doze-dev / doze-aws

本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 1984,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 1580531,
        "CSS": 69281,
        "HTML": 150847,
        "Shell": 8263,
        "JavaScript": 26767,
        "TypeScript": 149006
      },
      "pushed_at": "2026-07-18T20:19:01Z",
      "created_at": "2026-07-10T23:11:20Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-18T20:19:01Z",
      "description": "A lightweight, pure-Go local AWS emulator — S3, DynamoDB, SQS, SNS, STS, KMS, SSM, Secrets Manager, EventBridge, and Lambda in one small binary. No Docker, no JVM. Built from the wire protocol up and verified against both AWS SDK generations; Lambda runs your functions as real local processes. Embeddable as a Go library.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "Organization",
      "login": "doze-dev",
      "company": null,
      "location": null,
      "followers": 0,
      "avatar_url": "https://avatars.githubusercontent.com/u/297208249?v=4",
      "created_at": "2026-06-26T15:49:12Z",
      "is_verified": null,
      "public_repos": 9,
      "account_age_days": 26
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-07-18T20:20:38Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-07-17T21:32:40Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-07-10T23:30:00Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "c25e5418f9438c54aa9135f57819a2e012efcf73",
          "body": "GET /_console/api/glance: everything a terminal dashboard needs in ONE call,\ndesigned to be polled ~1s while a dash row is selected — the service board\n(per-service call sparklines from the traffic ring, service-aware state:\nqueue depth, DLQ warnings, lambda warm/sleeps-in), an attention list with\nc\n[…]\nds X-Forwarded-Prefix into the host so generated queue URLs\nroute back through the same path, and the console's copyable queue URL chip\nprefers AWS_ENDPOINT_URL_SQS — the address an SDK actually uses.",
          "is_bot": false,
          "headline": "console: glance API for the doze dash + path-prefix-aware queue URLs",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-18T19:26:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9ab0f79c96e6eaf85d34519473cbe13af6fb3db6",
          "body": "… split\n\nThe cross-repo reorg's doze-aws half: sqs/kms split into per-concern\nfiles (attrs/errors/receive/sweeper, aliases/crypto/keys/policy),\nsns codec folded into the shared awsquery/awsjson protocol packages,\nstackfile apply/export decomposed into per-service svc_*.go, console\nclients aligned with the new service surfaces.",
          "is_bot": false,
          "headline": "reorg: split god-files, dedupe protocol codecs, stackfile per-service…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-17T21:27:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d1b154d9c1aa185787c88d93e1bf5cb8f67f795e",
          "body": "…ardening\n\nDynamoDB Streams (real, single open shard): change records (INSERT/MODIFY/REMOVE\nwith keys + old/new images per StreamViewType) are captured at writeItem — the\nsingle mutation choke point, so records commit atomically with the write and\ncover Put/Update/Delete/txn uniformly. Implements Li\n[…]\npanicking. A serialization edge can\nno longer take down the emulator.\n\nAdds a streams wire-shape contract test (INSERT/MODIFY/REMOVE order, image\nshaping, empty re-poll). Full suite green under -race.",
          "is_bot": false,
          "headline": "feat(dynamodb,trust): DynamoDB Streams + S3→Lambda proof + no-panic h…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-13T01:15:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "07cf4c0c32ef1eab17a948717a545201847052c9",
          "body": "…endpoints\n\nConsole: the backend now takes a peers.Directory instead of a single gateway\nhandler. A new fanoutTransport routes each request to the owning service via the\nnewly-exported gateway.Route, then dials that service's endpoint — an in-process\nhandler when embedded (peers.InProcess over the s\n[…]\n process's own environment (real\nper-service domains in the module topology), plus the general AWS_ENDPOINT_URL\nfrom the embedded listen address — never the decorative peer BaseURLs an SDK\ncan't dial.",
          "is_bot": false,
          "headline": "feat(console,lambda): topology-agnostic console + reachable function …",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T17:58:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "20a1963acc580b52e1589305abe3ddc074e3f4cc",
          "body": "The SQS wire-fidelity change moved the JSON __type to the modern shape name\n(QueueDoesNotExist); stackfile's create-if-missing detection matched only the\nlegacy \"NonExistent\" marker, so first-apply queue creation failed. Add\n\"DoesNotExist\" to the not-found markers.",
          "is_bot": false,
          "headline": "fix(stackfile): recognize the modern SQS QueueDoesNotExist error code",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:56:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8aa9f377b6e0d0ca5de8d6c35222234428a0c75f",
          "body": "A self-copy without REPLACE now returns InvalidRequest, matching real S3; a\nself-copy with metadata/tagging REPLACE is still allowed. Adds a regression test.",
          "is_bot": false,
          "headline": "fix(s3): reject CopyObject onto itself without a metadata change",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:53:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b5aada171672047374cc2a6d5c72b5ed6fc225d",
          "body": "…ad code\n\n- Secrets Manager: a SecretId now resolves by the exact ARN name segment before\n  the suffix-stripped form, so partial ARNs and names ending in a dash-6char\n  segment (e.g. \"db-secret\") no longer mis-resolve.\n- Lambda: reserved concurrency 0 now throttles invocations (429\n  TooManyRequests\n[…]\n Corrected stale \"Phase 6/8/roadmap\" comments in package docs, dozeaws.go, and\n  doze-aws.example.toml to reflect the now-shipped features.\n\nAdds partial-ARN and concurrency-throttle regression tests.",
          "is_bot": false,
          "headline": "fix(fidelity+hygiene): partial-ARN lookup, concurrency-0 throttle, de…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:52:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "12923e81cc87049476b711e01b8a66f6880c2e72",
          "body": "Adds internal/schemaver: each of the 9 bbolt stores now records a schema version\non first use and, on later opens, refuses a database written by a newer binary\nrather than silently misreading JSON structs whose shape may have changed. A\npre-versioning database is treated as v1 and stamped in place, \n[…]\n3, sqs, sns, dynamodb, kms, ssm, secretsmanager,\neventbridge, and lambda. Adds schemaver unit tests (stamp/accept, reject-newer,\nunversioned-as-current); the persistence round-trip suite still passes.",
          "is_bot": false,
          "headline": "feat(persistence): stamp and verify a schema version in every store",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:45:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3d35dbb3160f33a10ad0246f46874a12f065202a",
          "body": "StackConfig gains an Endpoint field, injected into Lambda function processes as\nAWS_ENDPOINT_URL, so handler code using an AWS SDK can call sibling services (it\npreviously had no reachable endpoint and such calls failed). The doze-aws binary\nderives the endpoint from --listen (normalizing wildcard hosts to 127.0.0.1);\nembedders pass it explicitly. docs/embedding.md's \"zero configuration\" claim is\ncorrected to note this one case.\n\nAdds endpointEnv and reachableEndpoint tests.",
          "is_bot": false,
          "headline": "feat(lambda): wire AWS_ENDPOINT_URL so handler code reaches siblings",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:42:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e002f35368548b279844d3eab4fbdafaebb7e118",
          "body": "- SSM version-label form now applies to the row's version (not always latest) and\n  keeps the user on the Versions tab.\n- Object-lock badge reads ObjectLockEnabled instead of trusting the status code,\n  so buckets without a lock no longer all show \"Enabled\".\n- Endpoint chip, SQS queue-URL copychip, \n[…]\noad button now uploads into the current folder by syncing the form\n  prefix from the live object table at submit time.\n- Error toasts decode HTML entities so messages read normally instead of \""\".",
          "is_bot": false,
          "headline": "fix(console): remaining live UI bugs",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:38:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e62d1b02f0a7892c46f5b2d7428811a0e23c9d1e",
          "body": "…cache\n\nS3 objects are served with X-Content-Type-Options: nosniff and a sandbox CSP,\nand only a safe allowlist (text/plain, json, common images) renders inline —\ntext/html and image/svg+xml now download, closing a stored-XSS vector on the\nconsole origin.\n\nState-changing requests are refused when th\n[…]\nr in-app navigation and survive partial swaps.\n\nThe full wiring graph is cached for a brief TTL so the flows poll and every\nresource detail page's Neighbors() call collapse a burst into one N+1 crawl.",
          "is_bot": false,
          "headline": "fix(console): XSS hardening, CSRF/Origin defense, editor swap, graph …",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:33:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b6af0b2881a5e78a3b9d9621f13e6695d9c7e0bb",
