ai8future / chassis-go

本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 15943,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 1375141,
        "Shell": 20296
      },
      "pushed_at": "2026-07-22T03:24:19Z",
      "created_at": "2026-02-03T18:46:40Z",
      "owner_type": "User",
      "updated_at": "2026-07-22T03:24:25Z",
      "description": null,
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "ai8future",
      "type": "User",
      "login": "ai8future",
      "company": null,
      "location": null,
      "followers": 0,
      "avatar_url": "https://avatars.githubusercontent.com/u/2287988?v=4",
      "created_at": "2012-09-05T22:44:07Z",
      "is_verified": null,
      "public_repos": 11,
      "account_age_days": 5071
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v11.3.24",
          "kind": "patch",
          "published_at": "2026-07-19T07:49:18Z"
        },
        {
          "tag": "v11.3.0",
          "kind": "minor",
          "published_at": "2026-07-02T17:59:31Z"
        },
        {
          "tag": "v11.1.3",
          "kind": "patch",
          "published_at": "2026-04-16T06:44:36Z"
        },
        {
          "tag": "v11.0.1",
          "kind": "patch",
          "published_at": "2026-04-11T14:13:16Z"
        },
        {
          "tag": "v11.0.0",
          "kind": "major",
          "published_at": "2026-04-11T13:50:38Z"
        },
        {
          "tag": "v10.0.7",
          "kind": "patch",
          "published_at": "2026-03-26T21:24:46Z"
        },
        {
          "tag": "v9.0.0",
          "kind": "major",
          "published_at": "2026-03-08T09:59:47Z"
        },
        {
          "tag": "v6.0.9",
          "kind": "patch",
          "published_at": "2026-03-07T08:27:39Z"
        },
        {
          "tag": "v5.0.0",
          "kind": "major",
          "published_at": "2026-02-08T11:22:42Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2026-02-05T22:10:59Z"
        },
        {
          "tag": "v1.0.3",
          "kind": "patch",
          "published_at": "2026-02-03T19:36:57Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "20ddc268f6faa4d1ff991a12d844e055e31e10ad",
          "body": "Contain external HTTP propagation to an explicit per-client policy and give scanner services a checked, single-owner OTLP lifecycle without changing legacy defaults for callers that do not opt in.\n\nConstraint: Existing call clients retain process-global propagation, while fail-closed consumers expli\n[…]\ntric TLS receipt; scanner_core propagation, TLS-override, and invalid-init probes\nNot-tested: hosted GitHub Actions, Docker E2E, and the full external live-service integration matrix after this commit",
          "is_bot": false,
          "headline": "Keep scanner telemetry boundaries fail-closed",
          "author_name": "ai8future",
          "author_login": "ai8future",
          "committed_at": "2026-07-22T03:24:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bbf37b0d29e18d9bd9bfd65d611e1bbc1c78a9cf",
          "body": "Add an explicit compatibility-preserving redaction boundary in call and raise the text dependency above the vulnerability floor used by authentication normalization.\n\nConstraint: Existing clients retain legacy request and telemetry behavior unless they opt in; release is based on remote VERSION 11.3\n[…]\n OTel Collector integration; Linux/Darwin cross-builds; auth/seal fuzz and isolated webhook fuzz rerun\nNot-tested: hosted GitHub Actions and the unrelated full external live-service integration matrix",
          "is_bot": false,
          "headline": "Prevent scanner request secrets from entering exported telemetry",
          "author_name": "ai8future",
          "author_login": "ai8future",
          "committed_at": "2026-07-21T23:28:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "73b2c6b5649da29218c86a80c076370c04e7671a",
          "body": "The email AI prerequisite gate requires stable partition keys, broker readiness,\nand a consumed-key check without changing the existing event envelope or\nunkeyed publish behavior. Port the audited kafkakit additions onto fresh\norigin/main so the release candidate retains upstream provenance and excl\n[…]\nnt=1; go test ./... -count=1; go vet ./...; go mod tidy -diff; git diff --check\nNot-tested: Live broker ping, partition placement, and slow-batch rebalance behavior remain operational release evidence",
          "is_bot": false,
          "headline": "Unblock durable email ingestion on released Kafka contracts",
          "author_name": "C Shaw",
          "author_login": null,
          "committed_at": "2026-07-19T07:49:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8b5b5cdee2c4da31b1e5fe100cee3dacca481453",
          "body": "Constraint: Documentation-only correction; implementation and tests remain unchanged.\n\nRejected: Daemon-wide volume parity wording | unrelated Docker volume churn is intentionally permitted\n\nConfidence: high\n\nScope-risk: narrow\n\nDirective: Keep G009 evidence scoped to disappearance of every exact ca\n[…]\npolicies; tidy diff and module verify; staged diff checks; pinned Redpanda live proof with owned=1 remaining=0.\n\nNot-tested: Exact-SHA hosted push CI and workflow_dispatch nightly pending this commit.",
          "is_bot": false,
          "headline": "Keep G009 release evidence aligned with exact-owned cleanup semantics",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T06:42:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1bdf8fd145ea008df1b3da6c918c14ff402ae1f2",
          "body": "Constraint: Redpanda cleanup must fail closed for captured anonymous volume IDs while preserving unrelated daemon activity.\nRejected: Daemon-wide inventory parity, daemon locks, or global pruning | unrelated Docker activity must remain independent and untouched\nConfidence: high\nScope-risk: narrow\nDi\n[…]\ny, pinned static/security/lint, cross-build/schema, CI topology, Bash syntax, and diff checks\nNot-tested: credentialed/manual T4 provider systems outside the repository's public credential-free matrix",
          "is_bot": false,
          "headline": "Keep exact Docker cleanup reliable during concurrent volume churn",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T06:10:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bb101dd5e6af26383f84c558694b8297996aa1a2",
          "body": "Remove anonymous volumes only with the exact owned container, and prove cleanup at argument and live-Docker boundaries.\n\nConstraint: Cleanup must remain exact-owner bounded and preserve existing timeout, diagnostics, and primary-versus-cleanup error behavior.\nRejected: Global volume pruning or volum\n[…]\n, race, coverage, E2E contracts, five live integrations, exact nightly, static/security/lint, module, policy, and cross-build gates\nNot-tested: Hosted push and workflow_dispatch CI pending this commit",
          "is_bot": false,
          "headline": "Prevent test cleanup from silently leaking Docker storage",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T05:19:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0961feb915a63d7647d3b9a55739c32bd1d4b37",
          "body": "…ases\n\nKeep deterministic defaults service-free while making selected hosted and nightly evidence fail closed, observable, and cleanup-truthful.\n\nConstraint: Preserve T0-T4 boundaries, exact nightly inventory, immutable image pins, and existing public semantics.\n\nRejected: Health-only restart and sk\n[…]\nE optional/required/negative, all integrations, full nightly, vet, pinned analyzers, modules, formatting, policy, cross-builds.\n\nNot-tested: Hosted push and workflow_dispatch runs pending this commit.",
          "is_bot": false,
          "headline": "Prevent incomplete Docker resilience evidence from greenlighting rele…",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T03:25:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b2ae329098815d618d83bc88b50fed58bf4f0c55",
          "body": "Make package enumeration an explicit fail-closed precondition before fuzz discovery so partial go list output cannot be reported as a completed nightly fuzz run.\n\nConstraint: G007 final blocker requires preserving go list stderr, no fuzz completion after enumeration failure, version 11.3.19, changel\n[…]\n --default=none --enable=govet --enable=ineffassign --enable=unused ./...; cross-build/schema proof; bounded nightly smoke.\n\nNot-tested: unreduced live nightly matrix; hosted CI completion after push.",
          "is_bot": false,
