go-steer / core-agent

本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [
        "adk",
        "agent",
        "anthropic",
        "claude",
        "gemini",
        "golang",
        "llm",
        "mcp",
        "vertex-ai"
      ],
      "is_fork": false,
      "size_kb": 6414,
      "has_wiki": false,
      "homepage": "https://go-steer.github.io/core-agent/",
      "languages": {
        "Go": 4040214,
        "Shell": 159088,
        "Python": 69013,
        "Dockerfile": 8890,
        "Go Template": 1615
      },
      "pushed_at": "2026-07-30T23:54:43Z",
      "created_at": "2026-05-14T15:17:48Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-30T23:54:46Z",
      "description": "Reusable Go base agent on the Google ADK — multi-provider (Gemini, Vertex, Claude on Anthropic + Vertex), MCP-native, with AGENTS.md, skills, and permissions wired up.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "Organization",
      "login": "go-steer",
      "company": null,
      "location": null,
      "followers": 2,
      "avatar_url": "https://avatars.githubusercontent.com/u/277239378?v=4",
      "created_at": "2026-04-18T10:34:56Z",
      "is_verified": null,
      "public_repos": 7,
      "account_age_days": 103
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v2.8.0-dev.4",
          "kind": "prerelease",
          "published_at": "2026-07-29T21:21:13Z"
        },
        {
          "tag": "v2.8.0-dev.3",
          "kind": "prerelease",
          "published_at": "2026-07-28T21:09:48Z"
        },
        {
          "tag": "v2.8.0-dev.2",
          "kind": "prerelease",
          "published_at": "2026-07-28T01:29:58Z"
        },
        {
          "tag": "v2.8.0-dev.1",
          "kind": "prerelease",
          "published_at": "2026-07-27T16:40:26Z"
        },
        {
          "tag": "v2.7.0",
          "kind": "minor",
          "published_at": "2026-07-20T19:16:46Z"
        },
        {
          "tag": "v2.7.0-dev.5",
          "kind": "prerelease",
          "published_at": "2026-07-20T10:36:45Z"
        },
        {
          "tag": "v2.7.0-dev.4",
          "kind": "prerelease",
          "published_at": "2026-07-19T11:27:27Z"
        },
        {
          "tag": "v2.7.0-dev.3",
          "kind": "prerelease",
          "published_at": "2026-07-17T10:12:38Z"
        },
        {
          "tag": "v2.7.0-dev.2",
          "kind": "prerelease",
          "published_at": "2026-07-17T10:12:40Z"
        },
        {
          "tag": "v2.7.0-dev.1",
          "kind": "prerelease",
          "published_at": "2026-07-17T10:12:42Z"
        },
        {
          "tag": "v2.6.0",
          "kind": "minor",
          "published_at": "2026-07-10T16:15:35Z"
        },
        {
          "tag": "v2.5.0",
          "kind": "minor",
          "published_at": "2026-07-10T17:11:09Z"
        },
        {
          "tag": "v2.4.0",
          "kind": "minor",
          "published_at": "2026-07-10T17:11:34Z"
        },
        {
          "tag": "v2.3.1",
          "kind": "patch",
          "published_at": "2026-06-11T20:57:05Z"
        },
        {
          "tag": "v2.2.0",
          "kind": "minor",
          "published_at": "2026-06-01T16:58:05Z"
        },
        {
          "tag": "v2.1.0",
          "kind": "minor",
          "published_at": "2026-05-31T18:02:53Z"
        },
        {
          "tag": "v2.0.0",
          "kind": "major",
          "published_at": "2026-05-29T21:42:57Z"
        },
        {
          "tag": "v1.8.0",
          "kind": "minor",
          "published_at": "2026-05-23T09:41:19Z"
        },
        {
          "tag": "v1.7.0",
          "kind": "minor",
          "published_at": "2026-05-21T19:20:08Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2026-05-21T18:23:53Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2026-05-19T17:08:09Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "2ba938a2dfdd59c8dae9222101b20739dbb6ce1b",
          "body": "…s (#539) (#552)\n\nUn-defers the remaining half of session-resume-design's crash-recovery\nnon-goal (#537 shipped the corrupting half). Key decisions: detection\nderives from eventlog tail shapes (no write-ahead markers — the payoff\nof per-event persistence), continuation is a synthesized system-note\nt\n[…]\n bounded by the existing ceilings plus\nmax_per_boot. Off by default. Three-PR shape proposed.\n\nRegistered in docs/README.md; cross-referenced from\nsession-resume-design.md's non-goals note.\n\nRefs #539",
          "is_bot": false,
          "headline": "docs: design for opt-in auto-continuation of restart-interrupted turn…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T23:54:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d48484b059b7a6678551ea0bd4009a898b4b0a08",
          "body": "…estion histories (#541) (#551)\n\nsummarizerHistory and sessionHistory fed raw event contents to the\nmodel with none of the call/response rearrangement ADK's contents\nprocessor applies on the main turn path. Any history carrying a\ndangling functionCall, an orphaned functionResponse, or a #537\ntail-re\n[…]\nid\ntwo-pair histories) and two P2s (orphan-response text loss, mixed\nresponse+call contents) found and fixed pre-merge; remaining\nduplicate-non-empty-ID limitation documented in the godoc.\n\nFixes #541",
          "is_bot": false,
          "headline": "fix(agent): normalize call/response pairing in summarizer and side-qu…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T23:53:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "94f0dd1665044957a1af989e91d0efc71c53e201",
          "body": "…; flag in-memory default (#540) (#550)\n\n- New reference page 'Restarts and shutdown': SIGTERM semantics (interrupt\n  immediately, exit 0, bounded ~24s teardown budget), the per-event\n  durability contract and its two preconditions (--session-db + surviving\n  storage), lazy interactive resume vs exp\n[…]\n- GKE example: explicit terminationGracePeriodSeconds: 30 tied to the\n  teardown budget.\n- README: --session-db blurb now states the in-memory default consequence\n  for daemon deployments.\n\nFixes #540",
          "is_bot": false,
