公开记录
软件健康报告模式 0.27.0 · 指标 2.5.0 · 2026-08-01 10:27 UTC

QuiteYellow / SmartThings-Local

Local control of Samsung SmartThings appliances over cert-authenticated CoAP-DTLS. No cloud! Python library + Home Assistant MQTT bridge demo.

PythonMIT★ 33 星标⑂ 8 复刻始于 2026年5月在 GitHub 上查看 ↗
类型如何判定

QuiteYellow/SmartThings-Local 的健康指数为 100 分中的 53 分,处于「中等」区间。 其得分最高的类别是Vitality(72/100),最低的是Security(37/100)。 最近一次更新在今天。 近期的大部分工作由 1 位贡献者完成。

53
总分 / 100
中等

软件健康指数

指标归入加权类别,统一采用 1–100 量表。总体分先取类别加权平均,再依据公开记录的分布进行校准,使各等级具有百分位含义;当公开证据触发高风险司法辖区政策时,评级会按政策调整,并设置 34(存在风险)的上限。

53
卓越93-100公开记录中的最高层级(约前 5%);基本满足所有检验标准
优秀80-92各方面均表现强劲;仅有少量不足
良好65-79健康;不足之处有限且可控
中等50-64可接受,但存在明显不足;建议进行审查
薄弱35-49多个领域存在实质性薄弱环节
存在风险20-34存在重大薄弱环节;采用时应保持审慎
危急1-19问题严重(项目被弃置、仅有单一维护者、缺乏基本工程规范)
活力社区与采用可持续性与治理工程质量安全AI 就绪度

评分画像

每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形,而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。

加权总体分 52 经校准后在公布的指数量表上为 53(记录校准 2026-08-02)。

所有权

Quite Yellow个人账户
3 关注者6 个公开仓库始于 2013年7月

该仓库由个人账户拥有。相较于组织支持的项目,单一所有者项目的延续性风险更高。

软件包生态系统

注册表软件包版本月下载量版本数最近发布标签
PyPIsmartthings-local0.1.23,94030 天前coapdtlshome-assistantiotocfsamsungsmartthings

按类别列示的指标

活力

项目是否仍有生命——是否仍在编写代码,是否仍在发布版本?

72良好 · 占总体的 21%
评分方式
36/36推送新近度 — 最近一次推送于 0 天前
3.5/36提交节奏 — 52 周中有 5 周有提交
14.6/18提交量 — 最近一年 41 次提交
0/10OpenSSF Scorecard:Maintained — project was created within the last 90 days. Please review its contents carefully
所用输入
commits_last_year41
human_commit_share1
days_since_last_push0
active_weeks_last_year5

发布纪律

100卓越
评分方式
27/27有发布版本 — 已发布 3 个发布版本
36/36发布时效 — 最近一次发布版本于 0 天前
27/27发布节奏 — 约每 12.3 天发布一次
0/10OpenSSF Scorecard:Signed-Releases — 无数据
所用输入
releases_count3
latest_release_tagv0.1.2
releases_from_tags
days_since_latest_release0
mean_days_between_releases12.3
已排除计分(无数据或不适用):OpenSSF Scorecard:Signed-Releases。 其余权重已重新归一化。

社区与采用

项目是否拥有用户、下载量与关注度,并具备欢迎贡献者参与的配置?

45薄弱 · 占总体的 17%

流行度与采用

31存在风险
评分方式
24.4/60星标 — 33 个星标
7/25复刻 — 8 个复刻
0/15关注者 — 1 位关注者
所用输入
forks8
stars33
watchers1
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

社区健康

50中等
评分方式
22.5/22.5README
22.5/22.5许可证 — 可识别的许可证(MIT)
0/18CONTRIBUTING 指南
0/13.5行为准则
0/7.2议题模板
0/6.3PR 模板
所用输入
has_readme
has_license
readme_badges
has_contributing
has_issue_template
has_code_of_conduct
readme_badge_services
has_pull_request_template
评分方式
47.9/80月度下载量 — pypi 合计每月 3,940 次下载
0/20注册表被依赖数 — 该生态系统不报告此项
所用输入
packagessmartthings-local
dependents
ecosystemspypi
total_downloads
monthly_downloads3,940
已排除计分(无数据或不适用):注册表被依赖数。 其余权重已重新归一化。

可持续性与治理

项目能否在其成员之外延续——巴士系数、响应能力、由谁支持,以及软件包的维护状况?