          "headline": "Prevent nightly fuzz false greens on package enumeration failure",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T02:06:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "16425f9942609f10d18603a2494f3db72776578b",
          "body": "Discovery now fails package-by-package while preserving stderr and target enumeration, with topology proof covering the former false-green path.\n\nConstraint: G007 required no new dependency, no fake production seam, VERSION/CHANGELOG update, bug note, commit, and push from current main.\nRejected: Co\n[…]\nLY_INTEGRATIONS=none CHASSIS_NIGHTLY_RESTART_SERVICES=none ./scripts/test-nightly.sh\nNot-tested: full live nightly matrix with integrations and restart probes; delegated final verifier owns that gate.",
          "is_bot": false,
          "headline": "Ensure nightly fuzz failures cannot masquerade as success",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T01:51:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "26870276321af4ce9d5dfa5b4879a7e861a91678",
          "body": "Remove unread container copies and obsolete range-variable shadows while preserving cleanup ownership and Go 1.26 range semantics.\n\nConstraint: Preserve G006 behavior, evidence semantics, tier boundaries, pins, and timeouts\nRejected: Consolidate package-local integration helpers | would add cross-pa\n[…]\ntegration/E2E before and after; unit, race, coverage, E2E, tagged vet, go vet, module checks\nNot-tested: live T2 services and scheduled nightly were not rerun after the deletion; locked by G006 commit",
          "is_bot": false,
          "headline": "Keep integration evidence fixtures focused on observed state",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T01:42:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8e5269f767dc1eb0682a5bf0f61d1fb6bb5525bd",
          "body": "Allow the pinned non-root collector to write only within dedicated receipt mounts, retain unique nightly evidence, and align the module graph with direct integration imports.\n\nConstraint: The pinned collector runs as UID/GID 10001 and must remain unprivileged.\nRejected: Run the collector as root or \n[…]\nDarwin arm64, and Linux 386 compile proofs.\nNot-tested: The complete 60-minute scheduled nightly orchestration was not run locally; its OTel integration component and topology were validated directly.",
          "is_bot": false,
          "headline": "Keep G006 telemetry proof reliable across Linux CI",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T01:17:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8788d2fb004f56c08a7653e37806c5fd03e71ec4",
          "body": "Address independent verifier findings by closing existing per-file RequireMajor gaps and moving hosted CI action pins to current official majors while preserving the installed workflow topology tests.\n\nConstraint: Leader reminder required per-file RequireMajor evidence, installed workflow proof, cur\n[…]\n19f633c-8865-7913-a8f9-8e336fca5548 PASS.\n\nNot-tested: Full live Docker integration matrix was not rerun after this narrow verifier follow-up; previous G006 commit ran scripts/test-integration.sh all.",
          "is_bot": false,
          "headline": "Keep CI topology gates aligned with current evidence",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T00:48:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f7f00f4554b441153a88782724d309b86b10f393",
          "body": "Wire the remaining G006 proof surfaces around the existing live integration checkpoint: durable artifacts, nightly script resilience selectors, static topology regressions, image-pin failure coverage, and race-stable bounded decode testing.\n\nConstraint: G006 requires public PR jobs to stay credentia\n[…]\nest-integration.sh all; git diff --check.\n\nNot-tested: Full default nightly restart/repetition job was not run locally; safe bounded nightly smoke and full live integration all-suite were run instead.",
          "is_bot": false,
          "headline": "Make CI resilience evidence release-provable",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T00:34:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f82a311ab1546ceb0769a4ee34f743960953a3e4",
          "body": null,
          "is_bot": false,
          "headline": "omx(team): auto-checkpoint worker-1 [1]",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T00:20:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4008a434b01345cf4fa35f38f355372c46ed1314",
          "body": "G005 needs public-PR-safe T2 evidence for adapter behavior without making default tests start services. Add integration-tag suites, immutable image registry checks, and documentation that separates local T2 proof from hosted/manual T4 and G006 restart/soak work.\n\nConstraint: G005 requires selected l\n[…]\nrage.sh; ./scripts/test-unit.sh; ./scripts/test-e2e.sh; go vet ./...; git diff --check\nNot-tested: Hosted credentialed provider accounts; long-running restart/soak/nightly scenarios reserved for G006.",
          "is_bot": false,
          "headline": "Prove live adapter contracts against pinned local runtimes",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-15T00:04:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "097b11c1be51a3762c307aa4cd9fd92e9db8f01c",
          "body": "Constraint: G004 requires selected live-service evidence without making default go test depend on Docker.\n\nRejected: Duplicate redpanda registry rows | would allow marker masking across packages.\n\nRejected: Adding Event key APIs or publisher seams | raw franz-go fixtures prove key/header preservatio\n[…]\npanda; go test ./...; go test -race ./...; ./scripts/check-coverage.sh; go vet ./...; git diff --check\n\nNot-tested: Broker restart/reconnect/soak scenarios; kept for explicit nightly/manual selection.",
          "is_bot": false,
          "headline": "Prove Kafka and Schema Registry behavior against pinned Redpanda",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-14T23:33:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4a9aeb9abe6ef4444a13f69e7f0c37c0e1c07679",
          "body": "Add a build-tagged T1 E2E suite so shipped examples and demo binaries are proven through their current process, TCP, HTTP, gRPC, and Docker contracts without burdening the default deterministic suite.\n\nConstraint: G003 required real loopback readiness, subprocess behavior, dynamic-port Docker covera\n[…]\nacity.\n\nTested: ./scripts/test-e2e.sh; go test ./...; go test -race ./...; ./scripts/check-coverage.sh; go vet ./...\n\nNot-tested: Docker-unavailable skip path on a host without a Docker CLI or daemon.",
          "is_bot": false,
          "headline": "Make shipped executable behavior release-provable",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-14T23:07:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4deefaf955be33efe61a96af111fd487ebccaf1",
          "body": "Close the named auth, lifecycle, app-version, and Kafka gaps, then cover adjacent deterministic library paths needed to enforce the approved aggregate and per-package floors without production seams or dependencies.\n\nConstraint: Preserve dependency-free go test ./... and keep .omx/ultragoal leader-o\n[…]\nons\nTested: go test ./...; go test -race ./...; go vet ./...; scripts/check-coverage.sh; authkit fuzz smoke\nNot-tested: Live Kafka success publication remains assigned to the Redpanda integration tier",
          "is_bot": false,
          "headline": "Make critical release behavior deterministically provable",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-14T22:47:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ed1e7613800bcc51843d17428434a766e198c49d",
          "body": "Establish the deterministic G001 harness, strict expiring coverage governance, and honest tier scripts without implementing later live scenarios.\n\nConstraint: G001 must preserve dependency-free default tests and add no Go dependency.\n\nRejected: Log-only integration markers | suppressed output and sk\n[…]\nk-coverage.sh; scripts/test-e2e.sh; empty integration all refusal; go vet ./...; gofmt; bash -n; git diff --check.\n\nNot-tested: Live external-service scenarios are intentionally deferred to G004-G006.",
          "is_bot": false,
          "headline": "Prevent test tiers from reporting evidence they did not run",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-14T22:24:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b64fa569af0b02bd93ba1ec343988ba2eb5f210",