          "body": "KMS: crypto operations now enforce KeyUsage (InvalidKeyUsageException) — Encrypt/\nDecrypt/GenerateDataKey/ReEncrypt require ENCRYPT_DECRYPT, Sign/Verify require\nSIGN_VERIFY, GenerateMac/VerifyMac require GENERATE_VERIFY_MAC — so code that\nworks locally can't silently do what real KMS rejects.\n\nDynam\n[…]\nhen-WHERE in statement order instead of reversed; SELECT\nhonors its projection list via a ProjectionExpression instead of returning full\nitems.\n\nAdds a KMS key-usage test and a PartiQL semantics test.",
          "is_bot": false,
          "headline": "fix(kms,dynamodb): enforce KMS KeyUsage; correct PartiQL semantics",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:28:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c90ccab13101c3d35ddfa088aca48407561f3687",
          "body": "SNS filter policies now delegate to the shared internal/eventpattern matcher, so\nnumeric conditions ({\"numeric\":[\">\",100]} and bare numbers) match instead of\nsilently dropping every message; filter policies are validated at subscribe /\nSetSubscriptionAttributes time rather than stored inert.\n\nSQS JS\n[…]\nnce no longer mutates the bbolt bucket while a cursor is live — it\ncollects the pass read-only and applies deletes/moves/updates afterward.\n\nAdds an SNS matcher table test and an SQS typed-error test.",
          "is_bot": false,
          "headline": "fix(sns,sqs): filter-policy matcher + SQS wire fidelity",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:22:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6f01c0e41ba350bf996ff2dc0813a29ee947645f",
          "body": "Pool: acquire/ensureStarted now refuse a closed/stopped pool so an Invoke racing\na restart can't spawn an orphan process running stale code; runInvoke retries\nonce against the fresh pool on ErrPoolClosed. Runner selection prefers an idle\nrunner over round-robin, eliminating spurious \"Task timed out\"\n[…]\ntch (10 × 256 KB) and Lambda sync responses (up to 6 MB) no longer truncate\ninto invalid JSON and stall the poller.\n\nAdds race regressions for the pool close-race and a discriminating ESM-filter\ntest.",
          "is_bot": false,
          "headline": "fix(lambda): concurrency lifecycle cluster + ESM filter + peercall cap",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:15:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e8e5085f78388b38efee98ad67501d186bf6f110",
          "body": "Console: delete-table/topic/bus rendered nonexistent templates → 500 after the\ndelete succeeded; redirect to the service landing page like the SQS/S3 handlers.\n\nS3: an unhandled bucket-subresource DELETE (DeleteBucketEncryption, replication,\netc.) fell through to deleteBucket and destroyed the bucke\n[…]\na GSI resurrected\nstale entries. Add the checks, reject duplicate items, and diff indexes by\nname+schema so removed/redefined index buckets are reclaimed.\n\nEach fix ships an SDK-level regression test.",
          "is_bot": false,
          "headline": "fix(audit): tier-1 data-integrity fixes across 7 services",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-12T15:08:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "22df8e13a201ca5ca9097d50b6e55f233b8116b2",
          "body": "Two bugs made a delayed SQS message not appear until the next manual action\n(the user sends another message, which force-refreshes the panel):\n\n1. The live poll captured its element in a closure and paused on\n   `!document.body.contains(el)`. A composer send / purge / redrive / delete\n   does an out\n[…]\nlled element after each request. Steady state is a clean 204.\n\nVerified in-browser: a message sent with a delay now appears on its own once\nthe delay elapses, and the panel settles (no re-morph loop).",
          "is_bot": false,
          "headline": "fix(console): live poll survives panel swaps; hash advances under morph",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T23:26:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "59cfec97a952fa8e482e760b114aa89f60a34c91",
          "body": "The nav rail lives outside #workspace, so hx-boost swapped the page without\nrepainting the rail's server-rendered `.on` class — the highlight only moved\non a full refresh. shell.js now recomputes the active item from the URL after\neach navigation (htmx:pushedIntoHistory) and on back/forward (popstate),\nmatching the Flows root exactly and each service section by path prefix.",
          "is_bot": false,
          "headline": "fix(console): rail active state follows boosted navigation",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T22:20:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ac392a307d694c001b809282e8daad3ee3143596",
          "body": "Filters were only settable after subscribing (the gear on an existing row).\nThe Subscribe form now carries them too: a sliders toggle reveals an optional\nfilter-policy JSON editor and a raw-delivery checkbox, passed as Subscribe\nAttributes so a subscription is born filtered. Closes the gap both ways.\n\nExtends TestSNSSubscriptionAttributes to subscribe with a filter + raw and\nassert the badges.",
          "is_bot": false,
          "headline": "feat(console): SNS filter policy + raw delivery at subscribe time",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T22:11:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e17ac6c1ca4f23d3d3b706a3dd5848ed305580ab",
          "body": "The last three deferrals from the wave sweep.\n\nSSM: path-addressed parameters now group by their parent path in the list\npane — a dimmed folder header per path, leaves labelled by their last\nsegment. Grouping is a template func (ssmGroups) so every caller keeps\npassing the flat list; the Alpine filt\n[…]\nbus, rule/{bus}/{name}\notherwise).\n\nTests: TestSSMPathTree, TestEBArchivesReplay, and an eb case added to\nTestTagsEverywhere. All browser-verified (archive captured 2 events, replay\nran to COMPLETED).",
          "is_bot": false,
          "headline": "feat(console): SSM path-tree, EB archives/replay UI, EB rule tags",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T21:28:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "911135c197f1726b943edc1309fd0c2bfea63310",
          "body": "SNS subscriptions gain a per-subscriber delivery-settings panel: a filter\npolicy JSON editor (only matching messages are delivered) and a raw\nmessage-delivery toggle. ListSubscriptions now pulls each confirmed\nsubscription's attributes so the \"filtered\" / \"raw\" badges reflect state.\n\nDynamoDB tables\n[…]\nir of generic routes, dispatched to each service's own tag wire format.\n\nTests: TestSNSSubscriptionAttributes, TestDynamoDBTableEditing (incl. cursor\npaging), TestTagsEverywhere. All browser-verified.",
          "is_bot": false,
          "headline": "feat(console): wave E — SNS filters, DynamoDB editing, tags everywhere",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T21:12:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "59b2e303e0ff5d40cbded1fad7bb7fd40afc07a3",
          "body": "PutRule now accepts ScheduleExpression: rate(...) rules are driven by the\nexisting once-a-second ticker (previously dead code — creation was rejected),\ncron(...) is stored but not driven, malformed expressions are rejected. The\nexpression round-trips through Describe/List.\n\nArchives and replay are f\n[…]\nel).\n\nVerified end-to-end with TestSDKArchiveAndReplay — live events are archived,\nreplayed, and the second delivery lands in SQS. Adds PHASE_8_REPORT.md and\nupdates the EventBridge api-support table.",
          "is_bot": false,
          "headline": "feat(eventbridge): scheduled rules + archives & replay (closes Phase 8)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T20:50:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1c20b0a5cf74b9f7b57cfb56421986c4f4500741",
          "body": "KMS playground is now usage-aware: SIGN_VERIFY keys get a sign/verify\nsurface (with a one-click \"verify this signature\" round-trip),\nGENERATE_VERIFY_MAC keys get an HMAC surface, and ENCRYPT_DECRYPT keys\nkeep encrypt/decrypt. Rotation controls only show on symmetric keys.\nAdded alias management (lis\n[…]\nnto the create form's JSON editor.\n\nSSM parameter versions now carry labels, attachable inline per version.\n\nFixes the lambda create-name pattern (escaped hyphen so the HTML `v`-flag\nregex validates).",
          "is_bot": false,
          "headline": "feat(console): wave D — crypto & config depth",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T20:13:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "da3fc838a9cf8f50ef93e3e6eef64f66c36e63a1",
          "body": null,
          "is_bot": false,
          "headline": "test: update lambda empty-state assertion for wave C copy",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T18:55:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e91528d3bcdc55c2ce35e0e7615604b9a2b447db",
          "body": "Lambda goes from inspect-only to full lifecycle from the UI:\n\n- Create function form — the empty state pasted a CLI command; now \"New\"\n  opens a form (name, runtime picker incl. the wave that added java/ruby/dotnet,\n  handler, code path, timeout, memory, env rows). The _local_ extension points\n  it \n[…]\n and the invoke result\nalready surfaces that tail.\n\nTest: TestLambdaLifecycle — create from a real build dir, edit config, create\n+ delete a function URL, add an ESM, async invoke returns the receipt.",
          "is_bot": false,
          "headline": "feat(console): wave C — Lambda lifecycle",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T18:34:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "631c74fdd07c6eb3bfc082168c09703814ce2210",