          "headline": "docs: document the restarts & shutdown contract; pin GKE grace period…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T23:20:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "daa78fc14b8b7140fe83d5487850c6ba23d5d3af",
          "body": "…attach shutdown timeout (#538) (#548)\n\nTeardown was LIFO defers with three unbounded waits and one orphan:\n\n- background.Manager.Close blocked forever on each subagent's done\n  channel; one wedged tool call held teardown hostage until the\n  supervisor's SIGKILL. Close now drains for a bounded windo\n[…]\n + three 3s\ntelemetry steps ≈ 24s — inside K8s' default 30s\nterminationGracePeriodSeconds with headroom. Documented at the\notelShutdown defer; the operator-facing contract lands with #540.\n\nFixes #538",
          "is_bot": false,
          "headline": "feat(shutdown): bound every teardown wait; reap MCP children; expose …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T23:16:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2a0ce9bfe226898b49f4592b3ce9b565b3087087",
          "body": "Persistence is per-event: the model response carrying a functionCall\ncommits before the tool runs. A crash mid-tool (SIGKILL, OOMKill) never\nproduces the functionResponse, and a mid-tool cancellation (ESC, attach\ninterrupt, SIGTERM) synthesizes one but appends it with the already-\ncancelled turn ctx\n[…]\n the corrupting half of docs/session-resume-design.md's\ncrash-recovery non-goal; auto-continuing the interrupted turn stays\ndeferred as #539. Summarizer-path pairing gap split out to #541.\n\nFixes #537",
          "is_bot": false,
          "headline": "fix(agent): repair dangling tool-call tails at turn start (#537) (#543)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T22:57:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "36b4842bb7f5a2622ffc2dc88efe743a40903a75",
          "body": "…rs (#338 Phase 3, slice 3) (#528)\n\n* feat(digest,attach,mcp,agent,autonomous): core_agent.* subsystem meters (#338 Phase 3, slice 3)\n\nPer-subsystem RegisterMetrics observers wired at daemon boot:\n\n- digest: calls + bytes_saved per method over the process-global\n  Telemetry() snapshot; the design do\n[…]\ntead of\n  silently dropped\n- design doc: per-session counter-restart-on-resume acceptance noted\n  on the compactions row; AgentSource documents the session.id\n  source divergence vs the usage observer",
          "is_bot": false,
          "headline": "feat(digest,attach,mcp,agent,autonomous): core_agent.* subsystem mete…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T19:01:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bd0f67ed2653ca0fa99d3c8276da73376dbd5061",
          "body": "…ssion usage metrics (#338 Phase 3, slice 2) (#527)\n\n* feat(usage,compose,config): session-label cardinality knob + multi-session usage metrics (#338 Phase 3, slice 2)\n\ncompose.RegistryTrackerProvider bridges the attach SessionRegistry\ninto usage.RegisterMetrics: multi-session daemons now report\nper\n[…]\nurce/attrs, duration resume caveat,\n  shipped-idiom note on the Observer-composition sketch)\n- tests: eviction/resume monotonicity, per-model separation,\n  priced=true branch, shared-tracker last-wins",
          "is_bot": false,
          "headline": "feat(usage,compose,config): session-label cardinality knob + multi-se…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T18:56:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "86336cb8dade35e56bb6a7850d19a1c91d10d696",
          "body": "…ls (#338 Phase 3, slice 1) (#526)\n\n* feat(agent,tools): ADK-schema GenAI histograms for turns and tool calls (#338 Phase 3, slice 1)\n\ngen_ai.agent.invocation.duration: one point per turn from Agent.Run's\nterminal cleanup; gen_ai.agent.name attr; error.type only on failed\nturns, carrying the stable \n[…]\n)\n- recordInvocation nil-guards hand-constructed Agents\n- lock-wait test bound loosened to hold/2 (scheduling noise)\n- site docs otel.md bullet updated with the new histograms\n\n* fixup: unconvert lint",
          "is_bot": false,
          "headline": "feat(agent,tools): ADK-schema GenAI histograms for turns and tool cal…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T17:42:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c8bca81ac849114f1c9b09a317126ca847df3417",
          "body": "…recipe pins past the CSRF/Content-Type skew (#529)\n\nThe GKE-troubleshoot e2e pinned ghcr.io/go-steer/core-agent:2.6.0, so\nno CI leg ever ran a current daemon against the shipped watcher. That\nblind spot let #383's CSRF guard (PR #431, in 2.8.0-dev.1+) ship while\nthe e2e stayed green — meanwhile on \n[…]\ntion 415 (12 occurrences in watcher\n  logs) - the e2e now catches this regression class.\n- positive: HEAD daemon + lookout built from k8s-lookout#139 goes\n  fully green (event -> inject -> echo turn).",
          "is_bot": false,
          "headline": "fix(e2e,examples): build the troubleshoot-e2e daemon from HEAD; bump …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T14:43:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ef9b9b5ee1d66a008a34d33f2929e2484c106af0",
          "body": "…elhttp wrap (#325, #338 Phase 1) (#525)\n\n#325 verify-first outcome: on Vertex, genai already builds its HTTP\nclient through cloud.google.com/go/auth/httptransport, whose default\ntelemetry wraps the transport in otelhttp — HTTP client spans and\ntraceparent were live-verified working with no code cha\n[…]\nin 'both' mode.\n\nDocs: otel.md's stale 'metrics aren't emitted yet' bullet replaced\nwith the real opt-in surface; metrics-design.md gains the runtime\ninstrument inventory.\n\nCloses #325. Advances #338.",
          "is_bot": false,
          "headline": "feat(telemetry,models/gemini): Go runtime metrics + Gemini API-key ot…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-30T09:22:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25d8531cf8d1d69459471009a9e7e2e9b0dff1e2",
          "body": "* chore(pricing): regen builtin catalog from LiteLLM (2026-07-29 stamp; rates unchanged)\n\n* chore(changelog): promote [Unreleased] to [2.8.0-dev.4]",
          "is_bot": false,
          "headline": "chore(changelog): promote [Unreleased] to [2.8.0-dev.4] (#524)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T21:16:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "850bbed6e8df75a56e0c59d83c43a07ceec486c2",