          "body": "Detach bounded idempotency cleanup from request cancellation, validate effective Kafka settings before client creation, and turn franz-go blocked-rebalance signals into bounded manual-batch handoff. Add fail-fast CI contracts for per-file version gates and malformed webhook verification.\n\nConstraint\n[…]\nt; tidy/verify; actionlint; staticcheck; golangci-lint; govulncheck; Linux/Darwin builds; Linux 386 schemakit compile.\nNot-tested: Live multi-member Kafka rebalance against an external broker cluster.",
          "is_bot": false,
          "headline": "Prevent cancelled work from stranding retry and rebalance progress",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-13T18:26:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "36d69bfe64159d3ee26a2f816f8b5581082cbade",
          "body": "Keep health failure ownership in work.Map and remove a dead Kafka legacy binding without changing v11 runtime behavior.\n\nConstraint: Preserve public v11 compatibility and all approved legacy/fail-safe behavior.\nRejected: Remove compatibility fallbacks or broader subscriber seams | Those paths are co\n[…]\ne tests for health and kafkakit; full go test ./...; go vet ./...; gofmt; go mod tidy -diff; go mod verify.\nNot-tested: staticcheck, golangci-lint, and govulncheck were unavailable in the local shell.",
          "is_bot": false,
          "headline": "Reduce duplicated state in audited execution paths",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-13T18:01:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "75c44ee295ee1cd911a81df552237f82d78586dc",
          "body": "Remove deprecated action runtimes and make the response-bound regression efficient enough that race instrumentation tests the invariant instead of scheduler speed.\n\nConstraint: The mandatory full race gate must remain reliable on two-core GitHub-hosted runners\nRejected: Removing or weakening the bou\n[…]\nr with an unbounded allocation\nAgent: Codex:gpt-5.5-high\nTested: lakekit race count 20; full race with GOMAXPROCS=2; full tests; vet; actionlint; tidy diff\nNot-tested: Hosted CI is verified after push",
          "is_bot": false,
          "headline": "Keep hosted release evidence stable under constrained runners",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-13T17:49:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "907a5e4cd1391b80dbdb6699787ee8bbd6e1deba",
          "body": "Raise the supported toolchain to the patched Go floor and make CI prove formatting, module integrity, static quality, security, coverage, race safety, fuzz resilience, and target portability with exact tool pins.\n\nConstraint: Go 1.26.5 must be the consistent minimum across module, CI, documentation,\n[…]\nuzz/cross-build matrix; vet; staticcheck v0.7.0; govulncheck v1.6.0; golangci-lint v2.12.2; actionlint v1.7.7; gofmt; tidy; module verification\nNot-tested: GitHub-hosted runner execution prior to push",
          "is_bot": false,
          "headline": "Require reproducible evidence before releasing toolkit changes",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-13T17:43:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "72241d2c7db97f058b7839a2c88aeaf5a012803c",
          "body": "… loss\n\nValidate declared franz-go settings before client creation and add an explicit manual-contiguous path that keeps poison records, partition ordering, and commit boundaries durable without breaking v11 call sites.\n\nConstraint: Preserve v11 source compatibility and franz-go v1.20.7 behavior.\nRe\n[…]\n...; go mod verify; gofmt and diff checks.\nNot-tested: Live Kafka/Redpanda broker integration; repository go mod tidy -diff has the pre-existing x/text directness delta reserved for the CI-gate story.",
          "is_bot": false,
          "headline": "Prevent Kafka configuration and offset ownership from hiding delivery…",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-13T17:32:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "254cbe2baf31aea96831cc8492e1eedaf9499dd5",
          "body": "Keep v11 compatibility while making mutation retry policy, schema conversions, validation operators, and queued analytics ownership explicit and fail-safe.\n\nConstraint: Preserve generic call.WithRetry behavior and public v11 data types while adding stricter package-specific safeguards.\nRejected: Inv\n[…]\nkit test-binary compile; go test -timeout=120s -count=1 ./...; go vet ./...; staticcheck v0.7.0 ./...; gofmt and diff checks.\nNot-tested: Live external Schema Registry and PostHog service integration.",
          "is_bot": false,
          "headline": "Prevent retries and deferred ownership from crossing safety boundaries",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-13T17:09:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2dd9b6121c9eda8908472580d27614ff82d35277",
          "body": "Preserve the v11 Store boundary while adding opt-in token ownership, bounded capture, and deterministic capacity so clients never observe an unpersisted success.\n\nConstraint: Preserve legacy Store source compatibility and the github.com/ai8future/chassis-go/v11 module contract.\nRejected: Make lease \n[…]\n20 ./idemkit; go test -timeout=120s -count=1 ./...; go vet ./...; staticcheck v0.7.0 ./...; gofmt and git diff checks.\nNot-tested: External distributed Store integrations and streaming keyed handlers.",
          "is_bot": false,
          "headline": "Fail closed when idempotency ownership or persistence is uncertain",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-13T16:56:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5e5f782d00a7ee863615b4fa5f1efebd130ba0de",
          "body": "…cceeding\n\nHarden v11 panic boundaries, preserve named health failures, make stream and webhook waits cancellable, and normalize infallible timing options without breaking existing call sites.\n\nConstraint: Preserve the v11 module and public compatibility surfaces while failing closed on recovered he\n[…]\n v0.7.0 on affected packages; touched-file gofmt and git diff --check.\n\nNot-tested: External production webhook endpoints; httptest covers request, retry, cancellation, and connection reuse semantics.",
          "is_bot": false,
          "headline": "Prevent malformed inputs and cancellation from crashing or falsely su…",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-13T16:39:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8601951558c28bb23081af0d5207af7567f607b8",
          "body": "Constraint: Preserve branch history while incorporating origin/main 11.3.0 release baseline and recent audit fixes.\n\nRejected: Rebase plus force-push | unnecessary history rewrite for a shared pushed readiness branch.\n\nConfidence: high\n\nScope-risk: moderate\n\nDirective: Keep VERSION on the latest mai\n[…]\n-v; contract checksums; README package table audit; no conflict-marker scan; go test ./...; go vet ./...; git diff --check.\n\nNot-tested: Pushing to main; this commit only updates the readiness branch.",
          "is_bot": false,
          "headline": "Merge latest main into Windmill readiness branch",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-05T15:41:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc500f80f9622f98e808184248d6c3ee86463578",
          "body": "Constraint: README must reflect implemented v11 packages and direct dependencies after Windmill readiness.\n\nRejected: Leaving package details to INTEGRATING.md only | README package table and dependency summary are the public landing page.\n\nConfidence: high\n\nScope-risk: narrow\n\nDirective: Re-run pac\n[…]\ndency README audit when adding packages or direct deps.\n\nTested: README package-row/direct-dependency audit; go test ./...; go vet ./...; git diff --check.\n\nNot-tested: Rendered Markdown in GitHub UI.",
          "is_bot": false,
          "headline": "Keep README aligned with current package surface",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-05T15:17:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f6c8979e22ab7f8a51841836272aeb9ce38f2913",
          "body": "Constraint: Preserve v11 module compatibility, keep DB-backed durability out of core, and honor pinned Windmill contracts.\n\nRejected: Shipping DB-backed idempotency/outbox in chassis-go core | violates tier isolation and defers true L3 to addons/service tests.\n\nConfidence: high\n\nScope-risk: broad\n\nD\n[…]\nv12/no DB drivers/TokenSource unchanged.\n\nNot-tested: Push publication may depend on GitHub credentials/network; true L3 durable outbox behavior remains intentionally deferred to addons/service tests.",
          "is_bot": false,