          "body": "Your \"editing a bucket\" callout, closed. The console touched 2 of S3's 13\nbucket subresources; it now edits the ones that matter:\n\nObject drawer:\n- Version history — versioning was a headline feature with invisible history.\n  The drawer lists every version and delete marker (newest current), each wi\n[…]\ne object then a past-dated one is refused, copy +\nmove, notification add/remove, CORS + lifecycle JSON round-trips. Added\nnewConsoleStack helper (tests needing the raw gateway, e.g. following a link).",
          "is_bot": false,
          "headline": "feat(console): wave B — S3 editing depth",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T18:12:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "85b16df29986c04bd2eb1ca7f5273e5b104154ad",
          "body": "The moments users are most stressed now have one-click exits:\n\n- SQS DLQ redrive: a dead-letter queue's message panel grows a\n  \"Redrive → source\" button (sources from ListDeadLetterSourceQueues; single\n  source prefills, several offer a picker — doze-aws's move tasks require an\n  explicit destinati\n[…]\nn the source; delete one message; retarget then remove a redrive\npolicy; delete + restore a secret; disable + re-enable a rule. Verified in the\nbrowser: \"✓ Redrive → work complete · 2 messages moved\".",
          "is_bot": false,
          "headline": "feat(console): wave A — the failure-loop recovery surface",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T17:46:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dc3fe9d6ae089c73f7b07d5071e9f2bd754a8f54",
          "body": "Serverless-style references, resolved on the raw document before parsing:\n\n  ${env:BUILD_DIR}          environment variable; unset is a loud error\n  ${env:STAGE, dev}         with a fallback default\n  ${var:name}               from the file's top-level vars: block,\n                            overri\n[…]\ntVariableReferences (env, var, defaults, key expansion, override\nprecedence, escape, collected errors). Verified through the CLI:\n`--var stage=ci` + DB_HOST env produce ci-jobs/ci/api-key//ci/db/host.",
          "is_bot": false,
          "headline": "feat(stackfile): variable references — ${env:...}, ${var:...}, defaults",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T17:33:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a5d90634be882b546f6bf75213d8f4d3a7b69b74",
          "body": "New stackfile package: a serverless-flavoured YAML file a team commits so one\ncommand stands up the whole local stack.\n\nSchema: resources by NAME (maps enforce uniqueness), wiring by reference —\nqueues (fifo/dlq:\"auto\"/redrive), tables (key: \"pk:S sk:N\" shorthand, GSIs,\nTTL), buckets (versioning + n\n[…]\nclean error surfaces at apply time.\n\nDeps: +gopkg.in/yaml.v3. Tests: parse/validate table, TestApplyConverges\n(create → converge → export → reparse → apply = zero creates),\nTestApplyNeverStompsValues.",
          "is_bot": false,
          "headline": "feat: stack.yaml — the declarative stack file (apply / boot / export)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T17:22:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "573206ce02d758f07c4d9e01828a5f5812ebab20",
          "body": "Closes the two DynamoDB gaps noted in the last pass:\n\n- PartiQL now uses a real SQL editor. Vendored CodeMirror's sql mode\n  (5.65.19, matching our core) and taught editor.js a \"sql\" hint →\n  text/x-sql. Keywords, strings and identifiers highlight; explicit modes\n  (json/yaml/sql) are no longer re-d\n[…]\n  Details tab shows each GSI's full key schema.\n\nTests: TestDynamoDBCreateWithGSIAndTTL (GSI queryable by its own key, TTL\nattribute in details). Verified end to end — TTL reports ENABLED server-side.",
          "is_bot": false,
          "headline": "feat(console): PartiQL SQL highlighting + DynamoDB create GSI/TTL",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T16:52:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "711407e2737bc3722877243fbd690ae8dde3c3f9",
          "body": "JSON editor — every data-editor=\"json\" surface (DDB item, Lambda invoke,\nEventBridge test event) now gets a real JSON experience: a live validity pill\n(\"✓ valid JSON\" / \"✗ line N: <parse error>\"), a Format button that prettifies,\na red gutter dot, and a highlighted error line at the exact failure po\n[…]\na GSI. GSI parsing now captures the range key and attribute types.\n\nTests: TestDynamoDBExplorer (scan/query/sort-key/partiql counts). CSS guard\ngreen with the new .seg/.explorer-form/.ex-grid classes.",
          "is_bot": false,
          "headline": "feat(console): first-class JSON editor + DynamoDB query explorer",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T16:41:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ff6a2ab3d0120597ff78354e90f71c4985cf2afe",
          "body": "The subscriptions panel showed truncated ARNs cut off exactly where the\ninformation starts (arn:aws:lambda:...:func…), unlinked, in a heavyweight\ntwo-column table, with the add form as a separate boxed panel below.\n\nNow one \"Subscribers\" panel: each row is the endpoint's NAME as a\nservice-colored li\n[…]\nover copy, unsubscribe on hover. The add-row is a\ncompact footer inside the same panel, so \"add to this list\" reads literally.\nThe subscriber view model is shared with the delivery receipt (subViews).",
          "is_bot": false,
          "headline": "fix(console): SNS subscribers speak resource language, not wire format",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T16:26:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc7dc21967c8e1d8adfc8fcebb4dfee513fd8897",
          "body": null,
          "is_bot": false,
          "headline": "style: gofmt",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T16:20:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0c54f7c7d76ae28e3672bf2fbd45ca119285a05",
          "body": "…FO, DLQ-alongside\n\nThe emulator supported far more than the console exposed. Now exposed:\n\nSending / publishing:\n- Message attributes (String / Number / Binary) on both the SQS composer and\n  SNS publish, via a shared editor partial; Binary sends BinaryValue base64.\n- FIFO queues: message group ID \n[…]\n and\nthe console doesn't pretend otherwise.\n\nTest: TestSQSMessagingThoroughness (create-with-DLQ + badges + full-metadata\nsend visible in the peek). CSS guard tightened to skip Alpine :class bindings.",
          "is_bot": false,
          "headline": "feat(console): full SQS/SNS publish + create surface — attributes, FI…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T16:20:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b948e4a552cab69169b670e5af89e9e724bdf8ea",
          "body": "… caught\n\nNew TestTemplateClassesAreStyled walks every class attribute in the templates\n(template actions stripped first — quoted args inside {{if eq .State \"...\"}}\nwould truncate a naive capture) and asserts each token appears in a stylesheet\nor in an explicit hook-class allowlist with a reason. Th\n[…]\ny inner\noverflow-y:auto inert. The shell is now height:100vh — panes own their\nscrolling, sticky footers actually stick, verified at a 500px viewport\n(list scrolls, detail scrolls, window never does).",
          "is_bot": false,
          "headline": "test(console): guard that every template class is styled; fix what it…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T15:59:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "39cfd23abcac55d1938b4f6de5461b0f8eefab2a",
          "body": "…ek header\n\n- The connections strip / lambda diagram sat flush against the tab bar's\n  border — the full-bleed wrappers now carry 14px top padding (sqs, lambda, s3).\n- .panel-head was referenced by the SQS peek header but never defined in CSS,\n  so its title and actions stacked as cramped blocks. Defined: one flex row,\n  title cluster left, live-peek + Purge right.\n- Connection columns get a touch more internal padding (12/16).",
          "is_bot": false,
          "headline": "fix(console): breathing room around the wiring strip; un-cramp the pe…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T15:50:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "680ea725a60f7f2350bb047447de3f3715ba2573",
          "body": ".form-page carried max-width but no padding, and it sits DIRECTLY inside\n.detail (whose padding normally comes from det-h/det-b children) — so all nine\ncreate pages rendered their title flush against the pane's top/left border.\nThe wrapper now carries the pane padding itself, with a comment explaining why.\n\nSame class of bug on the S3 detail page: the connections strip was included\nbare while every other service wraps it in the padded container. Wrapped.",
          "is_bot": false,
          "headline": "fix(console): create pages and S3 wiring strip glued to the pane border",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T15:44:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "55c11fc27225e8449968927dd749bd3310d16131",
          "body": "- ⌘K pins your last five visited resources on top (current page excluded, so\n  ⌘K ⏎ always means \"back to where I just was\"). Visits are tracked from the\n  URL on load and boosted navigation; nothing new is stored server-side.\n- Traffic rows grow a hover copy button that renders the call as a replay\n[…]\ncorder's redacted copy, so masked secrets stay masked in the repro.\n  TestTrafficRecorder's leak assertion now counts rendered action cells — each\n  row also embeds its action inside the curl payload.",
          "is_bot": false,
          "headline": "feat(console): palette recents, traffic copy-as-curl",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T15:38:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27d4dda3db5f187ac9bdb5b6f3e38712f0bae02f",