          "body": "…ete the edit-sequencing prompt rule (#523)\n\n#460 - the #459 design's marked exit path, taken exactly as\nspecified: prompt text standing in for a missing executor guarantee\nis retired by shipping the guarantee.\n\npkg/tools/serialize.go: within one model response, read-only tools\nkeep ADK's concurrent\n[…]\n-barrier dispatch test drives real ADK fan-out: mutual\nexclusion pinned deterministically (unwrapped run shows in-flight\nmax=2), read-only concurrency via a barrier CI catches across runs.\n\nFixes #460",
          "is_bot": false,
          "headline": "feat(tools,agent): serialize mutating tool calls in the executor; del…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T20:47:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0499f692d4b579d2c0a2a83a540406099106ca9",
          "body": "…rlays, user layers (#522)\n\nImplements docs/system-prompt-layering-design.md (#459); the doc's\nimplementation notes are authoritative and every settled decision is\nhonored.\n\npkg/agent: the ~350-word DefaultInstruction monolith becomes ordered\nlayers, stable -> volatile: CoreInstruction (parallel-dis\n[…]\nry-verified word-identical const texts vs the design doc\n(190/190 on CoreInstruction after a one-space catch), legacy-prefix\nbyte-compat, spawn composition, and the doc rewrites' accuracy.\n\nFixes #459",
          "is_bot": false,
          "headline": "feat(agent): system prompt layering - core, provider quirks, mode ove…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T20:19:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "58acd31c67ea1cdc51e9c1655d6468e8b5aee564",
          "body": "…precate the attach-named seam (#519)\n\n* refactor(agent,attach): transport-neutral SetOperatorEventEmitter; deprecate the attach-named seam\n\n#506 (split from #492 item 8; name picked by maintainer). The typed\noperator-event seam - status-update, usage-update, turn-complete/\nerror, inbox - baked one \n[…]\nshipped, surfaced twice consecutively on PR #519's\nCI under full-suite -race load. The test DSN now carries the same\npragma, making the double representative of the real connection\nconfig.\n\nFixes #520",
          "is_bot": false,
          "headline": "refactor(agent,attach): transport-neutral SetOperatorEventEmitter; de…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T15:44:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "daee688c5656ad45cf8d48930a843a12e9e86a01",
          "body": "…del from a pre-built Agent (#518)\n\n#510 (follow-up from #492 item 1's review). runner.RunOptions\nrequired Model even alongside a pre-built Agent because the agent\nexposed only ModelName(), not the LLM - the exact agent/model\nmismatch invitation the #492 assessment flagged on the old\npositional vari\n[…]\ny-verified: no new encapsulation exposure (the interface\ncarries only Name/GenerateContent and embedders already hold the\nLLM they passed to New), derivation ordering sound, docs accurate.\n\nFixes #510",
          "is_bot": false,
          "headline": "feat(agent,runner): Agent.Model() accessor; runner.Run derives the mo…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T15:14:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6a4810b193d9eaeea894f0d856ce6b0441b2573e",
          "body": "…it (#517)\n\n#499. The full-suite -race CI run flaked\nTestInit_TransientCancelRetriesInsteadOfStickyFail with 'condition\nnever became true within 1s' (2026-07-29, PR #498's run): every\nwaitFor in the file used a 1s deadline against conditions that are\ngoroutine-scheduling hops - microseconds on an id\n[…]\n negative, not\nfalse), and that the 20ms negative-assertion sleeps are a different\nrisk class (false-PASS) correctly left per file convention. Same\ntreatment as the #462 resume-test flake.\n\nFixes #499",
          "is_bot": false,
          "headline": "test(vertexcache): widen async assertion deadlines to a shared testWa…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T15:03:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d9d55ec58b01ba2533a92bea3bb1df6608c6b103",
          "body": "…iling Spawn (#516)\n\n#502 (found during #488's adversarial review). Close snapshots every\nhandle and blocks on <-h.done, but a Spawn that failed during\npre-launch resolution (tools/scheduler/model) never launched the\ngoroutine whose defer closes done - a Close that snapshotted the\nreservation inside\n[…]\nsult consumers nil-guard.\nDeterministic regression test parks a stub provider mid-resolution,\nsnapshots via concurrent Close, releases - hung 5s+ pre-fix, instant\npost-fix, 3x -race clean.\n\nFixes #502",
          "is_bot": false,
          "headline": "fix(background): Manager.Close no longer hangs racing a pre-launch-fa…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T14:54:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "905a80a901d937856b29b5e233ebc0f80dcbde22",
          "body": "….Customize (#515)\n\n#505 (split from the #492 umbrella; scope confirmed by maintainer:\ntools, skills, models - permissions already per-session via the\ntemplate-derived sub-gates).\n\nSessionFactoryDeps.Customize runs at the top of every session\nconstruction (POST /sessions creations AND lazy resumes) \n[…]\nonly\nCaller field populated on resume - documented as the hook contract\n(key on Identity or re-derive tenant metadata; Labels-keyed hooks\nwould silently rebuild differently after restart).\n\nFixes #505",
          "is_bot": false,
          "headline": "feat(compose): per-tenant session construction via SessionFactoryDeps…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T13:47:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "eee54b6f2c45d413c1f46a564b10d8611c04d460",
          "body": "…r-provider option structs (#514)\n\n#492 item 7 (final chunk). The only programmatic path through the\nprovider registry was Resolve(*config.Config) - embedders had to\nfabricate the on-disk config struct just to pick a backend.\n\nmodels.New(opts models.ProviderOptions) routes through the same\nregistry \n[…]\nroviders deliberately omitted (zero routing inputs; NewEcho is the\ndirect path). Resolve unchanged - still the config-file adapter.\nembed/api.md gains the models.New path beside Resolve.\n\nPart of #492",