52中等 · 占总体的 23%
评分方式
9/54巴士系数 — 1 位贡献者贡献了半数提交
10.2/22.5提交分布 — 头号贡献者编写了 55% 的提交
4.1/13.5贡献者广度 — 3 位贡献者
10/10OpenSSF Scorecard:Contributors — project has 3 contributing companies or organizations -- score normalized to 10
所用输入
bus_factor1
contributors_sampled3
top_contributor_share0.548
评分方式
21/42议题解决 — 50% 的议题已关闭
21.8/30PR 接受 — 已裁定的 PR 中 8/11 已合并
0/13Newcomer PR acceptance — 30 天内没有首次贡献者的 PR 得到裁决
4.5/15OpenSSF Scorecard:Code-Review — Found 3/8 approved changesets -- score normalized to 3
所用输入
merged_prs8
open_issues3
closed_issues3
prs_merged_7d
prs_decided_7d
prs_merged_30d
prs_decided_30d
issue_closed_ratio0.5
closed_unmerged_prs3
first_time_authors_30d
first_time_prs_merged_30d
first_time_prs_decided_30d
已排除计分(无数据或不适用):newcomer_pr_acceptance。 其余权重已重新归一化。
评分方式
10/30所有权背书 — 个人(用户)账户
0/20已验证域名 — 不适用于个人账户
4.3/25所有者影响力 — QuiteYellow 有 3 位关注者
18.2/25既往记录 — 6 个公开仓库,账户约 13 年
所用输入
followers3
owner_typeUser
is_verified
owner_loginQuiteYellow
public_repos6
account_age_days4,751
已排除计分(无数据或不适用):已验证域名。 其余权重已重新归一化。
评分方式
25/25已发布且可解析 — pypi 上有 1 个软件包
35/35发布时效 — 最近一次发布于 0 天前
12/20版本历史 — 3 个已发布版本
20/20未被弃用 — 活跃,未被弃用或撤回
所用输入
packagessmartthings-local
ecosystemspypi
any_deprecated
min_days_since_publish0

工程质量

基础的工程与文档实践是否到位?

53中等 · 占总体的 19%

工程实践

48薄弱
评分方式
24/24CI 工作流 — 1 个工作流
24/24存在测试
0/16Linter 配置
0/9.6Pre-commit 钩子
0/6.4.editorconfig
0/20OpenSSF Scorecard:CI-Tests — 0 out of 4 merged PRs checked by a CI test -- score normalized to 0
所用输入
has_ci
has_tests
has_editorconfig
has_linter_config
has_precommit_config

文档

60中等
评分方式
30/30README
0/25文档目录
0/15文档 / 主页站点
10/10仓库描述
10/10主题标签 — 5 个主题标签
10/10Wiki
所用输入
topicshome-assistant, iot, mqtt, samsung, smartthings
has_wiki
homepage
has_readme
has_docs_dir
has_description

安全

可见的安全与供应链实践是否稳固,且不存在未解决的高风险司法辖区暴露?

37薄弱 · 占总体的 16%

安全态势

37薄弱
评分方式
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — branch protection not enabled on development/release branches
0/2.5CI-Tests — 0 out of 4 merged PRs checked by a CI test -- score normalized to 0
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
2.2/7.5Code-Review — Found 3/8 approved changesets -- score normalized to 3
2.5/2.5Contributors — project has 3 contributing companies or organizations -- score normalized to 10
10/10Dangerous-Workflow — no dangerous workflow patterns detected
0/7.5Dependency-Update-Tool — no update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5许可证 — license file detected
0/7.5Maintained — project was created within the last 90 days. Please review its contents carefully
5/5Packaging — packaging workflow detected
0/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
0/5SAST — SAST tool is not run on all commits -- score normalized to 0
0/5Security-Policy — security policy file not detected
0/7.5Signed-Releases — 无数据
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
6/7.5Vulnerabilities — 2 existing vulnerabilities detected
所用输入
sourceopenssf_scorecard
checks_evaluated17
scorecard_versionv5.5.0
checks_inconclusive1
scorecard_aggregate3.7
已排除计分(无数据或不适用):signed_releases。 其余权重已重新归一化。

AI 就绪度

该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件?权重刻意设小(4%):代理工具链是一项真实的维护信号,但完全不具备的仓库仍可达到 100/100。

39薄弱 · 占总体的 4%
评分方式
0/45代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则
0/15机器可读文档(llms.txt)
40/40可读的提交历史 — 44 次人类提交中有 38 次说明了意图(结构化标题或解释性正文)
所用输入
has_llms_txt
legible_history_share0.864
agent_instruction_files
agent_instruction_max_bytes
评分方式
0/18一条命令的引导启动
22/22自动化测试
0/11Lint / 格式化配置
0/11静态类型检查
10/10可复现环境 — Dockerfile
0/10已体现的代理实践 — 最近 44 次提交中没有代理编写的提交
0/8自动化维护 — 未观察到自动依赖更新
0/10OpenSSF Scorecard:Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
所用输入
has_nix
has_tests
lockfiles
has_dockerfile
typed_language
bootstrap_files
has_devcontainer
has_linter_config
typecheck_configs
agent_commit_share0
toolchain_manifests
dependency_bot_commit_share0
评分方式
0/45可类型检查的代码 — Python,未配置类型检查
55/55可控的文件大小 — 采样的 28 个源文件中有 0 个超过 60KB
所用输入
primary_languagePython
largest_source_bytes36,289
source_files_sampled28
oversized_source_files0
评分方式
0/40API 模式(OpenAPI/GraphQL/proto)
0/20MCP 服务器
40/40可运行示例 — samples
所用输入
example_dirssamples
has_mcp_signal
api_schema_files

关键数据

33GitHub 星标
3贡献者
41最近 12 个月提交数
0距最近推送天数
3发布版本数
1巴士系数(bus factor)
3开放议题
PyPI软件包生态系统数

数据采集警告

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
  • GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
  • deps.dev does not index pypi:smartthings-local@0.1.2; advisories assessed against the repository dependency graph instead