          "body": "…ick round-trip\n\nThree loop-closers — act and verify on one screen:\n- EventBridge: the bus page's test event now shows a live verdict per rule as\n  you type (debounced), using the service's own TestEventPattern evaluator —\n  \"which rule catches this event?\" answered without an SDK loop. Publish stil\n[…]\nets a loud warning instead of a\n  cheerful toast (the classic silent foot-gun).\n- KMS: the encrypt result carries \"Decrypt this →\" — the round-trip is one\n  click instead of copy/scroll/paste/decrypt.",
          "is_bot": false,
          "headline": "feat(console): EB live rule matcher, SNS delivery receipt, KMS one-cl…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T15:32:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "86138504ac308148bd5d5d3b1ddc1aa670e4cc3d",
          "body": "…ats form bodies\n\nThe Lambda page opens with the picture: triggers → function → destinations.\nTrigger cards come from the wiring graph (event sources, SNS subscriptions, EB\nrule targets), destination cards are labeled by role (on success / on failure /\ndead-letter), every neighbor is clickable, and \n[…]\nund\nnothing and every such request fell through to the S3 fallback's 405. classify\nnow parses the recorder's captured copy and never touches r.Body.\nRegression-tested in TestRecorderPreservesFormBody.",
          "is_bot": false,
          "headline": "feat(console): Lambda function-overview diagram; recorder no longer e…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T15:24:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9620c87306325bc1218b50124fb20e0005d4c677",
          "body": "…t inheritance\n\nThe act/verify loop on one screen: the Messages tab now shows the live peek\nbeside a docked composer — type, ⌘⏎ (new global convention: submits the\ncomposer you're typing in, from plain textareas and CodeMirror alike), and the\nmessage lands in the peek with a green flash. The Send ta\n[…]\nince the workbench overhaul (tests drive handlers directly and never saw it).\nEvery partial actuator now carries hx-select=\"unset\", and layout.html documents\nthe trap next to the inherited attributes.",
          "is_bot": false,
          "headline": "feat(console): SQS composer docked beside the live peek; fix hx-selec…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T15:15:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3038aa719692f1bac898be9cd794ea4c2c7be8fb",
          "body": "The rail now defaults to 208px — official AWS icon (24px, glyph legible),\nservice name, and a live resource count — grouped by AWS category so the six\npink/red services stop reading as identical dots. Collapses to 56px icons with\nhover-flyout names (position:fixed so the rail's scroll can never clip\n[…]\n).\n`[` or the footer button toggles; the choice persists via localStorage and is\napplied pre-paint from an inline script, so no flash on load. Counts come from\nthe new /api/counts, refreshed every 5s.",
          "is_bot": false,
          "headline": "feat(console): collapsible nav with names, live counts, and groups",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T15:03:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cfa7c9d0f9deb5776812880898774972628b197e",
          "body": "Dark mode:\n- codemirror.min.css loaded AFTER app.css, so CM's base `.CodeMirror\n  {background:#fff}` beat the themed rule at equal specificity — every editor\n  stayed white in dark mode. Vendor CSS now loads first; app.css wins the\n  cascade by order, as intended.\n- Syntax colors are now per-theme t\n[…]\nsed it because they hit stack.Handler()\n  directly — only cmd wraps the Recorder. The scan now resumes after each mask.\n  Regression-tested in TestRedactSecrets (terminates, masks, keeps non-secrets).",
          "is_bot": false,
          "headline": "fix(console): dark mode lands in the editors; recorder redaction hang",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T14:52:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e3aa328113c84d89709b9e4c54dac683074b857c",
          "body": "- The Lambda idle window is now configurable: config `[lambda] idle-timeout`\n  (round-trips through `config print`), `--lambda-idle` flag, StackConfig.\n  LambdaIdleTimeout → lambda.Options.IdleTimeout → per-pool SetIdleTimeout.\n  Lets you watch a function sleep in seconds instead of ten minutes.\n\nFi\n[…]\nw-proof; the going-cold flip stays server-authoritative.\n\nVerified end to end with a 30s window: Warm · sleeps in Ns ticks down 1s/1s,\nthen flips to Idle · wakes on invoke exactly when the pool reaps.",
          "is_bot": false,
          "headline": "feat(lambda,console): configurable idle window + skew-proof countdown",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T14:16:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "622d6ed108aae2f964bcac883229883c419f8c50",
          "body": "The warm badge now counts down — \"Warm · sleeps in 9m 41s\" — ticking every\nsecond and re-syncing when the timer resets on a new invoke.\n\n- Pool records an idleDeadline when it arms the scale-to-zero timer, cleared on\n  acquire/reap/stop; SleepDeadline() exposes it (and whether a countdown is\n  runni\n[…]\nlive poll keeps 204ing and only morphs on an actual reset — no per-second\n  network churn, no jitter.\n\nTest: TestPoolScalesToZeroWhenIdle now asserts a future deadline while warm and\nnone once reaped.",
          "is_bot": false,
          "headline": "feat(console,lambda): live countdown to Lambda sleep",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T13:58:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b9e961a9bf35dba5217d42211d4a3a9f455b4ffa",
          "body": "The Lambda page now surfaces the scale-to-zero behaviour it can't otherwise see:\n- A live badge in the identity band — green \"Warm · sleeps after 10m idle\" when\n  the function holds a child process, grey \"Idle · wakes on invoke\" when it's\n  scaled to zero. It polls itself (3s) and morph-swaps, so yo\n[…]\nRunners, IdleTimeoutSeconds} from the runtime pool\n(Pool.Size / Pool.IdleTimeout). Console backend.LambdaRuntime consumes it.\nAlso corrected the now-stale lambda package doc comment (the pool exists).",
          "is_bot": false,
          "headline": "feat(console,lambda): show Lambda process state + idle window",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T13:51:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4c96c73fbcbfd202e97afc4163c4def9f1fa73ab",
          "body": "A warm Lambda pool now reaps its child process(es) once it has been fully idle\n(no invocation in flight) for DefaultIdleTimeout (10m), then respawns lazily on\nthe next invoke. So a function you stop calling stops holding memory — a\nnever-invoked function already costs nothing, and now a gone-quiet o\n[…]\nThe window resets on every drain-to-idle, so active development\nkeeps warm-start latency. SetIdleTimeout overrides it (tests use 150ms).\n\nTest: TestPoolScalesToZeroWhenIdle (warm → reaped → respawns).",
          "is_bot": false,
          "headline": "feat(lambda): scale idle function pools to zero",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T13:41:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "263fbd550ea8f49608c9b076a850d0b8b3972821",
          "body": "…untimes\n\nConsole:\n- Lambda Test tab no longer has a dead right half at rest — it shows an \"At a\n  glance\" panel (runtime, handler, timeout, memory, triggers) that the invoke\n  result replaces on run. Async wiring lives in the Connections strip above.\n- S3 bucket detail pages now show the Connection\n[…]\nWS-supported language launch without an explicit command.\n\nTests: TestConnectionsView (redrive fed-by/drains-to both directions),\nTestRuntimeCommand (all runtime mappings + unsupported-runtime error).",
          "is_bot": false,
          "headline": "feat(console,lambda): Lambda Test-tab summary, S3 connections, more r…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T13:14:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3ad7825ce3f9b2323743343e082e9fb39dd99ccc",
          "body": "Every SQS/SNS/Lambda/EventBridge detail page now shows a compact \"Fed by → this\n→ Drains to\" strip of its immediate connections, built from the wiring graph\n(backend.Neighbors). Each neighbor is a service-colored, edge-kind-labeled,\nclickable chip — you see a resource's wiring without leaving its page, which the\nAWS console can't do. Complements the global Flows map.",
          "is_bot": false,
          "headline": "feat(console): per-resource Connections strip (local 1-hop wiring)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T13:06:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4df8c4b744eb656e696ae296c21fc001f7a233ba",
          "body": "Lambda is now a full graph source: besides DLQ, its EventInvokeConfig\nOnSuccess/OnFailure destinations (SQS/SNS/Lambda/EventBridge) are read via\nGetFunctionEventInvokeConfig and drawn as \"dest\" edges. The Configuration tab\nlists On success/On failure destinations with copy chips. New legend entry.",
          "is_bot": false,
          "headline": "feat(console): Lambda async destinations in Flows + config page",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T13:01:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "72d0d9712fa144f169d9d8406cabf8bf3dfa0520",
          "body": "Each independent flow now renders as its own bordered card with a header label\nand a self-contained SVG in LOCAL coordinates, instead of all flows sharing one\ncanvas separated by faint dashed lines. FlowGraph now carries []FlowDiagram\n(each with its own nodes/edges/W/H) + a separate Unwired []FlowNode rendered as\nchips in a \"Not connected\" card. Reads far cleaner: \"order-events flow\" and\n\"emails flow\" are visibly distinct boxes. -race clean.",