          "is_bot": false,
          "headline": "feat(models): programmatic provider construction - models.New with pe…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T13:21:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "37273e78e8f2c15bf3ba612e5a387033efe5a2d7",
          "body": "…d forwarding shim (#513)\n\n#492 item 6. ADK's own session package dominates pkg/agent's\nsignatures, so our pkg/session collided in almost every file that\nused both, forcing import aliases on embedders.\n\n- pkg/session -> pkg/transcript (package clause + docs only; zero\n  code or string changes - adve\n[…]\nholds\n  across old and new sentinels (same underlying value).\n- Stability list swaps session for transcript with the forwards\n  note; cmd/core-agent and the embed API reference migrated.\n\nPart of #492",
          "is_bot": false,
          "headline": "refactor(transcript): rename pkg/session to pkg/transcript; deprecate…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T13:00:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e7c0be2b929aeb25e1d9ff32c8dcdef501d8e8a1",
          "body": "…me/Handle/Option (#512)\n\n#492 item 4. autonomous.RunAutonomous, autonomous.StartAutonomous,\nautonomous.ResumeAutonomous, autonomous.AutonomousHandle, and\nautonomous.AutonomousOption all repeated the package name; the\nprimary symbols are now Run / Start / Resume / Handle / Option, and\nRun's raw func\n[…]\niberately untouched (the first\nmechanical doc sweep corrupted them; it was reverted and redone\nqualifier-aware with an exclusion rule - adversary-verified zero\nhistorical lines altered).\n\nPart of #492",
          "is_bot": false,
          "headline": "refactor(autonomous): de-stutter the package surface - Run/Start/Resu…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T12:44:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c927c5e067464d1a3a82f676d2359893f4988e3b",
          "body": "… four REPL variants (#511)\n\n#492 item 1. The REPL surface had grown four positional permutations\n(REPL, REPLWithInitialPrompt, REPLWithAgent,\nREPLWithAgentAndInitialPrompt) at up to ten parameters, with the\nagent-taking forms accepting both agent AND model positionally - a\nmismatch invitation.\n\nrun\n[…]\n\nAdversary-verified: field-by-field parity with each variant, no\nin-tree caller relied on differing I/O, SA1019 clean (zero remaining\nvariant callers), site-doc snippet matches the code.\n\nPart of #492",
          "is_bot": false,
          "headline": "refactor(runner): one Run(ctx, RunOptions) entry point; deprecate the…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T12:25:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b8e8a3b1a0e407ced98069579010418c9a00f787",
          "body": "…missions (#509)\n\n#492 item 2. The .agents/config.json persistence seams lived in\ncompose only because that's where the extraction left them; hosts\nthat never touch compose (bare library embeddings) needed compose\njust for grant persistence.\n\n- pkg/config gains Mutate(agentsDir, fn): Load -> fn -> S\n[…]\n outside pkg/config), helper semantics\nbyte-equivalent except the disclosed drift, alias has no\ntype-identity consumers, SA1019 clean because no in-tree caller\nuses the deprecated names.\n\nPart of #492",
          "is_bot": false,
          "headline": "refactor(compose): re-home config persistence to pkg/config + pkg/per…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T12:10:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4bf582fb769e373be01f581b5880755d5d2607d4",
          "body": "…d spawner sentinel (#508)\n\n#492 item 5. New's doc claimed 'a may be nil (the adapter's methods\nall no-op / zero-value)' while the plain attach.Registrant forwards\nmisbehave on a nil agent - the identity accessors (AppName,\nSessionID, EventLog) nil-deref panic, Inject/InjectAs error,\nRequestWake no-\n[…]\nle comment (which still said the sentinel\nwas agent-side), and both pinned-literal test fixtures updated in\nlockstep. Operator-visible 501 mapping unchanged (integration test\ncovers it).\n\nPart of #492",
          "is_bot": false,
          "headline": "docs(attachadapter): one truthful nil-contract; attachadapter-prefixe…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T11:51:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1b5207cec674d0bcf812e78b1d41a760fd3d67f2",
          "body": "…context-cache handle (#507)\n\nThe #386 compose extraction moved code across the internal/ boundary\nwithout its types, leaving parts of the public API uncallable\noutside the module (#489):\n\n- compose.CfgToCatalogOverride returned map[string]pricing.ModelRates\n  and compose.DescribeRefresh took pricin\n[…]\n +\n  cut-ga-tag.sh - the exact 2026-07-18 stale-pricing incident class\n  they exist to prevent - became no-ops. All four updated.\n\nNo behavior change; go build/vet + full unit suite green.\n\nFixes #489",
          "is_bot": false,
          "headline": "refactor(pricing): promote internal/pricing to pkg/pricing; nameable …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T11:36:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a25586cf8d39d9742e58aea64c8c93e58991644",
          "body": "…; doc-truth pass (#504)\n\nThree second-assessment structural items in one attach/docs pass.\n\nattach capabilities (#490): the boot frame derived features + slash\ncommands by type-asserting optional interfaces on the registrant,\nbut attachadapter.Adapter satisfies all of them unconditionally -\nso ever\n[…]\n refresh). The issue's other two items need no code: the site\nhooks reference already exists (concepts/hooks, since #434) and\nagent.WithEventHook is already exported.\n\nFixes #490\nFixes #491\nFixes #493",
          "is_bot": false,
          "headline": "fix(attach): honest capabilities frame; compiling package-doc example…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T10:56:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "df4cefb9946e4b01c4afec88fd3a03d82014a06f",