          "headline": "Enable Windmill-callable v11 services without widening core boundaries",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-07-05T07:08:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "78c1bf52b0e7c71f0a55bd8e9729c4304606c661",
          "body": "…y) + unify CLAUDE.md as symlink\n\nMandate 'git add -A' at commit time so _studies/_proposals/_rcodegen/_bugs_open/_bugs_fixed\nalways get committed even when an agent stages selectively. CLAUDE.md is now a\nrelative symlink to AGENTS.md (single source of truth).\n\nClaude:Opus 4.8 (1M context)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: split AGENTS.md scratch-folder rule (read-avoid vs commit-anywa…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-03T04:51:36Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9fd6ca3072d1c5867ad61142be7f1fb5c0cc8d59",
          "body": null,
          "is_bot": false,
          "headline": "docs: align product version with chassis 11.3.0",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T17:59:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "31e043daa3db7f472f77cd2977f6a6011bf24e34",
          "body": "Promote to minor release 11.3.0. No functional code changes since\n11.2.4; consolidates recent tracekit doc/test corrections into a new\nminor line. Sync README version reference.\n\nAgent: Claude Code (Claude:Opus 4.8, 1M context)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: bump version to 11.3.0",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T17:53:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e646db72baa3f5eaa31221f1c4dee76eed7eae0e",
          "body": "…re coverage\n\nBump to v11.2.4. Correct INTEGRATING.md and CHANGELOG to describe generated\nlightweight trace IDs as tr_ + 32 lowercase hex chars (128-bit entropy).\nMiddleware still accepts safe opaque incoming X-Trace-ID values, including\nlegacy tr_ + 12 hex IDs during transition. Add explicit tests preserving both\nlegacy and canonical incoming trace IDs.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(tracekit): correct trace ID format to tr_ + 32 hex; add middlewa…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T16:56:12Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f805014880893cfcae0911a66f9b2b006fcffedd",
          "body": null,
          "is_bot": false,
          "headline": "docs: update README for v11.2.3",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T16:49:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "61caf62d420a1570fd9312572cf522f40f67ce21",
          "body": null,
          "is_bot": false,
          "headline": "fix test version compliance (Codex:gpt-5.5)",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T16:35:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "23c69935b43e1718c44e0aaf8d190024e701ebfa",
          "body": "Codex:gpt-5.5",
          "is_bot": false,
          "headline": "fix low-hygiene audit issues",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T15:59:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aebcf0e77212e917010434dffb1ca4da85a9b3f8",
          "body": "Codex:gpt-5.5",
          "is_bot": false,
          "headline": "fix medium audit correctness issues",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T15:52:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "66d16f37388525499f42484545402adbae9c5b0b",
          "body": "Codex:gpt-5.5",
          "is_bot": false,
          "headline": "fix breaking api and webhook wire gaps",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T15:42:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "08d314241520d357d05ce3ee07a5c5f2358e45f8",
          "body": "Codex:gpt-5.5",
          "is_bot": false,
          "headline": "fix critical client edge cases",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-07-02T15:37:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ef7bdee5f6e7927216fce50949875e1f9e8ef7c",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: complete README and PRODUCT",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-06-29T01:47:21Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f09c47a09b6ee14c7201552443c7203a8234c222",
          "body": "Preserve the approved clikit implementation plan alongside the merged clikit package.\n\nAgent: Codex:gpt-5.1-codex-max-high",
          "is_bot": false,
          "headline": "Add clikit implementation plan",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-06-11T13:57:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b09b263e139516df5fc3629403f3270f6a258c4d",
          "body": "…ontracts\n\nAdd clikit as a composition layer around existing chassis primitives while preserving app-owned SetAppVersion/RequireMajor flow and keeping stdout/stderr/scriptability contracts explicit.\\n\\nConstraint: chassis-go v11 consumers that do not import clikit must keep compiling and retain exis\n[…]\nest ./...; independent code-reviewer APPROVE and architect CLEAR.\\nNot-tested: external downstream consumer repositories beyond generated subprocess fixtures and repo-wide tests.\\nAgent: Codex:gpt-5.5",
          "is_bot": false,
          "headline": "Provide an opt-in CLI toolkit without changing existing v11 startup c…",
          "author_name": "M2",
          "author_login": null,
          "committed_at": "2026-06-10T21:13:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "919359a97783995bca876801ef33729b60212a6d",
          "body": null,
          "is_bot": false,
          "headline": "chore: ignore OMX runtime state",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-05-06T09:53:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5349057de20797aac38dcba4e6d24d36bb27394e",
          "body": null,
          "is_bot": false,
          "headline": "docs: clarify Go 1.26.2 policy",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-05-06T09:43:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "04b0fed7487ea5956579d6512775328aa75edc17",
          "body": null,
          "is_bot": false,
          "headline": "chore: align CI with Go 1.26.2",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-05-06T09:40:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52d340bcb51c777957d8182d7951ea9f30cc1157",
          "body": "Updates `go.mod` to `go 1.26.0` and aligns README, INTEGRATING,\nGO-BEST-PRACTICES, and the full-service Dockerfile to Go 1.26.\nThe Go 1.26.2 security-patch guidance in INTEGRATING.md is preserved.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Bump Go toolchain floor to 1.26",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-05-06T09:20:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "018b5c0ca51eaafe2524f83d0d81b8386f296fba",
          "body": "Note that chassis-go ships no driver, point readers to chassis-go-addons/pgkit\nplus goose for ledger migrations, and call out the sqlc trade-off: it shines\non stable query shapes but Bun or raw pgx is friendlier for dynamic queries.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add Database Access section recommending pgkit + goose + sqlc",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-05-06T07:02:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ab70202f47c6c36a30f472ef208315f1a75075da",
          "body": "Adds a callout to the Multi-tenancy section of INNGEST.md clarifying\nthat the inngestkit package itself implements no tenant-aware behavior:\ntenancy is a deploy-time convention applied by consumer services\nthrough env-var naming and event payload fields.\n\nBumps to 11.1.9.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(inngestkit): note that multi-tenancy is convention, not kit code",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-05-05T09:31:02Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6b872a1129a536509e7b9fe85752a127322a2558",
          "body": "Restore the documented freshness opt-out contract, make registry and Kafka shutdown paths durable under failure, and keep v11 consumer guidance consistent with the current module path.\n\nConstraint: Repo requires VERSION and CHANGELOG updates, fixed-bug notes, and auto-commit/push after code changes.\n[…]\n/vuln/cmd/govulncheck@latest ./...\n\nNot-tested: Broker-backed Kafka/Redpanda integration tests for DLQ success/failure and lifecycle heartbeat announcements.\n\nCo-authored-by: OmX <omx@oh-my-codex.dev>",
          "is_bot": false,
          "headline": "Keep audit fixes aligned with runtime guarantees",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-05-02T09:09:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fdf5b3370cf159c3d8df2af4e107623d0defaa2a",