更多细节

Star 与 Fork 历史 0 ★ / 8 ⇿
0Star
8Fork
2发布

每颗 star 和每个 fork 的添加时间,来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方,二者可相互对照:稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时,它会作为增长真实性予以报告。

02468832026-062026-072026-07
主版本 0次版本 1修订 1
OpenSSF Scorecard 3.7 / 10
3.7综合

来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身,而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用,并从安全评分中剔除(绝不按零分计)。Scorecard v5.5.0 · 2026-08-01 10:27 UTC

10Binary-Artifactsno binaries found in the repo
0Branch-Protectionbranch protection not enabled on development/release branches
0CI-Tests0 out of 4 merged PRs checked by a CI test -- score normalized to 0
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
3Code-ReviewFound 3/8 approved changesets -- score normalized to 3
10Contributorsproject has 3 contributing companies or organizations -- score normalized to 10
10Dangerous-Workflowno dangerous workflow patterns detected
0Dependency-Update-Toolno update tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
0Maintainedproject was created within the last 90 days. Please review its contents carefully
10Packagingpackaging workflow detected
0Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 0
0SASTSAST tool is not run on all commits -- score normalized to 0
0Security-Policysecurity policy file not detected
不适用Signed-Releasesno releases found
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
8Vulnerabilities2 existing vulnerabilities detected
直接依赖 2
注册表软件包版本约束清单文件
PyPIcbor2>=5.6pyproject.toml
PyPIpyOpenSSL>=23.0pyproject.toml
全部依赖 未采集