          "body": "… env expansion, e2e robustness (#503)\n\nSix smaller fixes from the 2026-07-28 adversarial review, bundled\nper the roundup convention (#488):\n\nattach: Server.Close no longer burns the full ShutdownTimeout when\nstreaming clients are attached. Two hostage streams: /events (SSE\nhandlers block on subscri\n[…]\nfor BOTH streams (each verified burning\nthe full 20s pre-fix / with the latch neutered), unreserve +\nshouldAlert identity semantics, env-literal preservation incl.\nbraces. All -race clean.\n\nFixes #488",
          "is_bot": false,
          "headline": "fix: post-assessment roundup - shutdown hostage streams, spawn races,…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T10:24:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b8dd225e9ae7fdeb3ff23772cc5be25eed34b818",
          "body": "The SDK's *ssestream.Stream owns the HTTP response body and no path\nin GenerateContent called Close(). A full drain was only a hygiene\ngap (the EOF-read body's connection returns to the pool anyway), but\na consumer stopping mid-iteration - or an accumulate/stream error -\nleft a live TCP connection E\n[…]\n abandoned mid-continuation). Verified failing\npre-fix with exactly 6 unclosed bodies; the mid-stream connection\nhold was additionally confirmed at the TCP level during adversarial\nreview.\n\nFixes #487",
          "is_bot": false,
          "headline": "fix(anthropic): close every streaming response in GenerateContent (#501)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T10:01:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d13abbf4a491eeec9b5945c1e7a73a07b40d107c",
          "body": "…ected pool staleness check (#500)\n\nThe broadcaster pool keys by session triple, and only DELETE\n/sessions ever removed entries. After idle-evict + lazy resume the\nfresh Entry shares the triple, so pool.For handed it the OLD\nbroadcaster: boot snapshots and SetAttachEmitter bound to the dead\nagent (t\n[…]\nry; end-to-end SSE\nhang-up on eviction through the server-wired hook; pool.Close\nblocks on an in-flight Retire (gated-stream fence pin); Server.Close\njoins a parked sweep without deadlock.\n\nFixes #486",
          "is_bot": false,
          "headline": "fix(attach): retire a session's broadcaster on idle-evict; regSeq-dir…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T09:33:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5c3f9414e8a07512d44512c2ba4d594c0101e892",
          "body": "…ed sweep (#498)\n\nOn an eventlog Watch error the pump goroutine returned with no\ncleanup: subscribers kept open-but-silent channels (a frozen stream,\nno EOF to trigger a client reconnect) and b.cancel stayed set, so\nevery future Subscribe saw firstSub == false and never started a\nreplacement pump. O\n[…]\n- TestBroadcaster_StalePumpSweepSparesSuccessor: deterministic\n  reproduction of the stale-sweep interleaving via a gated iterator\n  return; the successor's subscriber must keep streaming.\n\nFixes #485",
          "is_bot": false,
          "headline": "fix(attach): pump death no longer strands live-tail; generation-guard…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-29T01:11:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "275ca8fd77285730831039ea279cbadcdb0bba5e",
          "body": "…on resume (#497)\n\nA Lookup miss on any session-scoped endpoint lazily RESUMES the\nsession: full agent construction, instruction load, unbounded\neventlog replay into the usage tracker, and a wake-loop spawn. Both\ngates that should bound that work ran after it:\n\n- lookupQualifiedAuth/lookupShortcutAu\n[…]\nsees the real persisted row), handler-level (stranger\ngets 404 with zero resumer calls, owner resumes and gets 200), and\nlimiter-order (429 on a resumable session with zero resumer calls).\n\nFixes #484",
          "is_bot": false,
          "headline": "fix(attach): run authorization and the cost limiter before lazy sessi…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T23:40:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8e5911f59217efaeac118d7fe252f72afb305734",
          "body": "Handlers resolve a session's broadcaster via pool.For before\nsubscribing, and DELETE /sessions (or server shutdown) runs\npool.Remove + Close in between - so Subscribe could execute against\nan already-closed broadcaster. That was a triple failure:\n\n1. panic: assignment to entry in nil map (Close nils\n[…]\nlose for 200 iterations\nunder -race and then asserts the broadcaster is still usable-shaped\n(post-Close Subscribe returns a closed channel; mutex not poisoned).\nVerified panicking pre-fix.\n\nFixes #483",
          "is_bot": false,
          "headline": "fix(attach): make Subscribe safe against a racing Close (#496)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T23:37:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29af4ef3b3e3b1d92bb739d60ae6604aed71a53d",
          "body": "ConfigGrantStore.Persist and the Append*/Persist* helpers were\nunguarded config.Load -> mutate -> config.Save sequences over one\nshared file. One store instance is set on the template gate and\nshared by every per-session sub-gate, so concurrent 'allow always'\nanswers (or /allow + /deny slashes) race\n[…]\n-update half.\n\nRegression test races 32 x {allow grant, deny append, path-scope\ngrant} through one store and asserts every entry survives (fails\npre-fix with ~3/32; green under -race now).\n\nFixes #482",
          "is_bot": false,
          "headline": "fix(compose): serialize .agents/config.json read-modify-writes (#495)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T23:33:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dbbac7cfe316c4e127e6b353ccb8244fd2d87ae4",
          "body": "…ry (#494)\n\nclampReplaySince computed floor = head_seq - maxReplayEvents in the\neventlog's global sequence space, but seq is one autoincrement shared\nacross every session in the log. A busy sibling session advanced the\nhead far past a quiet session's rows, so a since=0 reconnect clamped\naway most (o\n[…]\nver it replay exactly their newest cap-many events.\n\nRegression test interleaves a 100-row sibling between two sessions'\nbursts and asserts both the full-history and the still-capped side.\n\nFixes #481",
          "is_bot": false,