          "is_bot": false,
          "headline": "feat(console): one card per flow (was all-in-one-canvas)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T12:55:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "55cf02ce95cb2b45a26b706e0b536cab4a3a14b1",
          "body": "…lored edges\n\nFixes the two issues raised in review:\n\nMultiple flows are now SEPARATED. layoutFlows groups the graph into independent\nconnected components (union-find over edges) and renders each as its own labeled\nband (\"order-events flow\", \"emails flow\"), laid out left-to-right by real chain\ndepth\n[…]\nify/redrive) with a legend,\nreplacing the text labels that overlapped nodes; redrive/dlq edges are dashed\nand route from node bottom to target top. Each node carries a service color bar.\n\n-race clean.",
          "is_bot": false,
          "headline": "feat(console): Flows redesign - separate flow bands, Lambda edges, co…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T12:45:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f60d50f845e4f4d7f954c78787f84b9f0e9a5e5",
          "body": "…affic, value workspace\n\nThe enterprise-grade rebuild agreed from the wireframes. Reframes the console\nfrom a page-per-service site into a three-pane workbench with two new global\nsurfaces, on the same server-rendered Go + HTMX + Alpine stack.\n\nShell (de-jitter by architecture):\n- Three panes: icon \n[…]\n + count/size footer, creates render in the\ndetail pane with a sticky action bar.\n\nTests updated for the shell; new coverage for the flows graph edges + 204-skip\nand the traffic recorder. -race clean.",
          "is_bot": false,
          "headline": "feat(console): workbench overhaul - rail/list/detail shell, Flows, Tr…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T12:29:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a9897c27943fba2ddc3f3f459f8ed2e214196b9c",
          "body": "… highlighting\n\nEditability:\n- Bucket tags: add/remove directly on the Properties tab (rebuilds the tag set\n  via PutBucketTagging; empty set deletes the tagging config)\n- SQS: pencil toggles an inline edit form for visibility/retention/delay\n  (SetQueueAttributes), config partial re-renders in plac\n[…]\no the textarea on htmx:configRequest and native submit;\n  dialogs refresh CM on open (hidden-init sizing)\n\nTests: tag add/remove, queue attribute edit, prefilled editors, CM asset\nserved. -race clean.",
          "is_bot": false,
          "headline": "feat(console): editing everywhere + CodeMirror editors with JSON/YAML…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T11:16:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f86d45401887f429ea7072bd6de2d5e8e3d58da7",
          "body": "The layout rewrite dropped the alpine:init handler that registers the 'filter'\nstore. Every list row gates on x-show=\"$store.filter.q…\", which evaluated to\nundefined (falsy) without it — so every table rendered empty while headers and\ncounts stayed visible. Re-add the registration and a test asserting the layout\nships it (server tests can't execute Alpine, but they can pin the contract).",
          "is_bot": false,
          "headline": "fix(console): restore the Alpine filter store registration",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T11:04:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ddec015a8cbc431ec2ebddc133d6b9d199a29c9",
          "body": "…, dropzone\n\nThe next-level pass — AWS-console information architecture with the HTMX+Alpine\nstack pushed properly:\n\n- Full-page create flows replace every modal dialog (9 sectioned forms: S3,\n  SQS, DynamoDB, SNS, EB bus + rule, KMS, SSM, Secrets). Large values get real\n  estate (10-12 row editors \n[…]\nes everywhere (create button inside the invitation).\n\nTests updated for the redirect flow (create helper asserts 303 + Location) +\nnew coverage for all 9 create pages and the palette API. -race clean.",
          "is_bot": false,
          "headline": "feat(console): full-page creates, official AWS icons, command palette…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T10:50:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c6684da9aa274b6a4c26c8972c498fdfaf820d6",
          "body": "Expand the S3+SQS slice to the complete console — every doze-aws service gets a\nreal management surface, AWS-console information architecture with shadcn-grade\nexecution, still server-rendered Go + HTMX + Alpine in the single binary:\n\n- Identity band on every resource page: colored service glyph, re\n[…]\nT-JSON Lambda) + plain-JSON<->\n  AttributeValue converters\n\n9 new flow tests (create -> render -> mutate per service, incl. SNS->SQS and\nEB->SQS deliveries driven from the UI); all green, -race clean.",
          "is_bot": false,
          "headline": "feat(console): full 10-service management console",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T03:39:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "93d448bddf74c46d1bd206f79ae3be441b2457e9",
          "body": "Address UX feedback:\n- Remove the global-looking top-bar search (it only filtered one table). Move a\n  scoped filter into the S3/SQS list headers where it clearly belongs to that\n  table; drop the now-unused Cmd-K handler.\n- Tighten table density: 34px rows / 29px headers / 12px padding (from 40/34/\n[…]\n (type, size, ETag, last-modified, storage\n  class), an inline image preview, a copyable s3:// path, and download/delete\n  actions. New backend HeadObject + /s3/{bucket}/meta route; covered by a test.",
          "is_bot": false,
          "headline": "feat(console): scoped filter, denser tables, S3 object detail drawer",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T02:56:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0065e797574ff86b4422400f74929622711e2b25",
          "body": "…compact\n\nRebuild the visual layer to a Linear/Vercel-grade shadcn 'new-york' feel, all in\nHTMX + Alpine + hand-authored CSS (no React, no build step):\n\n- Real Lucide SVG icons (the set shadcn ships) replacing every emoji — inlined\n  via a Go template func, currentColor, crisp at any size\n- Vendored\n[…]\ntates with icons, kbd, sticky\n  blurred top bar\n- htmx<->Alpine glue (initTree on afterSwap) so interactions survive swaps\n\nStill server-rendered Go templates, still one binary. Tests updated + green.",
          "is_bot": false,
          "headline": "feat(console): premium redesign — Lucide icons, Alpine interactions, …",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T02:43:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1fc600d6d33a6c3df41b87f35573f4812462339d",
          "body": "Replace the utilitarian styling with a proper design system:\n- shadcn-faithful HSL token palette (neutral zinc base, blue primary), soft\n  borders, generous radius, layered shadows — theme-aware (light/dark via\n  prefers-color-scheme + data-theme override)\n- self-hosted Inter variable font (vendored\n[…]\npill\n\nNo new toolchain — still server-rendered Go templates + embedded assets in the\nsingle binary. shadcn/ui proper needs React+Tailwind (breaks the no-node ethos);\nthis reproduces the look natively.",
          "is_bot": false,
          "headline": "feat(console): shadcn-style redesign with AWS-console structure",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T02:30:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4a0bcb8fd835bd236cfa7e0c2619289cba603157",
          "body": "A lightweight, server-rendered management console mounted at /_console on the\nsame :4566 endpoint. Server-rendered Go html/template + vendored HTMX (embedded\nvia go:embed) — no SPA build step, ships inside the single Go binary, no CDN at\nruntime.\n\nArchitecture: the console is just another CLIENT of \n[…]\nsole's\npoll-for-messages. Overview page ties it together.\n\nWired into cmd/doze-aws (-console flag, default on). Theme-aware CSS\n(light/dark). Tests drive the full flow end-to-end through the handlers.",
          "is_bot": false,
          "headline": "feat(console): web management UI prototype — S3 + SQS slice (HTMX)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T02:10:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bff3170ac5b07c8d1559b18845c7e90847d05b14",
          "body": "…lients\n\nProtocol audit for the 'get people with older code on board' concern: SigV2 was\nonly exercised at the parse layer (sigparse unit/fuzz) and the routing layer\n(gateway stubs) — nothing drove a real old-style request through the full Stack\nto a real handler and back.\n\nAdd protocol_test.go (roo\n[…]\nked S3 uploads, ListObjects V1+V2, SQS/SNS/STS Query, presigned\nexpiry). doze-aws parses signatures without verifying, so these confirm a\nlegacy-signed request is accepted and served, not just parsed.",
          "is_bot": false,
          "headline": "test: end-to-end legacy-protocol acceptance (SigV2 + Query) for old c…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T01:37:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "57de0b9f066ca7eb36d43d3a64611da1be25bbd8",
          "body": "…trix)\n\nThe last two services without aws-sdk-go (v1) contract tests. Now all 10\nservices are exercised by both SDK generations, per the dual-SDK requirement.\n\n- eventbridge/sdkv1_test.go: rule lifecycle (PutRule/PutTargets/DescribeRule/\n  ListRules/ListTargetsByRule/PutEvents/RemoveTargets/DeleteRu\n[…]\n\n  the v1 Lambda client, reusing buildBootstrap\n\nBoth pure-JSON protocols (no SigV2/Query divergence), so this confirms the v1\nwire encoding is accepted rather than exercising a distinct signing path.",