本报告未能采集到解析后的依赖集合:GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

原始 JSON 报告 机器可读
{
  "data": {
    "repo": {
      "topics": [
        "home-assistant",
        "iot",
        "mqtt",
        "samsung",
        "smartthings"
      ],
      "is_fork": false,
      "size_kb": 158,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Shell": 3423,
        "Python": 233695,
        "Dockerfile": 1103
      },
      "pushed_at": "2026-08-01T10:23:35Z",
      "created_at": "2026-05-25T18:01:12Z",
      "owner_type": "User",
      "updated_at": "2026-08-01T10:17:34Z",
      "description": "Local control of Samsung SmartThings appliances over cert-authenticated CoAP-DTLS. No cloud! Python library + Home Assistant MQTT bridge demo.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Python",
      "significant_languages": [
        "Python"
      ]
    },
    "owner": {
      "blog": "https://quiteyellow.studio",
      "name": "Quite Yellow",
      "type": "User",
      "login": "QuiteYellow",
      "company": null,
      "location": null,
      "followers": 3,
      "avatar_url": "https://avatars.githubusercontent.com/u/5108828?v=4",
      "created_at": "2013-07-28T22:34:29Z",
      "is_verified": null,
      "public_repos": 6,
      "account_age_days": 4751
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.1.2",
          "kind": "patch",
          "published_at": "2026-08-01T10:23:36Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2026-07-27T16:45:53Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-07-07T18:04:34Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "b7f2f20f2957217e8ae59f01f5943087b48c5608",
          "body": "Add a DTLS ClientHello probe as the liveness + diagnostic primitive",
          "is_bot": false,
          "headline": "Merge pull request #17 from QuiteYellow/feat/dtls-clienthello-probe",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-08-01T10:17:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "46041bfb2c248b769476c7166cd4ff2074d323be",
          "body": "Convert em-dash prose splices to varied punctuation (periods, colons,\nsemicolons, commas, parens), turn **Label.**-period bullets into\n**Label:** colons, drop sentence-spanning bold in \"Traps to avoid\", and\ncut a couple of hollow intensifiers.\n\nNo content, facts, tables, code, or links changed (50/50 line diff). Left\nas-is: the `## Part N —` headings (heading-anchor stability), everything\ninside code/log fences, table N/A cells, and numbered-list\n`**Bold** — desc` carve-outs.",
          "is_bot": false,
          "headline": "docs(readme): anti-AI writing pass",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-08-01T10:10:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a35cd59a1615f92a2f32aa1d17c21b650ee946d",
          "body": "…e bridge\n\nA stateless-by-default DTLS ClientHello probe that classifies a host:port\nas DEAD/LIVE/COMPLETED/REJECTED in ~1 RTT off the server's first flight,\nsitting in front of the full handshake.\n\nProbe (smartthings_local/protocol/dtls_probe.py):\n- Stateless liveness mode (default): stops at Hello\n[…]\nprobe behaviour (retransmit recovery, stateless single-flight\nguard, silent-port flight budget, diagnostic continuation) and bridge\nport-resolution (pinned gate, parallel discovery early-exit, cache).",
          "is_bot": false,
          "headline": "feat(protocol): add DTLS ClientHello liveness probe + wire it into th…",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-08-01T09:57:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c2108a510bf1942fda10e8e5c6057df83795e76",
          "body": "…essions\n\nRoot-cause fix for the stale-session stall on always-on appliances (#14).\nWhen the client dies without close_notify (crash, SIGKILL), the device\nkeeps an orphaned DTLS association keyed to the old 5-tuple; a reconnect\nfrom a fresh ephemeral port presents as a brand-new peer, so the orphan\n\n[…]\nven does not\nreproduce the fridge stall even with 11 crash-orphaned OBSERVE\nregistrations, so fridge-side confirmation of the eviction is still needed.\n\nCo-authored-by: vmvarga <garrysuchiy@gmail.com>",
          "is_bot": false,
          "headline": "feat(protocol): fixed DTLS source port so reconnects evict orphaned s…",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-26T19:53:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6653de3b2c281dbcf13d8cf0a9ccb25f23dd316f",
          "body": "- credit @indykoning + note localthings test path for the washer row\n- soften DV90T mnid grouping (mnid=0AJT confirmed on DV5000T only)\n- de-speculate the same-family note now that a washer is confirmed",
          "is_bot": false,
          "headline": "docs(readme): refine tested-combos after PR #13",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-26T17:44:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a2760eaa1129d8d4d246aab97adca82274b24e6a",
          "body": "Added tested machines",
          "is_bot": false,
          "headline": "Merge pull request #13 from indykoning/patch-1",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-26T17:43:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "231d2b5f1af9de98b6d4ceea6795ff39ce53ebd2",
          "body": null,
          "is_bot": false,
          "headline": "Added tested machines",
          "author_name": "indykoning",
          "author_login": "indykoning",
          "committed_at": "2026-07-23T11:19:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "072af1bfa1c93ffb06c107a149a604dea7138a72",
          "body": "- Lead with the pip-installable library; frame the MQTT bridge as a\n  reference demo. Add a library quick-start (install, DtlsCoapSession\n  example, in-memory cert_pem/key_pem variant).\n- Fix stale protocol/ + ocf/ references to smartthings_local/*; update\n  the repo-layout tree (nested package, ocf\n[…]\nble) from\n  the open oven remote-start problem.\n- Note the few write surfaces the cloud HA integration doesn't expose\n  (dryer course, oven setpoint). Drop the achieved collaborators-wanted\n  callout.",
          "is_bot": false,
          "headline": "docs(readme): reframe around the smartthings-local library",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-07T18:41:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c46dda976629efce46952c3fe75e3a2cc3b43612",
          "body": "Support in-memory PEM cert/key alongside file paths in DtlsCoapSession",
          "is_bot": false,
          "headline": "Merge pull request #12 from mbillow/cert-pem-support",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-07T16:33:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a2dc524c0b0468cca88f6c457518f15d9f0e9853",
          "body": "…Session\n\nlocalthings mints its client cert at runtime through the HA config flow\nand never writes it to disk. DtlsCoapSession only accepted cert_path/\nkey_path (file-based), which would have forced localthings to write its\nin-memory cert/key to disk on every connect just to migrate off its\nvendored\n[…]\nso exactly one cert source\n(file pair or PEM pair) is required. Existing file-path callers\n(mqtt_demo, setup_cert.py) are unaffected — verified against both real\nappliances with each constructor path.",
          "is_bot": false,
          "headline": "feat: support in-memory PEM cert/key alongside file paths in DtlsCoap…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-06T20:04:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3fdc735141e309d0e5545f67b866ae74fcb5de4d",
          "body": "…yPI packaging\n\nNest the two library packages under a single import namespace so they\ncan ship as one distribution:\n\n  protocol/ -> smartthings_local/protocol/\n  ocf/      -> smartthings_local/ocf/   (git mv, history preserved)\n\n- Rewrite all imports protocol.* -> smartthings_local.protocol.*,\n  ocf\n[…]\n.egg-info/).\n\nValidated: pytest tests/ (11 passed), python -m build produces sdist +\nwheel with the pem bundled, fresh pip install resolves all nested imports\nwith the pem readable from site-packages.",