          "headline": "fix(attach): derive the replay-cap floor from the session's own histo…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T23:27:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5a89b558b45dac30c5a8e7a0c5c3ffa1180cc065",
          "body": "* docs: note Claude 5-gen support on providers page + CI pipeline coverage on troubleshooting page\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>\n\n* chore(changelog): promote [Unreleased] to [2.8.0-dev.3]\n\nCut via dev/release/cut-dev-tag.sh (pricing preflight clean — same-day\nregen). Carries th\n[…]\ns-page note\nfor Claude 5-gen support and the troubleshooting page's CI-coverage\nnote.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>\n\n---------\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "chore(changelog): promote [Unreleased] to [2.8.0-dev.3] (#480)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T21:05:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ed390bd2bf66eab1df826ac0e6d8b67c27c557ca",
          "body": "The kind-based troubleshoot e2e proved the recipe DEPLOYS; it now\nproves the pipeline FLOWS, hermetically on the echo provider:\n\n- Trigger: a broken pod (unpullable image) in a scratch namespace\n  fires a BackOff Warning event — verified present in lookout\n  v0.8.0's default reason filter (pkg/engin\n[…]\n10m.\n\nValidated by a full local kind run against the pinned images\n(core-agent:2.6.0 + lookout:v0.8.0) — passed first attempt, all\nassertions green.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(e2e): assert the event->inject->turn pipeline in the GKE e2e (#479)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T20:55:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c69dbf2902b82ce987e344251dc778cd46015ed",
          "body": "…4 follow-up) (#478)\n\nThe watcher sidecar now deploys k8s-lookout's published image —\nghcr.io/go-steer/lookout:v0.8.0 (multicall binary, `lookout watch`\nentrypoint) — completing the migration deferred when the source moved\nout of this repo in #464. The drop-in claim was verified against\nlookout's ca\n[…]\ne\n  flavor) rather than adopting it.\n\nK8s object/label/secret/SA names keep the k8s-event-watcher naming\n(drop-in; matches lookout's own manifests).\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "chore(examples): migrate gke-troubleshoot-agent onto k8s-lookout (#46…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T20:21:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e978d6f82e77ce9cd7de22e8bab2a748530a76d1",
          "body": "…+ site catalog (#477)\n\nThree new examples showcasing this week's surface, all hermetic\n(mock/echo providers, loopback listeners, temp dirs) and executed to\ncompletion in review:\n\n- examples/attach-daemon — the canonical post-#388 library embedding\n  of a headless daemon: agent.New -> attachadapter.\n[…]\nI friction found while building these is filed as #476\n(mock per-call scripted provider + two doc nits), also noted in the\nREADMEs where each bites.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(examples): attach-daemon, compose-multi-session, parallel-spawn …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T19:38:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6f2681f2e0b3b3ffac2e13e0aee94f87a532aeab",
          "body": "…#475)\n\n- READMEs (42-59 lines each, uniform sections: what it shows / run\n  it / key APIs / expected output / next) for all 10 library\n  examples: basic, streaming, with-tools, with-subagent, replay,\n  autonomous, autonomous-handle, autonomous-resume,\n  background-monitor, scheduled-monitor. Hermet\n[…]\narlier\n  merge.\n\nEvery hermetic example verified to run to completion (exit 0).\ngke-troubleshoot-agent deliberately untouched (pending k8s-lookout).\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "docs(examples): READMEs for every library example + staleness sweep (…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T19:25:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f698d1d4a4a2181c5e4e36ada28b804b33af2a18",
          "body": "The operator's Vertex project now has the Claude 5 family enabled\n(claude-sonnet-5, claude-opus-5, claude-fable-5), closing the last\ngap from the #397 E2E work: the thinking-model path can be exercised\nlive.\n\n- Builtin pricing: claude-opus-5 ($5/$25) and claude-fable-5\n  ($10/$50) join claude-sonnet\n[…]\neted the full bash tool\nloop (thinking blocks replayed on request 2 — the old adapter 400'd\nexactly there); opus-5 and fable-5 single-turn verified.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(models): first-class Claude 5-generation support (#474)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T13:28:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "744cc77c2e6319f4cc24cba2532c8b0fd56fc843",
          "body": "…-up) (#473)\n\nThe #463 per-caller cost rate limit was tunable only via the library's\nattach.Options. Operators of the bundled daemon can now set it from\n.agents/config.json:\n\n  \"attach\": { \"cost_rate_limit\": { \"per_minute\": 60, \"burst\": 15 } }\n\n- config.CostRateLimitConfig {per_minute, burst, disabl\n[…]\nd once in this PR's presubmits, 10/10\ngreen isolated). Deadline now 1s with an honest skip when setup\nprovably never reached the deferred-wake wait.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(config): expose attach.cost_rate_limit to operators (#463 follow…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T10:26:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bda863b2a4f45f05bd760517e1fa2ee93b07fe01",
          "body": "…3) (#472)\n\nAny authenticated caller could drive unbounded model/network work\nthrough the synchronous attach operations (cost-DoS). A token bucket\nkeyed by the middleware-resolved caller identity now bounds them, on\nby default:\n\n- Limited (7 endpoints): the five slash ops (compact, done, btw,\n  suba\n[…]\n-to-end with two\nbearer identities, prune, defaults/disable, 429 header+body parity,\nand unlimited-endpoint behavior under exhaustion.\n\nCloses #463.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(attach): per-caller rate limiting on cost-bearing endpoints (#46…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T09:21:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e2790df50c4f6fd290c7afae2950f7910446401",