          "body": "Phasekit already had broad path coverage, but the startup fallback contract needed tests for default PATH lookup, explicit binary paths, and CLI-present bootstrap validation. This also rejects a top-level null Phase response so malformed JSON cannot masquerade as a valid empty secret export.\n\nConstr\n[…]\n: Codex:GPT-5\n\nTested: go test ./phasekit/...; go test -cover ./phasekit/...; go vet ./phasekit/...; go build ./phasekit/...; go test ./...; git diff --check\n\nNot-tested: Live Phase service smoke test",
          "is_bot": false,
          "headline": "Lock down phasekit fallback and parser edges",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-26T20:24:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a481ed58f94229751564e527dfb9c2f71e327d57",
          "body": "Missing phase CLI fallback needs to support env-backed runtimes before Phase bootstrap config exists, so phasekit now resolves CLI availability before validating Phase app/env/token fields. The env application path also prevalidates keys and values before mutating process state, and Result.Source no\n[…]\nuild ./phasekit/...; CGO_ENABLED=0 go build ./phasekit/...; go vet ./phasekit/...; go test -cover ./phasekit/...; go test -race ./phasekit/...; go test ./...\n\nNot-tested: Live Phase service smoke test",
          "is_bot": false,
          "headline": "Harden phasekit fallback and env application",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-26T20:19:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ff0a32a9fe2a4656bdd8b5a5467a03a90424c9c7",
          "body": "Phasekit should be safe to wire into services whose runtime environment already provides required variables. A missing phase binary now returns an env-fallback result instead of making MustHydrate panic, while real CLI execution failures still surface.\n\nRequiredKeys remain a Phase-response validatio\n[…]\ntest 87.9%)\nTested: go test -race ./phasekit/...\nTested: go vet ./phasekit/...\nTested: go test ./...\nNot-tested: Live Phase smoke test against phase.z.secure; no service token provided in this session",
          "is_bot": false,
          "headline": "Let Phase hydration fall back when the CLI is absent",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-26T20:11:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8cc9fc4979ab328ef7936ffc8f28bf8cd07c863e",
          "body": "Phase already owns secret retrieval and decryption, so chassis only needs a startup bridge that exports JSON through the Phase CLI and applies values before config.MustLoad runs.\n\nThe implementation preserves existing env vars by default, rejects redacted values, and disables dynamic secret lease ge\n[…]\ntest 87.9%)\nTested: go test -race ./phasekit/...\nTested: go vet ./phasekit/...\nTested: go test ./...\nNot-tested: Live Phase smoke test against phase.z.secure; no service token provided in this session",
          "is_bot": false,
          "headline": "Keep Phase hydration dependency-light and fail-fast",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-26T19:56:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d91ebe73e1174baa1cbcfb36d18f03ea232a5b4",
          "body": "…file\n\nGo services registered \"unknown\" as their version in /tmp/chassis/<svc>/<pid>.json\nbecause registry.readVersion() read a VERSION file from the current working\ndirectory at runtime. When services run from /opt/ai8/bin/, no VERSION file\nexists, so it fell back to \"unknown\".\n\nAdded registry.SetA\n[…]\n now checks the in-memory value first. All Go services\nthat already call chassis.SetAppVersion() get the fix with no code changes.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: registry manifest now uses SetAppVersion instead of CWD VERSION …",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-16T06:44:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0462d5496017e86527ae503c5ca57dab14b68d08",
          "body": "Three patterns for single inngest server with multiple tenants:\n- Per-tenant deploys: INNGEST_APP_ID=praxis.hotfolderd\n- Shared multi-tenant: INNGEST_APP_ID=email-inbound, tenant in event data\n- Tenant-unaware: INNGEST_APP_ID=scanner-edgar\n\nAlso documents what inngest is NOT for (cross-service streaming,\nsimple HTTP calls, services without durable workflow needs).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add multi-tenancy patterns to INNGEST.md",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-11T20:24:15Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "da0f695ebdbb08d496f4b5a809ada9861cb4e34b",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: require Go 1.26.2+ in INTEGRATING.md for security patches",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-11T15:53:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "500bbe760b222ddac1e823b2102204f93a505d28",
          "body": "- Go toolchain 1.26.0 -> 1.26.2: fixes 10 stdlib CVEs (TLS DoS,\n  x509 auth bypass, XSS, path traversal)\n- grpc v1.78.0 -> v1.79.3: fixes GO-2026-4762 auth bypass\n- govulncheck reports zero vulnerabilities\n\nClaude:Opus 4.6\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v11.1.2: upgrade Go 1.26.2 + grpc v1.79.3, zero CVEs",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-11T15:52:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c1e256a4795ac55bef42d5bd3f7bd7e2e04db578",
          "body": "- posthogkit: close flushCh on Close() preventing goroutine leak (CRITICAL);\n  sync.Once for double-close safety; cap requeue at maxBuffer\n- schemakit: bound Register response body with io.LimitReader (HIGH)\n- cache: collect-then-remove in Prune to avoid map mutation during iteration\n- webhook: compact order slice backing array to prevent memory leak;\n  use NewRequestWithContext for cancellable outbound calls\n\nClaude:Opus 4.6\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v11.1.1: fix 6 findings from audit cycle 2",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-11T15:48:44Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6a4915df72b5f9ee1a9080546a1100f53109be4b",
          "body": "Security (17 fixes):\n- kafkakit: fix CRITICAL double-close race via sync.Once\n- chassis: fix appVersion data race with atomic.Value\n- freshness: auto-rebuild now opt-in (CHASSIS_AUTO_REBUILD=1)\n- lifecycle: use os.Executable() for restart exec path\n- webhook: add 5-min timestamp replay protection\n- \n[…]\nSE loop\n- tick: stop timer on ctx cancel during jitter\n- qdrantkit/registrykit/lakekit: bound response body reads\n\nClaude:Opus 4.6\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v11.1.0: fix 32 audit findings across 30 packages",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-11T15:13:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8271d0f2a889d08df552d958ab588fc7a7f1b256",
          "body": "registry.resolveName() used binary+cwd_basename while lifecycle used\njust cwd_basename. The divergence caused all registry and lifecycle\nintegration tests to look for PID files in the wrong directory.\n\nFix: registry.resolveName() now uses filepath.Base(wd), matching\nlifecycle. Extract testSvcDir helper replacing 16 inline path\ncomputations in registry_test.go.\n\nClaude:Opus 4.6\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(registry): align resolveName() with lifecycle, fix 39 broken tests",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-11T14:22:30Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3286063fb36526f255aa8351c41504d73fd27cba",
          "body": "…te ServeOrigin\n\n- Auto-strip `signkey-<env>-` prefix from INNGEST_SIGNING_KEY and\n  INNGEST_SIGNING_KEY_FALLBACK so users can paste either raw hex or\n  the full prefixed form from the inngest server config\n- Enforce minimum 32 hex char (16 byte) signing key length to prevent\n  weak HMAC-SHA256 keys\n[…]\nredundant RegisterURL override (SDK computes from APIBaseURL)\n- Update tests from 17 to 24 covering new behaviors\n\nClaude:Opus 4.6\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(inngestkit): strip signing key prefix, enforce min length, valida…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-11T14:13:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c1c5a301409b8d27ea529aea10aa3284fef6942f",