          "is_bot": false,
          "headline": "feat(packaging): nest protocol/ + ocf/ under smartthings_local, add P…",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-06T19:29:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9004bac729f5bd44516c6bce1860395af8f0a5e3",
          "body": "Reorg into protocol/ + ocf/ + mqtt_demo/, port 3 DTLS reliability fixes",
          "is_bot": false,
          "headline": "Merge pull request #8 from mbillow/protocol-library-reorg",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-06T16:33:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ce6985ca3f4396b50b14de8477f758e82b573c8d",
          "body": "Task 8's port of retry/retransmit from localthings dropped the per-attempt\ntimeout/retry log lines (present in coap_dtls.py) — found while gathering\nreal-device pacing evidence, where the missing logs made retry frequency\nimpossible to see. Restores both the retry and final-timeout log lines.",
          "is_bot": false,
          "headline": "fix: restore Block2 retry debug logging dropped during port",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-05T21:51:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ff688f5d5d04954357594d24baf0ef9f8fe557f4",
          "body": "pace() slept the entire rate-limit interval every call regardless of how\nmuch of it had already elapsed since the last real send (e.g. spent\nprocessing the previous block's response). Track the last send timestamp\nand only sleep the remainder, recovering time already spent between\nrequests without c\n[…]\nd against 10.0.0.129/10.0.0.254: multi-block /device/0 fetches\nstill complete cleanly, faster per sweep, with the same request spacing\nguarantee (patch and measurement from QuiteYellow, PR #8 review).",
          "is_bot": false,
          "headline": "fix: residual inter-request pacing instead of blind full-interval sleep",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-05T21:51:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27480dcb1df110f433cf33d08874d09352bc743a",
          "body": "…docs",
          "is_bot": false,
          "headline": "fix: pace inter-tier polling; fix stale package-rename references in …",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T22:29:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a2d3da3b26425cbfc99af47faec20603a65cdbc",
          "body": "…rence-only",
          "is_bot": false,
          "headline": "docs: point HA users at localthings, freeze mqtt_demo/samples as refe…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T22:29:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "70baa3baf0041dc5173c27fcdeedfa506387ebb8",
          "body": null,
          "is_bot": false,
          "headline": "fix: rate-limit inter-request pacing to avoid RT-OCF request drops",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T22:29:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "58df1b242ff1d33582153cee5498c73ee483ce58",
          "body": "Ported from localthings fork: bounded per-block retransmission\n(_BLOCK_MAX_ATTEMPTS/_BLOCK_ACK_TIMEOUT) instead of a single attempt\nper block, SZX renegotiation tracking, and a bugfix moving\nconn.send(datagram) inside the try that catches its own SSL errors.",
          "is_bot": false,
          "headline": "fix: retry Block2 GETs on timeout, track server-negotiated block size",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T22:29:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0fc65339b53422c74a8f81afd589d6a962f811b3",
          "body": "…_NONE",
          "is_bot": false,
          "headline": "fix: validate device cert chain against OCF root CA instead of VERIFY…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T22:29:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c7232b3df6430bc3e39beec696915757af7b039d",
          "body": "…t false pass",
          "is_bot": false,
          "headline": "fix: isolate subprocess PYTHONPATH in import-isolation test to preven…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T22:29:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8a6bc8d594b0e0a907c88830ab2450185db27950",
          "body": "- Add test_import_isolation.py: isolation test that copies protocol/ and ocf/\n  to a temp directory without mqtt_demo/ and verifies all modules import\n- Add conftest.py: pytest configuration to add repo root to sys.path,\n  enabling tests to import protocol/ and ocf/ packages",
          "is_bot": false,
          "headline": "test: verify protocol/ + ocf/ import in isolation from mqtt_demo/",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T22:29:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4789ac8f55fe11362cc89df16698118c565eb169",
          "body": "…nt .env leaking into the image",
          "is_bot": false,
          "headline": "fix: include .dockerignore in deploy.sh's remote tar package to preve…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T21:22:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "554645409713381036317a58f6eae15257748ab8",
          "body": "…ndency",
          "is_bot": false,
          "headline": "fix: remove ocf/state_cache.py's stale mqtt_demo-descriptor type depe…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T21:17:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f573dddb14cf4a583e8b412c926ae38477637fce",
          "body": "… requirements-bootstrap.txt path",
          "is_bot": false,
          "headline": "fix: prevent .env from being baked into mqtt_demo image; fix dangling…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T21:15:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa9ec0f0d9a8b3513fde95328ca0883d28bf7f1e",
          "body": "… descriptors",
          "is_bot": false,
          "headline": "refactor: extract mqtt_demo/ — move bridge, config, logger, appliance…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T21:11:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24fc197a9e308ff9ad0c1c034bb0a6050115159c",
          "body": "…ex_device_tree",
          "is_bot": false,
          "headline": "refactor: extract ocf/ — fold sensors.index_links into StateCache.ind…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T21:02:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "10773bb8c88634bb004cacb8de57880f98979945",
          "body": "…ssion",
          "is_bot": false,
          "headline": "refactor: extract protocol/ — split CoAP wire helpers from DtlsCoapSe…",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T20:55:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d33b46171a4eb3b9cfae1da91590c4162e2b4d26",
          "body": null,
          "is_bot": false,
          "headline": "test: characterize CoAP wire encode/decode before extracting protocol/",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T20:50:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cae0592324ae79b6a8ab1cef95c9c158ab102140",
          "body": null,
          "is_bot": false,
          "headline": "test: add pytest as a dev dependency",
          "author_name": "Marc Billow",
          "author_login": "mbillow",
          "committed_at": "2026-07-04T20:49:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3cdfc6a3e6ba607f657f279afd9fad1db4df88b0",
          "body": "Merge PR #1: ARTIK051 fridge + session-recovery robustness",
          "is_bot": false,
          "headline": "Merge pull request #7 from QuiteYellow/artik-fridge",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-02T20:24:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b34f0e824889c49a6a700c1d4dc9b9461e8de430",