          "body": "…(#461) (#471)\n\nWith WithWebSearch enabled, a long server-side search ends the\nmodel's message at stop_reason=pause_turn. The adapter treated that\nas terminal (FinishReasonOther), truncating the turn, and had no\nhandling for server_tool_use / web_search_tool_result blocks.\n\n- GenerateContent now run\n[…]\ne, usage summing (80/19/99),\npartials during continuation, and the runaway bound (pause-forever\nserver → exactly 5 requests, no hang).\n\nCloses #461.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(anthropic): resume pause_turn and handle server-side tool blocks …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T09:13:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a9cc156e15ea4f628c08423d80c80589bf6b2872",
          "body": "Cut via dev/release/cut-dev-tag.sh (includes the daily pricing-regen\ntimestamp churn its preflight requires; rates unchanged). Second dev\ncut of the day: carries the completion of all four cleanup\nmilestones — #372/#385/#390/#393/#394/#396/#397 plus the grpc\nGO-2026-6061 bump. The v2.8.0-dev.2 tag lands on this commit once\nmerged.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "chore(changelog): promote [Unreleased] to [2.8.0-dev.2] (#470)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T01:25:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e229d65c82859a961096688ab6ee40d684b323c1",
          "body": "…#469)\n\nTest-only change (no production code touched); total coverage\n63.1% -> 64.8%.\n\n- internal/attachclient (29% -> 69%): every TUI-facing RPC runs\n  against a REAL attach.Server + SessionRegistry + echo agent wrapped\n  in attachadapter.New — ListSessions, NewSession (inline\n  SessionFactory; no-\n[…]\neams were needed.\n\nThe Agent.Attach* half of the original issue was already covered by\nthe attachadapter tests that shipped with #443.\n\nCloses #396.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "test: cover the attach wire format and remaining 0% surfaces (#396) (…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T01:19:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a135bc2695a529200546e515b5b538ff31f066fc",
          "body": "… (#468)\n\nThree-part CI/test-hygiene fix per the #397 umbrella:\n\n- Real-provider E2E: dev/tools/e2e-real-provider detects provider\n  credentials in the environment and runs live legs — Gemini-via-\n  Vertex (smoke 02) and a NEW Anthropic-via-Vertex leg (smoke 09:\n  single turn + a real bash tool loop\n[…]\n lie). The\n  attach peers test drops its fixed 1500ms/100ms sleeps for\n  deadline-polling. Both rewritten suites pass -race -count=20.\n\nCloses #397.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(ci): real-provider E2E, coverage ratchet, de-flaked tests (#397)…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T01:04:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ec7a49f9983d77ebf8406447be5f91976e0efd88",
          "body": "…390) (#467)\n\nPre-freeze surface cleanup, same spirit as the #388/#386 splits. The\nreal embedding contract — Server/Options/AuthConfig, the registry\ncontract (SessionRegistry/Entry/Registrant/factory/resumer/ACL store),\npeers, the prompt broker, and the capability-provider interfaces +\nwire types — \n[…]\n kept-constructor options, and all Err*\nsentinels stay as documented contracts.\n\nNo wire-format, route-path, auth, or semantic change.\n\nCloses #390.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "refactor(attach)!: shrink the public API to the embedding contract (#…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T00:55:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b8c369ed980c921852c7692d8ace04834b23b6d5",
          "body": "…v1 (#394) (#466)\n\nThe ~300-line picker/spinner in cmd/core-agent-tui was the only user\nof the legacy charmbracelet/bubbletea v1 + lipgloss v1 pair, pulled\nin alongside the charm.land/* v2 tree the rest of the TUI already\nuses via go-steer/core-tui. Ported to v2 mirroring core-tui's idioms:\n\n- tea.K\n[…]\ns first unit tests: navigation clamping,\nselect/cancel, keys-ignored-while-loading, load-error retry, and\nsession-created auto-select.\n\nCloses #394.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "chore(tui): port the session picker to charm.land v2, drop bubbletea …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-28T00:14:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "601267794c98dc3a0a665fba89e19f0fdf4352e8",
          "body": "Fixes 6 of the 8 items from the #385 umbrella (item 4, protocol\nnegotiation, already shipped as #389; per-caller rate limiting split\nout as #463):\n\n- fetch_url: operator-injected headers (url_scope.headers bundles,\n  e.g. X-Api-Key) are stripped on every redirect hop and re-applied\n  only from the b\n[…]\ne test;\n  Close semantics from #424 preserved).\n\nEach behavioral fix carries a regression test verified to fail with\nthe fix reverted.\n\nCloses #385.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(security): attach security roundup — six hardenings (#385) (#465)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T23:55:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4edf0bd98d8ef438a53b7463e7a65e0f4853171b",
          "body": "…) (#464)\n\nThe watcher's successor lives in go-steer/k8s-lookout (dataplane\nintelligence). cmd/k8s-event-watcher/ is deleted and the core-agent\nlibrary's module graph no longer pulls Kubernetes into any consumer's\nbuild:\n\n- Direct deps removed: k8s.io/api, k8s.io/apimachinery,\n  k8s.io/client-go (v0\n[…]\nmd/site docs\n  (getting-started, troubleshooting-agent, otel) point at\n  k8s-lookout. Historical design docs and blog posts untouched.\n\nCloses #393.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "chore!: move k8s-event-watcher to k8s-lookout, drop k8s.io deps (#393…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T23:38:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3724f7ae459c7cb446af39198948bcddb1f41c73",