          "body": "Track A — xyops removal:\n- Delete xyops/ package (302 LOC client) and xyopsworker/ (129 LOC stub)\n- Delete XYOPS.md (794 LOC aspirational guide)\n- Strip xyops sections from INTEGRATING.md, PRODUCT.md, AGENTS.md\n- Replace \"service without xyops is invisible\" mandate with opt-in inngestkit language\n\nT\n[…]\nON 10.3.5 → 11.0.0\n- All 82 .go files updated (imports + RequireMajor)\n- All active .md files updated (import paths, version refs)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v11.0.0: remove phantom xyops, add inngestkit for self-hosted inngest",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-11T13:50:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0ba684bb51d2ede2200a6dac63052052a576dd55",
          "body": "- Replace 3 direct os.Exit(1) calls with osExit(1) in RequireMajor and\n  AssertVersionChecked for testability consistency\n- Change flagz.FromJSON signature from Source to (Source, error) since\n  file I/O errors are runtime conditions, not programmer errors\n\nClaude:Opus 4.6\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: use mockable osExit in chassis.go, return error from flagz.FromJSON",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-05T07:45:15Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2ea2968fa68c6457aa851392ad4144ad96612676",
          "body": "Batch fix of issues identified by multi-agent code review (Claude, Gemini, Codex).\n\nKey fixes:\n- Data races: webhook delivery fields, kafkakit s.client, schemakit cache, announcekit serviceName\n- Error handling: otel shared shutdown ctx, metrics silent errors, config panic context, health write erro\n[…]\ns on partial write, work.Stream orphaned spans\n\n27 reports reviewed, 27 fixes agreed upon, 17 suggestions rejected with rationale.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: apply 27 rcodegen fixes across 21 packages",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-05T06:54:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fd4d991e867265a0a97cc731497b18465147cb7f",
          "body": "…egistry, tracekit, logz\n\n- webhook: guard delivery field mutations with s.mu, return ID on failure, panic on rand.Read error\n- registry: handle --flag value redaction, log write/atomicWrite errors to stderr\n- tracekit: panic on rand.Read error in GenerateID\n- logz: remove redundant spanID != \"\" guards after sc.IsValid()\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: data races, error handling, and redaction gaps across webhook, r…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-05T06:47:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "705e366d7e79f3b8bf482f36fc746fef0cbbfabc",
          "body": "- otel: separate shutdown timeout contexts for traces and metrics\n- metrics: log warnings on Counter/Histogram meter creation errors\n- config: descriptive panic for invalid regex in validate \"pattern\" tag\n- health: check and log w.Write error in handler\n\nClaude Code:Opus 4.6 (1M context)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: four robustness fixes in otel, metrics, config, health",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-05T06:47:30Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ec1fcc04f7cd334d14e1d4fd14c12cbffa8637d8",
          "body": "- xyops: CancelJob (cache invalidation), SearchJobs, GetEvent, AckAlert\n- deploy: RunHook exec, missing noop, path traversal rejection, exec error\n- tick: option constructors, non-positive interval guard\n- xyopsworker: Job callback invocation, Run context cancellation\n- registrykit: AsOf RFC3339 encoding, WithRetry transient retries, WithCircuitBreaker open-circuit rejection\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: add 15 tests across xyops, deploy, tick, xyopsworker, registrykit",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-05T06:43:43Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f8ff400c45a71a85f9eba718e2a3ea3946e61cd6",
          "body": "qdrantkit, meilikit, inferkit, and xyopsworker Config structs had fields\nthat panicked at startup via config.MustLoad when env vars were unset,\neven though the code already handled empty values gracefully. Adds\nrequired:\"false\" tags and sensible defaults where missing.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: make API key and optional config fields non-required across kits",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-04T20:11:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b83ec3dd70699a772f1c0f07b314a0f1af80ae1a",
          "body": "…haling\n\nAdds a generic convenience function that unmarshals json.RawMessage hits\ninto typed slices, eliminating the manual unmarshal loop consumers need.\nWorks with both single-search and multi-search results.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(meilikit): add generic SearchHits[T] helper for typed hit unmars…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-04T19:06:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "badf454bd26c49236e3b4c3d64efce76c0e916da",
          "body": "…aphkit\n\n- ollamakit: Ollama native LLM client\n- posthogkit: PostHog product analytics client\n- qdrantkit: Qdrant vector database client\n- meilikit: split into multi-file package (errors, requests, types)\n- graphkit: removed — zero consumers, service never adopted\n- registrykit: updated registry client\n- docs: updated INTEGRATING.md, PRODUCT.md, README.md\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add ollamakit, posthogkit, qdrantkit; split meilikit; remove gr…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-04T18:45:12Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "53962437022e73e8df765bec4a693bcd2a5ddde0",
          "body": "- ExtraBody map[string]any on ChatRequest/EmbedRequest for provider-specific\n  fields (e.g. service_tier). Typed fields always win on conflict.\n- ResponseMeta (StatusCode + Header) on ChatResponse/EmbedResponse for\n  accessing response headers (e.g. x-groq-region).\n- ChatStream signature: (*ResponseMeta, <-chan ChatChunk, error) — breaking.\n- Remove omitempty from wire Stream field to prevent ExtraBody injection.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(inferkit): add ExtraBody and ResponseMeta support",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-04T18:36:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d6bcdc4de7de859e988ad8c3d31d7df420f2562a",
          "body": "Verifies that non-404 4xx errors (e.g. 403 Forbidden) are returned as\n*MeiliError and not silently treated as \"not found\" by the special 404\nhandling path.\n\nClaude Code:Opus 4.6 (1M context)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(meilikit): add GetDocument non-404 client error test",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-04T18:29:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "20ca70d124f633004deb2fc65a855f6da1192e05",
          "body": "…thods\n\n- GetDocument(ctx, docID) retrieves a single document by ID (GET /indexes/{uid}/documents/{docID}), returns nil,nil on 404\n- DeleteDocument(ctx, docID) deletes a single document by ID (DELETE /indexes/{uid}/documents/{docID}), returns async *TaskInfo\n- Add validateDocID internal helper for d\n[…]\nment ID validation\n- 9 new tests (2 validation + 4 GetDocument + 3 DeleteDocument), all 51 pass\n\nClaude Code:Opus 4.6 (1M context)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(meilikit): add GetDocument and DeleteDocument single-document me…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-04T18:26:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "66dd4f83e4e8338f5b657ce3cafaabbd07d4b8eb",
          "body": "- tick.OnError(Skip) silently ignores errors, not \"log and continue\"\n- External dependencies are six, not four (was missing hamba/avro\n  for schemakit and franz-go for kafkakit)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: fix tick OnError(Skip) description and external dependency count",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-03T11:26:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "330eea3afaff54d5983206209d91e7e6d4fb4294",
          "body": "Maps 13 common needs (caching, encryption, signing, tokens, periodic\ntasks, webhooks, tracing, schemas, graph/registry/lake queries,\nheartbeats, lifecycle events) to the right package with a concrete\nreason not to hand-roll each one.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add \"don't skip these\" summary table to addon packages section",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-03T11:23:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "86081effbbb1bdfa2d4223142b0f739234c034c5",