          "body": "- Add ARTIK051_REF_17K row to the tested-combinations table with a\n  link to aminorjourney's PR.\n- New 'Firmware families — a limitation' section under Part 1\n  explaining that descriptors are firmware-family-specific with no\n  runtime feature detection, so the wrong descriptor produces\n  half-broke\n[…]\nvestigial /hass paths, collection-resource door\n  model vs newer per-instance-resource fridges).\n- Update config-keys reference: CLASS list gains 'fridge',\n  OCF_PORT defaults list gains fridge=49155.",
          "is_bot": false,
          "headline": "Docs: fridge notes + firmware-family limitation callout",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-02T20:22:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "015e4a4e9e02773708038ba1e6caefefd278f236",
          "body": "- Suppress ConnectionError log noise from in-flight requests draining\n  after a session close (poll_scheduler + keepalive log at DEBUG).\n- Null KeepaliveTask.on_unreachable during a forced reconnect so the\n  dying session's keepalive can't flip HA availability offline after\n  the new session is alre\n[…]\ns last_success_ts + _maybe_force_reconnect\nalready covers the 'session dead, restart it' goal via a different\npath, and running both means two paths force-closing the same session\non the same failure.",
          "is_bot": false,
          "headline": "Session-recovery robustness (from PR #1)",
          "author_name": "Aminorjourney",
          "author_login": null,
          "committed_at": "2026-07-02T20:15:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "93f78f99a28ed3d7026c07bbbb8f97f5eebcab55",
          "body": "- Full resource map discovered via live CoAP-DTLS session against\n  ARTIK051_REF_17K fridge-freezer (firmware DA-REF-ART-COMMON-1_20201124)\n- seed_path: /device/0 (returns 32 links including hidden appliance resources)\n- Entities: fridge/freezer temp + setpoints, 3x door sensors (fridge,\n  freezer, \n[…]\nl_increasing),\n  water filter usage/status, ice maker, rapid fridge/freeze, sabbath mode\n- Port: 49155 (not 49154)\n\nFirst known public documentation of this firmware's local CoAP-DTLS\nresource layout.",
          "is_bot": false,
          "headline": "feat: add Samsung ARTIK051_REF_17K fridge-freezer descriptor",
          "author_name": "Aminorjourney",
          "author_login": null,
          "committed_at": "2026-07-02T20:10:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e4c6702c489bb93842b39d41e1cbc9fd7226e64f",
          "body": null,
          "is_bot": false,
          "headline": "Add MIT license",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-07-01T19:30:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e9a30d96f9df5b8070efd7e16c39835c22d1fb0f",
          "body": null,
          "is_bot": false,
          "headline": "Drop dangling local-tools/ references from README",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-06-30T18:51:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "788408da9a88742bbe089ada0b789b9c8d458674",
          "body": null,
          "is_bot": false,
          "headline": "Update README.md",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-06-30T18:49:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "27a614fcb8207f298471dc8d846d2c074dade9ee",
          "body": "Production-hardening pass: half-open detection, cascade throttle, OBSERVE refresh, lamp/door coupling",
          "is_bot": false,
          "headline": "Merge pull request #5 from QuiteYellow/production-hardening",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-06-30T18:36:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "19946e21d7342054b559ae19870c148754155076",
          "body": "Ship setup_cert.py to repo root, auto-fetch all CA materials",
          "is_bot": false,
          "headline": "Merge pull request #3 from QuiteYellow/cert-refactor",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-06-30T18:33:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "36acf3a209f86b9e292221ef3f35a9a110960682",
          "body": "…ERVE refresh, lamp/door coupling\n\nFour failure modes observed in-house since the polling-first refactor\n(709fdf4):\n\n1. Half-open DTLS sessions where the socket stays writable but the peer\n   has gone silent. Ping sends succeed against a wedged peer because\n   RT-OCF doesn't reliably emit a RST; onl\n[…]\n ANSI-coloured WARNING/ERROR lines (NO_COLOR=1 opt-out), jittered\nreconnect backoff so dryer + oven don't sync up after a router blip.\n\nIn-house verification: running on dryer + oven since 2026-06-03.",
          "is_bot": false,
          "headline": "Production-hardening pass: half-open detection, cascade throttle, OBS…",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-06-30T18:27:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0374f8cf687083fc3c8229188f31dab80bf5d977",
          "body": "Closes #2.\n\nPreviously the cert minting script lived in local-tools/ (gitignored)\nand the README pointed at a cert-only source that didn't include the\nprivate key or upstream chain.\n\nsetup_cert.py now lives at the repo root and live-fetches both the\npeer UUID (from the relevant TLS server cert subje\n[…]\nn commit 709fdf4.\n\nOutput files use neutral client.* names. README, .env.example,\ndocker-compose.yml, deploy.sh, and config.py updated to match.\n\nProvenance receipts in local-tools/cert_provenance.md.",
          "is_bot": false,
          "headline": "Ship setup_cert.py to repo root, auto-fetch all CA materials",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-06-30T18:27:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "709fdf444da7c687b5b1b28c825712234e26ebdc",
          "body": "State freshness now comes from a tiered PollScheduler over the persistent\nDTLS session; OBSERVE registrations are kept as an opportunistic\nacceleration layer. Behaviour is identical online vs air-gapped except\nfor worst-case freshness latency.\n\nAdds three modules:\n- StateCache: single source of trut\n[…]\nier; PING_INTERVAL_S now consumed by KeepaliveTask inside the bridge\nrather than driven from main.py.\n\nREADME explains the push/poll split and what happens when the appliance\nis blocked from internet.",
          "is_bot": false,
          "headline": "Refactor to polling-first architecture with OBSERVE as accelerator",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-06-03T17:38:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8775f7a9301872a2c1c9c1f95b58a5b0143000b4",
          "body": "Major session of local-OCF reverse engineering against the NV7000BS\noven and DV5000T dryer. Surfaces a working set of HA entities for the\noven and resolves several Samsung-quirk regressions in the bridge's\nwrite path.\n\nKey behavioural fixes:\n- OBSERVE registrations now use single-byte tokens. Samsun\n[…]\nvar enables verbose tracing (rx CON/NON/ACK/\n  RST per frame, full link-tree dump at seed, /oic/res directory,\n  REP changes on /operational/state, /oven, /power, mode options).\n  Quiet in production.",
          "is_bot": false,
          "headline": "Add oven controls and fix Samsung-OCF write semantics",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-05-31T19:43:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "85580d81b7d12c316a3f2e7447692752800a60cc",
          "body": null,
          "is_bot": false,
          "headline": "Update README.md",
          "author_name": "Quite Yellow",
          "author_login": "QuiteYellow",
          "committed_at": "2026-05-31T14:51:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c99ef324fc1ab7cea777d1198e5d7970bafe1219",
          "body": null,
          "is_bot": false,
          "headline": "Initial commit",
          "author_name": "Jack Nagy",
          "author_login": "QuiteYellow",
          "committed_at": "2026-05-31T14:50:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 3,
      "commits_last_year": 41,
      "latest_release_at": "2026-08-01T10:23:36Z",
      "latest_release_tag": "v0.1.2",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 5,
      "days_since_latest_release": 0,