          "is_bot": false,
          "headline": "test: dual-SDK v1 coverage for eventbridge + lambda (completes the ma…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T01:34:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9ba189ab4bc6b576cb9644aabd2d09b09b926d6e",
          "body": "…ant)\n\nConfidence audit found restart durability was tested for SQS only, while the\nother bbolt-backed services never verified that state survives Close+reopen —\nthe core 'I restarted doze and my data is still here' guarantee.\n\nAdd TestPersistenceAcrossRestart: black-box through the real SDKs, write\n[…]\nt check decrypts KMS ciphertext produced before\nthe restart, proving the key's backing material was persisted (not regenerated).\n\nRuns in the normal suite (unlike the soak-tagged kill/restart checks).",
          "is_bot": false,
          "headline": "test: cross-service persistence across restart (the durability invari…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T01:31:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7140a949ebe42d529166bcc86e081213aaf04137",
          "body": "Close the gap found in the last test pass: routeDestination (async\nOnSuccess/OnFailure destinations) was wired but unreachable via any SDK. Add the\nPut/Get/Update/List/DeleteFunctionEventInvokeConfig handlers under the\n/functions/{name}/event-invoke-config[/list] subresource, storing the raw\nDestina\n[…]\n-after-delete) and an\nend-to-end integration test (failing lambda -> OnFailure SQS destination record\nwith condition RetriesExhausted). Lambda coverage 69.2->70.6.\n\nUpdated docs/api-support/lambda.md.",
          "is_bot": false,
          "headline": "feat(lambda): EventInvokeConfig handlers (async destinations, reachable)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T00:46:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b59f0a47ac86d60a1a8ce72d099e02925807aa02",
          "body": "…otation flags, data key pairs, ZipFile)\n\nTargeted the untested-but-meaningful surface the low-coverage services still\nhad — not error stringers or formatting helpers, which stay deliberately\nuncovered:\n\n- kms: automatic-rotation enable/disable + status, GenerateDataKeyPair\n  (asymmetric), key polic\n[…]\ning lambda -> retries exhausted ->\n  SQS dead-letter) end to end through a full Stack\n\nCoverage: s3 68.2->71.2, lambda 65.2->69.2, sqs 65.9->75.3, kms 67.3->74.9.\nFull -race suite green (30 packages).",
          "is_bot": false,
          "headline": "test: cover the last real feature gaps (retention, DLQ, move tasks, r…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T00:25:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c429adc8fe67d6373c0a99a032f835904c1b402f",
          "body": "End-to-end wiring flows through a real Stack with real SDKs, covering the\nLambda-as-target paths that weren't exercised before:\n- TestIntegrationLambdaSinks: a compiled recording Lambda driven by\n  SNS->Lambda (subscription), SQS event-source-mapping->Lambda (poll +\n  batch deliver), and EventBridge\n[…]\no an SNS topic that delivers to a subscribed SQS\n  queue.\n\nComplements the existing SNS->SQS, EventBridge->SQS, S3->SQS, and\nSM-rotation->Lambda integration tests. Full suite race-clean (30\npackages).",
          "is_bot": false,
          "headline": "Full cross-service integration suite (Lambda sinks + S3->SNS->SQS chain)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T00:10:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "99ccb27c25f620b1aba3a537233331feb51fa823",
          "body": "Targeted the previously-untested admin/management operations of each\nservice (found via coverage profiles):\n- dynamodb (+8): table tags, UpdateTable, Describe{Limits,Endpoints,\n  ContinuousBackups}, PartiQL Batch + Transaction.\n- sqs (management): list/delete queue, set-attributes, change-visibility\n[…]\nlete, tags.\n- secretsmanager (+13): UpdateSecret, BatchGetSecretValue, tags, resource\n  policy, CancelRotateSecret.\n- sts (+18): AssumeRoleWithSAML.\n\nEvery service now 65-78%+, from a 48-70% baseline.",
          "is_bot": false,
          "headline": "Raise coverage across the remaining 8 services via SDK contract tests",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T00:07:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4b6691e0d4bea928d78e7320b3ea04779a3fb9d9",
          "body": "….2%)\n\nUpdateFunctionConfiguration/UpdateFunctionCode, PublishVersion, reserved\nconcurrency put/get/delete, tags, and event-source-mapping CRUD (create/\nget/update/list/delete).",
          "is_bot": false,
          "headline": "lambda: management + event-source-mapping coverage tests (48.7% -> 65…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T00:02:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c508d22f9fc3b2e419cd6110fc309edbe625172",
          "body": "…copy tests",
          "is_bot": false,
          "headline": "s3: CORS+preflight, lifecycle, website, encryption, object ACL, part-…",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-11T00:00:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e1c3ffe12f05d12efe9aed3c6a1dfef2a4de47c4",
          "body": "Contract tests via the SDK for the previously-untested surface: bucket\nops (list/head/location/delete), versioning + bucket tagging, bucket\npolicy + ACL, object tagging + GetObjectAttributes, object lock (legal\nhold), and the full multipart flow (create/list-uploads/upload-part/\nlist-parts/complete/abort).",
          "is_bot": false,
          "headline": "s3: comprehensive coverage tests (48.6% -> 63.6%)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:59:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aea8151eda60aefbf49f6c55f8e943f8a4dd4303",
          "body": "These were exercised only transitively; add focused unit tests so they're\ncovered directly and their contracts are pinned:\n- peers: None/InProcess(dispatch)/UnixSockets/FromEnv(both env forms)/\n  Static + Endpoint.URL.\n- awsident: ARN vs GlobalARN (region-segment difference) + constants.\n- internal/\n[…]\nl/peercall: SQS send/receive/delete, Lambda sync + async invoke,\n  SNS publish against a recording peer, plus the no-peer-wired errors.\n- internal/ddb/store: white-box item + table lifecycle + counts.",
          "is_bot": false,
          "headline": "Direct tests for the 0%-coverage foundational packages",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:56:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "26bd1856dfbdfbcb0dde913e31ddbdfca584b932",
          "body": "- FuzzOpenBlob: the ciphertext-blob parser runs on untrusted\n  CiphertextBlob from Decrypt/ReEncrypt; feed it arbitrary bytes, assert\n  it rejects malformed input without panicking. 1.2M execs clean.\n- FuzzMembers: the indexed-member query parser (Attribute.N.* / entry.N.*)\n  on adversarial query strings. 2.8M execs clean.\nBoth registered in the weekly fuzz workflow.",
          "is_bot": false,
          "headline": "Fuzz the KMS ciphertext-blob parser and awsquery member decoder",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:53:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c7cbac36fccd68709dffd84974b241c28f4f864",
          "body": "- Taskfile 'check' (gofmt check + vet + go test -race ./...) and\n  'hooks:install' (a git pre-push hook that runs it) — so the race class\n  can't reach CI again.\n- New scheduled Soak workflow (weekly + manual dispatch) running the\n  cross-service soak with the race detector.\n- TestConcurrencyStress \n[…]\nlivery goroutines are exercised under concurrency.\n- TestStackChurn starts/stops many Stacks concurrently, incl. a double\n  Close, covering the New/Close lifecycle + shutdown-race class under\n  -race.",
          "is_bot": false,
          "headline": "Testing infra: pre-push race gate, soak-in-CI, wider stress + churn",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:51:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "923c0d6ac07059d1fd45e696f5adf678718922f8",
          "body": "Two additions aimed at the bug classes single-threaded contract tests\nmiss — the parser boundary and concurrent store access.\n\n- FuzzPartiQL feeds arbitrary statements through the tokenizer, parser,\n  and value binder, asserting no panics. 2.1M executions clean locally;\n  registered in the weekly fu\n[…]\nconcurrent bbolt access and shared in-memory state across services —\n  exactly the class of race the scheduler and lambda-pool bugs were.\n\nFull suite: go test -race ./... clean across all 25 packages.",
          "is_bot": false,
          "headline": "Deepen testing: PartiQL fuzz + cross-service concurrency stress",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:40:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5ffd18aeb6f70bf31b704c6f0ae46805cf40dc77",
          "body": "Both were in the Phase 8 concurrency work:\n\n1. eventbridge: Close() wrote s.stop = nil while the scheduler goroutine\n   read s.stop in its select — a data race on the field. The goroutine\n   now takes the channel as an argument (never touches s.stop), Close\n   closes it exactly once via sync.Once, a\n[…]\nrrent Runners raced on the shared\n   Command slice's backing array. buildCommand now copies the argv slice\n   before mutating it.\n\nFull suite is race-clean: go test -race ./... passes all 24 packages.",
          "is_bot": false,
          "headline": "Fix two data races caught by -race CI",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:36:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "269d31e055661f70e5e3f3988f8d6603baa90a15",