          "body": "…INTEGRATING.md\n\nAdd comprehensive integration guidance for 10 previously undocumented\npackages: cache, seal, tick, webhook (addon packages), graphkit,\nregistrykit, lakekit (service client kits), tracekit, schemakit,\nheartbeatkit, announcekit (event bus kits). Update module taxonomy\nto classify all package categories.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add addon packages, service client kits, and event bus kits to …",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-03T11:22:21Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1084791855df514e36dddcc5ec9152f4fe4ae505",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add bug fix docs for kafka offset and subscriber concurrency issues",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-04-03T11:11:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a56f6541ac0d364b486a45029b4632e471bf0d66",
          "body": "INTEGRATING.md: full section with comparison table, usage guidance,\nand DLQ semantics. README.md: update kafkakit description and version.\nPRODUCT.md: mention configurable delivery guarantees.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: document AtLeastOnce delivery mode across all docs",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-30T17:19:31Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a22b357dff3a8a86c7425c00c9fdd0c7a3f11372",
          "body": "When SubscriberConfig.AtLeastOnce is true, offsets are committed only\nafter all handlers in a batch complete. Includes OnPartitionsRevoked\ncallback for safe rebalancing and unconditional shutdown commit.\nDefault behavior (rolling semaphore with auto-commit) is unchanged.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(kafkakit): add AtLeastOnce delivery mode for manual offset commit",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-30T16:21:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f4ab69d2d4cdc268bdeb4a3cd3c101db01a1dc49",
          "body": "The subscriber concurrency docs still described the old batch-wait\nbehavior. Updated to document the rolling semaphore, auto-scaled\nMaxPollRecords, and graceful shutdown drain.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: update INTEGRATING.md to reflect rolling semaphore model",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-30T10:04:54Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e46ed2dbe5b7ca67c498fb5dbb00206e9ef8fcc7",
          "body": "…oncurrency\n\nThe batch-parallel model (PollFetches + wg.Wait per batch) only processed\n1 record at a time because kgo delivered 1 record per poll. Two fixes:\n\n1. Use PollRecords(ctx, maxPoll) with maxPoll auto-scaled to Concurrency*2\n   so each poll fetches enough records to saturate the worker pool\n[…]\nbatch wg.Wait() — the semaphore now acts as a rolling\n   concurrency limiter. WaitGroup retained only for graceful shutdown drain.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(kafkakit): switch to rolling semaphore and PollRecords for real c…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-30T09:58:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b7ddd980ae0c65db613fbffa0c1a9f115696f14e",
          "body": "Consumer repos using vendoring with local replace directives must add\nvendor freshness guidance to their AGENTS.md so AI agents know to run\ngo mod vendor before building or debugging.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add mandatory AGENTS.md snippet for vendor freshness in consumers",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-29T16:45:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8e7f799012f8811e3e8b13b5c7d0fd23cdda8738",
          "body": "Add guidance to \"Things to watch out for\" about stale vendor directories\nwhen using local replace directives. Includes explicit instructions for\nAI agents to run go mod vendor before building or debugging.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add vendor freshness warning to INTEGRATING.md",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-29T16:43:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a41f0c7f0e0a18afaee8c2f8d0b5ed6c2a7ce960",
          "body": "Add optional Concurrency field to SubscriberConfig for parallel message\ndispatch. When Concurrency > 1, handlers run as goroutines bounded by a\nchannel semaphore, with WaitGroup drain per poll batch. Default (0 or 1)\npreserves existing sequential behavior.\n\nv10.2.0\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(kafkakit): add subscriber concurrency support",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-29T10:59:22Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9968e4cf6491e90e326287eccc6190e8b854a6e9",
          "body": "…oy examples",
          "is_bot": false,
          "headline": "docs: add SetAppVersion to remaining XYOPS.md and INTEGRATING.md depl…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-29T08:25:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef38507d14a770ee7014940d67f809c2232ee21e",
          "body": "…NG, and GO-BEST-PRACTICES",
          "is_bot": false,
          "headline": "docs: add SetAppVersion to all code examples across README, INTEGRATI…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-29T08:20:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "995b766af933175aece4c53aba5d74bb568aa003",
          "body": "… INTEGRATING.md",
          "is_bot": false,
          "headline": "docs: add version/freshness integration instructions to CLAUDE.md and…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-29T08:01:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3189ec9e36135e978917500a610a9f5a34a35ad",
          "body": "Detects stale binaries by comparing compiled appVersion against the\nVERSION file on disk. When stale, rebuilds via go build with atomic\nrename and re-execs. Dormant until SetAppVersion() is called.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: auto-rebuild freshness check in RequireMajor",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T22:35:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "410531f4bca6ddcde4a73b219a91bc6f63279230",
          "body": null,
          "is_bot": false,
          "headline": "feat: wire checkFreshness into RequireMajor",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T22:35:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7392a9da121f806c38fe9f21bc4f77cbde0aac79",
          "body": "Add rebuild() which runs go build to a temp file then atomically renames,\nwith 2-minute timeout and descriptive error messages.\n\nAdd checkFreshness() which compares compiled-in appVersion against the\nVERSION file on disk, rebuilds if stale, and re-execs via syscall.Exec.\nRespects CHASSIS_NO_REBUILD \n[…]\nebuildNoGo, TestCheckFreshnessSkipsWhenNoAppVersion,\nTestCheckFreshnessSkipsWithNoRebuildEnv, TestCheckFreshnessSkipsWithGuardEnv.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(freshness): add rebuild and checkFreshness orchestrator",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T22:34:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8e3db355e303c16af05c9dfdcfdeb8e6cd919e21",
          "body": "Tasks 2-4: directory walker to find module root (go.mod + VERSION),\ngo.mod parser for module path extraction, and main package resolver\nwith build info / fallback strategies.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(freshness): add findModuleRoot, readModulePath, resolveMainPackage",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T22:31:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e9bd5d8b4237b15989abc19677bb27770d7b88c0",
          "body": "Claude Code:Opus 4.6 (1M context)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: bump version to 10.0.12, update CHANGELOG",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T22:29:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "107f1022070177942bc1b5e650e79dccb5543f05",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(freshness): add semverNewer version comparison",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T22:28:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5e0fd790e141fd8dd730679cafdd8d0b656aacce",
          "body": null,
          "is_bot": false,
          "headline": "docs: add auto-rebuild freshness implementation plan",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T22:26:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ca3b94a1a65394bbdb3a1f672f895e43f3a0dc61",
          "body": null,
          "is_bot": false,
          "headline": "docs: add auto-rebuild freshness check design spec",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T22:20:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5a32e4574f7b8db75a550cd5689e9907f7b3aece",