      "mean_days_between_releases": 12.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "smartthings-local",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "coap",
            "dtls",
            "home-assistant",
            "iot",
            "ocf",
            "samsung",
            "smartthings",
            "Development Status :: 3 - Alpha",
            "Intended Audience :: Developers",
            "Programming Language :: Python :: 3",
            "Topic :: Home Automation",
            "Topic :: System :: Networking"
          ],
          "ecosystem": "pypi",
          "matches_repo": true,
          "registry_url": "https://pypi.org/project/smartthings-local/",
          "is_deprecated": false,
          "latest_version": "0.1.2",
          "repository_url": "https://github.com/QuiteYellow/SmartThings-Local",
          "versions_count": 3,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": 3940,
          "first_published_at": "2026-07-07T16:37:07.815172Z",
          "latest_published_at": "2026-08-01T10:24:59.973243Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 0
        }
      ]
    },
    "popularity": {
      "forks": 8,
      "stars": 33,
      "watchers": 1,
      "fork_history": {
        "days": [
          {
            "date": "2026-06-27",
            "count": 1
          },
          {
            "date": "2026-07-19",
            "count": 1
          },
          {
            "date": "2026-07-23",
            "count": 1
          },
          {
            "date": "2026-07-26",
            "count": 1
          },
          {
            "date": "2026-07-29",
            "count": 3
          },
          {
            "date": "2026-07-31",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 8,
        "total_forks": 8
      },
      "star_history": null,
      "open_issues_and_prs": 3
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "samples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [],
      "largest_source_bytes": 36289,
      "source_files_sampled": 28,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "mqtt_demo/requirements.txt",
        "pyproject.toml",
        "requirements-bootstrap.txt",
        "requirements-dev.txt"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "pypi"
      ],
      "dependencies": [
        {
          "name": "cbor2",
          "manifest": "pyproject.toml",
          "ecosystem": "pypi",
          "version_constraint": ">=5.6"
        },
        {
          "name": "pyOpenSSL",
          "manifest": "pyproject.toml",
          "ecosystem": "pypi",
          "version_constraint": ">=23.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 8,
        "open_issues": 3,
        "closed_ratio": 0.5,
        "closed_issues": 3,
        "closed_unmerged_prs": 3
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "QuiteYellow",
          "commits": 23,
          "avatar_url": "https://avatars.githubusercontent.com/u/5108828?v=4"
        },
        {
          "type": "User",
          "login": "mbillow",
          "commits": 18,
          "avatar_url": "https://avatars.githubusercontent.com/u/8651166?v=4"
        },
        {
          "type": "User",
          "login": "indykoning",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/15870933?v=4"
        }
      ],
      "contributors_sampled": 3,
      "top_contributor_share": 0.548
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "publish.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 0,
            "reason": "0 out of 4 merged PRs checked by a CI test -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 3,
            "reason": "Found 3/8 approved changesets -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 3 contributing companies or organizations -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 8,
            "reason": "2 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "b7f2f20f2957217e8ae59f01f5943087b48c5608",
        "ran_at": "2026-08-01T10:27:23Z",
        "aggregate_score": 3.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-08-01T10:25:03Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-08-01T10:17:24Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 9,
          "created_at": "2026-07-05T09:48:33Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 10,
          "created_at": "2026-07-06T16:32:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 16,
          "created_at": "2026-07-29T18:52:39Z",
          "last_comment_at": "2026-08-01T02:04:43Z",
          "last_comment_author": "jjyn0215"
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/QuiteYellow/SmartThings-Local",
    "host": "github.com",
    "name": "SmartThings-Local",
    "owner": "QuiteYellow"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": "The weighted overall 52 is calibrated to 53 on the published index scale (record calibration 2026-08-02).",
      "notes": [
        {
          "code": "overall_calibration",
          "params": {
            "raw": 52,
            "calibrated": 53,
            "calibration": "2026-08-02"
          }
        }
      ],
      "value": 53,
      "inputs": {
        "security": 37,
        "vitality": 72,
        "community": 45,
        "governance": 52,
        "calibration": "2026-08-02",
        "engineering": 53,
        "ai_readiness": 39,
        "weighted_overall_raw": 52
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 72,
        "weight": 0.21,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "commits_last_year": 41,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 5
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "5/52 weeks with commits",
                "points": 3.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "41 commits in the last year",
                "points": 14.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 41
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "exceptional",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 3,
              "latest_release_tag": "v0.1.2",
              "releases_from_tags": false,
              "days_since_latest_release": 0,
              "mean_days_between_releases": 12.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "3 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~12.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 12.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "exceptional",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "weak",
        "name": "Community & Adoption",
        "value": 45,
        "weight": 0.17,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 31,
            "inputs": {
              "forks": 8,
              "stars": 33,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "33 stars",
                "points": 24.4,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 33
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "8 forks",
                "points": 7,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 8
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "readme_badges": null,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "readme_badge_services": [],
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "packages": [
                "smartthings-local"
              ],
              "dependents": null,
              "ecosystems": "pypi",
              "total_downloads": null,
              "monthly_downloads": 3940
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "3,940 downloads/month across pypi",
                "points": 47.9,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 3940,
                      "ecosystems": "pypi"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 52,
        "weight": 0.23,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "at_risk",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 33,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 3,