          "body": "docs/cli.md documents the full CLI surface: the three commands (serve,\nversion, config print), every flag (--config/--listen/--data-dir/\n--services/--s3-host), the doze-aws.toml config file and precedence\n(defaults -> file -> flags), how AWS SDKs/CLI connect (endpoint + creds +\nper-service AWS_ENDPOINT_URL_* vars), and persistence/reset. Linked from\nthe docs index.",
          "is_bot": false,
          "headline": "docs: add CLI + configuration reference",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:22:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "796f70f0512ee0a267b9cf6e2f90e5e974055425",
          "body": "docs/embedding.md had API fragments but no end-to-end program. Add a\nself-contained main() that embeds a stack (S3 + SQS), serves it, and\ndrives both services through one endpoint with the real aws-sdk-go-v2 —\ncreate a bucket, put an object, send + receive an SQS message. Notes the\ngateway routes by wire signal and how to swap httptest for a long-running\nlistener on :4566.",
          "is_bot": false,
          "headline": "docs: add a complete runnable embedding example",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:11:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "79263a4f24bd5871d1d674390e76112603a29ccb",
          "body": "The wall-clock timing assertion flaked under parallel test load (24\npackages contending for CPU inflate process-startup). Rely on\npool.Size()==3 instead: the pool only grows past one runner when inflight\nexceeds the current size, which can't happen if invocations serialized —\na deterministic concurrency proof, independent of timing.",
          "is_bot": false,
          "headline": "lambdaruntime: make pool concurrency test deterministic",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T23:00:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "792d7507b05af866d8b75758336013065d3d4371",
          "body": "RotateSecret now runs the standard four-step rotation protocol\n(createSecret -> setSecret -> testSecret -> finishSecret), invoking the\nconfigured rotation Lambda synchronously for each step; the function does\nthe real work and moves the version stages back through Secrets Manager.\nCancelRotateSecret\n[…]\n drives\nit through all four steps in order (asserted via a step marker the\nfunction writes), and DescribeSecret reports RotationEnabled. This\ncompletes Phase 8: all five coverage items are functional.",
          "is_bot": false,
          "headline": "Phase 8: Secrets Manager rotation via Lambda (final coverage item)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T22:59:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "301cba7a1ff46a267b87df1b22cf1a2500ad0d0c",
          "body": "Invocations for a function now run across a growable Pool of Runners (one\nchild process each) instead of a single serialized Runner. The pool grows\nlazily to match observed concurrency and is capped at the function's\nreserved concurrency (DefaultPoolMax=5 when unset), so a serial caller\nkeeps one pr\n[…]\nr-C round-trip) now bounds real execution concurrency.\n\nTest: three concurrent 400ms invocations finish in well under the serial\n1.2s and the pool grows to three runners; serial invocations reuse one.",
          "is_bot": false,
          "headline": "Phase 8: Lambda concurrency pool",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T22:53:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cba26d750c447a8881f2040d51cdf42198e7961a",
          "body": "TestSDKTableLifecycleAndStubs asserted ExecuteStatement returned a stub;\nit's now functional (TestSDKPartiQL covers it), so the stub check moves to\nDescribeGlobalTable (global tables remain a stub — one region locally).",
          "is_bot": false,
          "headline": "dynamodb: update stub-assertion test (PartiQL now functional)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T22:46:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1342640242b8cd3466e9fab9dfe2ab54b0444b75",
          "body": "PartiQL is a translation layer: a statement is tokenized + parsed, its\n'?' parameters bound against Parameters (AttributeValues) and literals\n('string'/number/bool/null) resolved, then it's rewritten into the\nequivalent classic operation and run through the existing item handlers —\nso PartiQL inheri\n[…]\now functional.\n\nTest: real aws-sdk-go-v2 ExecuteStatement drives INSERT (params) ->\nSELECT (GetItem path) -> UPDATE (literal) -> DELETE, asserting each\neffect. Full DynamoDB + ddb-engine suites green.",
          "is_bot": false,
          "headline": "Phase 8: DynamoDB PartiQL (ExecuteStatement/Batch/Transaction)",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T22:46:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f9086219c91ac2a8fba0fc5eb1c8310fcd368c35",
          "body": "A per-server scheduler ticker (started in New, stopped in Close) fires\nany enabled rule whose rate(...) schedule interval has elapsed,\ndelivering the canonical 'Scheduled Event' (source aws.events) to the\nrule's targets — reusing the same dispatch path PutEvents uses. Supports\nrate(N minute[s]|hour[\n[…]\nocal stack), and archives/replay\nremain honest stubs.\n\nTest: parseRate across all units + cron/malformed rejection; the\ndue-firing logic arms on first sighting then re-fires once the interval\nelapses.",
          "is_bot": false,
          "headline": "Phase 8: EventBridge rate-scheduled rules",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T22:42:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "36f11be56483d4a5f3e0bb57c98c01a984350abb",
          "body": "RotateKeyOnDemand generates fresh symmetric backing material and retires\nthe old material (kept, newest-first, in Key.OldMaterials) so ciphertexts\nproduced before the rotation still decrypt — decrypt now tries the\ncurrent material then each superseded one. New encryptions use the new\nmaterial. Rotat\n[…]\n\n(ON_DEMAND). Both were Tier-S stubs; now functional.\n\nTest: encrypt, rotate, assert the pre-rotation ciphertext still decrypts\nand a fresh encrypt round-trips, and ListKeyRotations reports the event.",
          "is_bot": false,
          "headline": "Phase 8: KMS on-demand key rotation",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T22:38:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "26fb5a30f1ba92d6dde299d76de65f954dfbf769",
          "body": "- Soak/chaos harness (build-tagged, go tool task soak): mixed\n  cross-service workload under sustained load.\n- User docs: getting-started, embedding guide, docs index.\n- Fuzz CI covers six targets (sigparse, awschunk, ddb decimal/keyenc/\n  expr, eventpattern).\n\ndoze-aws is feature-complete: 10/10 se\n[…]\nan. Runtime deps remain\njust bbolt + toml. Ready to tag v0.1.0. Phase 8 items (PartiQL, KMS\nrotation, EB schedules, rotation-via-lambda, Lambda concurrency pool)\nanswer honest stubs until implemented.",
          "is_bot": false,
          "headline": "Phase 7: hardening + v0.1.0 readiness",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T19:24:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "781d1c7f4b029b9d789d7e15957145a15db7ea7c",
          "body": "The last two services and the wiring that connects all ten.\n\n- internal/eventpattern: full EventBridge content-based pattern language\n  (exact/prefix/suffix/equals-ignore-case/wildcard/anything-but/numeric/\n  exists/cidr/$or, nested fields, event-array any-element). Fuzzed.\n- internal/peercall: hand\n[…]\nle\nlands a matching event in SQS, a real compiled Go handler runs through\nthe SDK Invoke path, S3 PutObject lands an event record in SQS with\nsuffix filtering. Stack serves 10/10 services. Race-clean.",
          "is_bot": false,
          "headline": "Phase 6: EventBridge + Lambda + cross-service wiring",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T19:21:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "325e7b1d056a028b411f7556ab4971cc91a8c39a",
          "body": "The biggest single build, landed as pure leaf packages under a thin\nJSON-1.0 handler layer:\n\n- internal/ddb/item: full AttributeValue model; numbers are normalized\n  arbitrary-precision decimals (never floats) with numeric compare and\n  Add/Sub; 38-digit + range enforcement; set semantics; 400KB siz\n[…]\naws-sdk-go-v2 contract suite (CRUD/expressions/GSI/paging/\ntransactions/TTL) passed on its first run against the assembled\npipeline. v1 SDK round-trips too. Stack now serves 8/10 services.\nRace-clean.",
          "is_bot": false,
          "headline": "Phase 5: DynamoDB from scratch",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T18:59:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e01de9a6104850a52c3030983f112f95ee2ece4",
          "body": "The gofakes3 replacement: complete REST-XML S3 over a new storage engine,\nfixing every gap that motivated the rewrite.\n\n- internal/awschunk: streaming aws-chunked decoder (signed + unsigned\n  framing, trailer capture). Fuzzed.\n- internal/checksum: CRC32/C, SHA1/256 + in-house CRC64NVME (verified\n  a\n[…]\n refused. Feature tests for CORS/website/lifecycle (fake\nclock). White-box store suite caught three real bugs pre-ship (paging\nmarker skip, missing seqKey, unreachable website-index path).\nRace-clean.",
          "is_bot": false,
          "headline": "Phase 4: S3 from scratch",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T18:33:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "16a1e00fb470f226d5fd9819333ac1a59dd77dbf",
          "body": "Three JSON-1.1 services with real crypto throughout:\n\n- kms: symmetric AES-256-GCM (context as AAD, key id embedded in the\n  blob), asymmetric RSA_2048/3072/4096 + ECC_NIST_P256/384/521 (OAEP\n  encrypt/decrypt, PKCS1v1.5/PSS/ECDSA sign/verify, genuine SPKI DER from\n  GetPublicKey, GenerateDataKeyPai\n[…]\nda.\n\nStack now serves 6 of 10 services. Dual-SDK contract tests for all\nthree; DescribeSecret/ListSecrets stage-map field-name split handled\n(VersionIdsToStages vs SecretVersionsToStages). Race-clean.",