          "body": "RequireMajor() now intercepts --version in os.Args before the version\ncheck, so every binary built with chassis-go automatically supports\n--version with zero consumer code changes. Also adds SetAppVersion()\nfor consumers who want to include their own version in the output.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: automatic --version flag for all chassis binaries",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T21:33:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "47490532c7457842fcc875bd2bae881fe6599898",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: commit pending changes",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-28T11:24:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "126d3f391449f262074acc018d66194addfbfce3",
          "body": "Add killPreviousInstances() that scans PID files for the same service,\nsends SIGTERM to live stale instances, waits 3s, then SIGKILL. Called\nfrom Init() and InitCLI() before cleanStale(). Prevents duplicate\ndaemons and port-binding failures on restart.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "registry: kill stale instances on startup to prevent port conflicts",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-27T18:29:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "93b8e53fd6df5bfc15b326a61b4a75583e28761e",
          "body": "… XYOPS env vars\n\nv10.0.7 removed required:\"true\" from xyops.Config fields but\nconfig.loadFields defaults to required when no tag is present.\nAdd explicit required:\"false\" so services embedding xyops.Config\nno longer panic at startup. Bump to v10.0.8.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(xyops): add required:\"false\" tags to prevent config panic without…",
          "author_name": "ai8future",
          "author_login": null,
          "committed_at": "2026-03-27T10:44:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        }
      ],
      "releases_count": 11,
      "commits_last_year": 186,
      "latest_release_at": "2026-07-19T07:49:18Z",
      "latest_release_tag": "v11.3.24",
      "releases_from_tags": true,
      "days_since_last_push": 4,
      "active_weeks_last_year": 17,
      "days_since_latest_release": 7,
      "mean_days_between_releases": 18.2
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": 28,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/ai8future/chassis-go/v11",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/ai8future/chassis-go/v11",
          "is_deprecated": false,
          "latest_version": "v11.3.24",
          "repository_url": "https://github.com/ai8future/chassis-go",
          "versions_count": 5,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-19T07:49:18Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 41894,
      "source_files_sampled": 180,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 3758
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/hamba/avro/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.31.0"
        },
        {
          "name": "github.com/inngest/inngestgo",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.15.1"
        },
        {
          "name": "github.com/twmb/franz-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.20.7"
        },
        {
          "name": "github.com/twmb/franz-go/pkg/kmsg",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.12.0"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.40.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.40.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.40.0"
        },
        {
          "name": "go.opentelemetry.io/otel/metric",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.40.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.40.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk/metric",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.40.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.40.0"
        },
        {
          "name": "go.opentelemetry.io/proto/otlp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.0"
        },
        {
          "name": "golang.org/x/crypto",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.53.0"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.0"
        },
        {
          "name": "golang.org/x/text",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.39.0"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.79.3"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "ai8future",
          "commits": 2,
          "avatar_url": "https://avatars.githubusercontent.com/u/2287988?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 8,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 5,
            "reason": "5 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "20ddc268f6faa4d1ff991a12d844e055e31e10ad",
        "ran_at": "2026-07-26T08:26:01Z",
        "aggregate_score": 4.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-26T06:23:16Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "FAILURE",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/ai8future/chassis-go",
    "host": "github.com",
    "name": "chassis-go",
    "owner": "ai8future"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 50,
      "inputs": {
        "security": 47,
        "vitality": 81,
        "community": 24,
        "governance": 32,
        "engineering": 62
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 81,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "commits_last_year": 186,
              "human_commit_share": 1,
              "days_since_last_push": 4,
              "active_weeks_last_year": 17
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "17/52 weeks with commits",
                "points": 11.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 17
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "186 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 186
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "releases_count": 11,
              "latest_release_tag": "v11.3.24",
              "releases_from_tags": true,
              "days_since_latest_release": 7,
              "mean_days_between_releases": 18.2
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "11 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 7 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~18.2 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 18.2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 32,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 37,
            "inputs": {
              "followers": 0,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "ai8future",
              "public_repos": 11,
              "account_age_days": 5071
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "0 followers of ai8future",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 0,
                      "login": "ai8future"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "11 public repos, account ~13 yr old",
                "points": 19.9,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 11
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 13
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/ai8future/chassis-go/v11"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 7
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 7 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "5 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 62,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 47,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 47,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 4.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "5 existing vulnerabilities detected",
                "points": 3.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 73,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.94,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 3758
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "94 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 94,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.47,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "47 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 47,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 41894,
              "source_files_sampled": 180,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/180 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 180,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-26T08:26:08.902663Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/ai8future/chassis-go.svg",
  "full_name": "ai8future/chassis-go",
  "license_state": "standard",
  "license_spdx": "MIT"
}