              "top_contributor_share": 0.548
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 55% of commits",
                "points": 10.2,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 55
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "3 contributors",
                "points": 4.1,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 3 contributing companies or organizations -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "newcomer_pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 54,
            "inputs": {
              "merged_prs": 8,
              "open_issues": 3,
              "closed_issues": 3,
              "prs_merged_7d": null,
              "prs_decided_7d": null,
              "prs_merged_30d": null,
              "prs_decided_30d": null,
              "issue_closed_ratio": 0.5,
              "closed_unmerged_prs": 3,
              "first_time_authors_30d": null,
              "first_time_prs_merged_30d": null,
              "first_time_prs_decided_30d": null
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "50% of issues closed",
                "points": 21,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 50
                    }
                  }
                ],
                "max_points": 42
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "8/11 decided PRs merged",
                "points": 21.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 8,
                      "decided": 11
                    }
                  }
                ],
                "max_points": 30
              },
              {
                "key": "newcomer_pr_acceptance",
                "name": "Newcomer PR acceptance",
                "detail": "no first-time contributor's PR decided in 30d",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_newcomer_prs",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 13
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 3/8 approved changesets -- score normalized to 3",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "weak",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 41,
            "inputs": {
              "followers": 3,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "QuiteYellow",
              "public_repos": 6,
              "account_age_days": 4751
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "3 followers of QuiteYellow",
                "points": 4.3,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 3,
                      "login": "QuiteYellow"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "6 public repos, account ~13 yr old",
                "points": 18.2,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 6
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 13
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "packages": [
                "smartthings-local"
              ],
              "ecosystems": "pypi",
              "any_deprecated": false,
              "min_days_since_publish": 0
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on pypi",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "pypi"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 0 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "3 published versions",
                "points": 12,
                "status": "partial",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 53,
        "weight": 0.19,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "weak",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 48,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "0 out of 4 merged PRs checked by a CI test -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "topics": [
                "home-assistant",
                "iot",
                "mqtt",
                "samsung",
                "smartthings"
              ],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "5 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "weak",
        "name": "Security",
        "value": 37,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "weak",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 37,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 3.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "0 out of 4 merged PRs checked by a CI test -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 3/8 approved changesets -- score normalized to 3",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 3 contributing companies or organizations -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "2 existing vulnerabilities detected",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "exceptional",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "commit_weight_rule": {
                "min_commits": 50,
                "min_commit_share": 0.1
              },
              "review_only_matches": 0,
              "below_threshold_exposures": [],
              "assessed_self_published_locations": 4
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "weak",
        "name": "AI Readiness",
        "value": 39,
        "weight": 0.04,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "weak",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.864,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "38 of 44 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 38,
                      "sampled": 44
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "at_risk",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 32,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [],
              "has_dockerfile": true,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 44",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 44
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "moderate",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "primary_language": "Python",
              "largest_source_bytes": 36289,
              "source_files_sampled": 28,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Python without a type-check config",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_typecheck_config_language",
                    "params": {
                      "language": "Python"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/28 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 28,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "weak",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "samples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "samples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "samples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
      }
    ],
    "classification": {
      "top": [
        "library"
      ],
      "labels": [
        "library"
      ],
      "scores": {
        "library": 8
      },
      "primary": "library",
      "evidence": [
        {
          "tier": "distribution",
          "label": "library",
          "source": "registry:pypi",
          "weight": 6
        },
        {
          "tier": "description",
          "label": "library",
          "source": "description:library",
          "weight": 2
        }
      ],
      "artifacts": [],
      "confidence": "medium",
      "host_extension": false,
      "runs_as_process": false,
      "consumed_by_code": true
    },
    "metrics_version": "2.5.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
    "deps.dev does not index pypi:smartthings-local@0.1.2; advisories assessed against the repository dependency graph instead"
  ],
  "report_type": "repository",
  "generated_at": "2026-08-01T10:27:36.614239Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/q/QuiteYellow/SmartThings-Local.svg",
  "full_name": "QuiteYellow/SmartThings-Local",
  "license_state": "standard",
  "license_spdx": "MIT"
}

评分是信号,而非担保。 评分反映的是 GitHub 上公开可见的实践——不是代码审计,也不是安全保证。

缺失数据将被剔除并重新归一化权重,绝不按零分计。方法论已版本化并公开:指标 v2.5.0、模式 v0.27.0—— 完整方法论 · 指标知识库.

单项结果在整体记录中的位置: 汇总统计PyPI.