          "is_bot": false,
          "headline": "Phase 3: KMS (all key families), SSM Parameter Store, Secrets Manager",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T18:12:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c959c5ad31634ad56464080e9b09a58005a4cc1",
          "body": "SQS (dual protocol: AWS JSON 1.0 + legacy Query/XML) and SNS (Query/XML)\nmove here as public packages on the uniform Options/Server pattern.\nBattle-tested logic is preserved verbatim: FIFO group locking + dedup GC,\nDLQ redrive, notifier-driven long polling, retention janitor, filter\npolicies, raw de\n[…]\nll/move-tasks/fanout/filters/webhooks; v1: legacy Query round trip\nwith client-side MD5 validation, coded error envelopes). Real-binary E2E\nnow runs STS + SNS->SQS fanout through one port. Race-clean.",
          "is_bot": false,
          "headline": "Phase 2: port SQS + SNS from doze-modules, complete their API surface",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T17:51:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dc4ceb76133c5cece48e0c8de218b8b951b6753a",
          "body": "The foundation every later service builds on:\n\n- awsident: fixed local identity (region/account/test creds, LocalStack-\n  compatible values).\n- peers: cross-service directory abstraction (InProcess, UnixSockets,\n  FromEnv, Static) so services find siblings identically in one-process,\n  child-process\n[…]\n/ version, flags > TOML > defaults, graceful drain).\n- Contract tests with BOTH aws-sdk-go v1 and aws-sdk-go-v2, real-binary\n  E2E with SIGTERM drain, CI matrix + weekly fuzz, goreleaser + install.sh.",
          "is_bot": false,
          "headline": "Phase 1: repo skeleton, protocol packages, gateway, STS",
          "author_name": "Srinivas Iyer",
          "author_login": "pf-srini",
          "committed_at": "2026-07-10T17:36:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 3,
      "commits_last_year": 91,
      "latest_release_at": "2026-07-18T20:20:38Z",
      "latest_release_tag": "v0.3.0",
      "releases_from_tags": false,
      "days_since_last_push": 3,
      "active_weeks_last_year": 2,
      "days_since_latest_release": 3,
      "mean_days_between_releases": 3.9
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/doze-dev/doze-aws",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/doze-dev/doze-aws",
          "is_deprecated": false,
          "latest_version": "v0.3.0",
          "repository_url": "https://github.com/doze-dev/doze-aws",
          "versions_count": 3,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-18T19:26:56Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 3
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Taskfile.yml"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "e2e/tsconfig.json"
      ],
      "toolchain_manifests": [
        "e2e/fixtures/lambda-handler/go.mod",
        "go.mod"
      ],
      "largest_source_bytes": 170535,
      "source_files_sampled": 256,
      "oversized_source_files": 1,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "e2e/package.json",
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "github.com/BurntSushi/toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.55.8"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.42.1"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/credentials",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.28"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/dynamodb",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.60.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/eventbridge",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.47.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/kms",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.54.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/lambda",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.97.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/s3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.105.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/secretsmanager",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/sns",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.41.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/sqs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.45.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/ssm",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.71.0"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/sts",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "github.com/aws/smithy-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.27.3"
        },
        {
          "name": "go.etcd.io/bbolt",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "pf-srini",
          "commits": 91,
          "avatar_url": "https://avatars.githubusercontent.com/u/205800080?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "e2e.yml",
        "fuzz.yml",
        "release.yml",
        "soak.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 5,
            "reason": "5 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "c25e5418f9438c54aa9135f57819a2e012efcf73",
        "ran_at": "2026-07-22T18:51:08Z",
        "aggregate_score": 3.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-19T07:20:31Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/doze-dev/doze-aws",
    "host": "github.com",
    "name": "doze-aws",
    "owner": "doze-dev"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 45,
      "inputs": {
        "security": 33,
        "vitality": 69,
        "community": 24,
        "governance": 31,
        "engineering": 66
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 69,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "commits_last_year": 91,
              "human_commit_share": 1,
              "days_since_last_push": 3,
              "active_weeks_last_year": 2
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 3 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "2/52 weeks with commits",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "91 commits in the last year",
                "points": 17.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 91
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 3,
              "latest_release_tag": "v0.3.0",
              "releases_from_tags": false,
              "days_since_latest_release": 3,
              "mean_days_between_releases": 3.9
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "3 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 3 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~3.9 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 3.9
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 31,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 37,
            "inputs": {
              "followers": 0,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "doze-dev",
              "public_repos": 9,
              "account_age_days": 26
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "0 followers of doze-dev",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 0,
                      "login": "doze-dev"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "9 public repos, account ~0 yr old",
                "points": 7.4,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 9
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "packages": [
                "github.com/doze-dev/doze-aws"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 3
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 3 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "3 published versions",
                "points": 12,
                "status": "partial",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 66,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "5 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 33,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 33,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 3.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "5 existing vulnerabilities detected",
                "points": 3.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 60,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.989,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "90 of 91 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 90,
                      "sampled": 91
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Taskfile.yml"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "e2e/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "e2e/fixtures/lambda-handler/go.mod",
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Taskfile.yml",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Taskfile.yml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "e2e/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "e2e/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 91",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 91
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 170535,
              "source_files_sampled": 256,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/256 source files over 60KB",
                "points": 54.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 256,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-22T18:51:13.588216Z",
  "schema_version": "0.26.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/doze-dev/doze-aws.svg",
  "full_name": "doze-dev/doze-aws",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}