          "body": "Fixes 8 of the 10 items from the #372 umbrella (item 7 is tracked as\n#263; item 8 grew legs and split out as #461):\n\n- autonomous: resume reports real elapsed Duration on the\n  cancelled-while-waiting path (was time.Since(time.Now()) ~= 0).\n- agent: RunWithContents deletes its per-call throwaway ses\n[…]\n; reachable via the attach serve path\nper govulncheck — verify-vuln fails tree-wide without it).\n\nEvery fix carries a regression test.\n\nCloses #372.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix: correctness roundup — eight low-severity fixes (#372) (#462)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T18:18:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8f142c2ceadab0707c4d5822f48cac6cfe3023c8",
          "body": "Restructures system instruction assembly into a five-layer stack\n(core contract, provider quirks, mode overlays, user memory,\nconsumer/operator append), with proposed const texts, API changes\n(WithMode, WithExtraInstruction, subagent compose-over-replace),\nand resolved design questions.",
          "is_bot": false,
          "headline": "docs: add system prompt layering design (#453)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T17:47:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9026adee6b21b2239dedb00fbf5d83e332fdc0eb",
          "body": "…458)\n\nInit ran Caches.Create on the first turn's request context: if that\nturn completed or was interrupted before the RPC returned, Create\ndied with context.Canceled, the manager flipped to sticky\nstateFailed, and the session silently paid full input price for the\nrest of the daemon's life.\n\n- doI\n[…]\nneExceeded, and the\nsticky-on-real-error counterpart. The fake gains an honorCtx knob to\nmimic a transport that respects cancellation.\n\nCloses #370.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(vertexcache): detach Init/Refresh from request contexts (#370) (#…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T17:07:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b86426e8753f93be9da85dffefc8a7a47968fc13",
          "body": "ADK's streaming aggregator can re-emit the same FunctionCall part\nacross more than one event (an intermediate aggregate plus the final).\nThe display path (runner/events.go) already dedups this;\nobserveToolCallsForWatchdog did not, so every real call counted up to\ntwice and the repeated-tool-call sig\n[…]\nped to one turn and resets on\nthe next Run — cross-turn repetition is exactly the signal the\nwatchdog exists to count, pinned by test.\n\nCloses #363.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): dedup watchdog tool-call observations per turn (#363) (#457)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T16:56:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d49b8d9625970cd18eeaace6b407ea6397b9f221",
          "body": "Cut via dev/release/cut-dev-tag.sh. Includes the pricing-freshness\nregen the script's preflight requires (timestamp-only churn; all\nrates unchanged vs 2026-07-20).\n\nThe v2.8.0-dev.1 tag is pushed onto this commit once it lands on\nmain. First dev cut since v2.7.0 GA; carries the 2026-07 security\nswee\n[…]\n split (#388), the pkg/compose\nextraction (#386), the fetch_url SSRF hardenings (#428, #429), and\nthe Anthropic thinking/tool-id fixes (#357, #367).\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "chore(changelog): promote [Unreleased] to [2.8.0-dev.1] (#456)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T16:35:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "83b3edaed3a4fae1d7cc8da0d914ce346831bc6a",
          "body": "…(#455)\n\nID-less genai parts patched their tool_use/tool_result ID with\n\"call_\"+name, so two parallel calls to the same function in one turn\n(or a replayed Gemini-origin history, which frequently omits IDs)\nproduced duplicate IDs — Anthropic 400s duplicates, and results could\nmispair.\n\nA per-request\n[…]\nories produce byte-identical requests, and counters reset per\nrequest so persisted sessions re-pair deterministically across\nrequests.\n\nCloses #367.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(anthropic): uniquify synthesized tool_use/tool_result IDs (#367) …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T16:24:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "69880acb580b9ce9bcc79e0423aaa89f8a8cbacf",
          "body": "…king models (#357) (#454)\n\nThe adapter converted only Text/ToolUse blocks: finalResponseFromMessage\ndropped thinking + redacted_thinking from responses, and partsToBlocks\nhad no thought case, so the assistant turn replayed before a\ntool_result arrived without its thinking blocks. On thinking-defaul\n[…]\nthinking+tool_use, then tool_result), with fixtures built\nvia json.Unmarshal because the SDK's union accessors re-parse from\nraw JSON.\n\nCloses #357.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(anthropic): round-trip thinking blocks so tool loops work on thin…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T16:11:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fe6b953b8f5b033d8bbc840b4bf1d697c4710b04",
          "body": "…29) (#452)\n\nThe fetch_url transport inherited ProxyFromEnvironment from\nhttp.DefaultTransport, so an ambient HTTP_PROXY/HTTPS_PROXY silently\nrouted fetches through a proxy — and with a proxy in the path, the\nSSRF guard's resolve-validate-pin dial vets the PROXY's address while\nhostname targets are \n[…]\ned/rejected proxy values.\n\nSite config reference updated (also folds the #428 ranges into the\nSSRF-defenses lists, which #451 missed).\n\nCloses #429.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(tools): make fetch_url proxying explicit via url_scope.proxy (#4…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T15:07:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "83ec0713ade7a5c05d72ad280039f336f561414b",
          "body": "…#428) (#451)\n\nAdd the special-purpose IP ranges adjacent to the signed-off #375\npolicy set to the SSRF guard's classification tables:\n\n- Hard-blocked (metadata tier; url_scope.allow_metadata_endpoints is\n  the only opt-out): 192.0.0.0/24 — IETF protocol assignments,\n  including the 192.0.0.192 meta\n[…]\ncast.\n\nTable-test rows cover each new range, the exact-host unlock on the\nprivate tier, and the flag-only unlock on the metadata tier.\n\nCloses #428.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(tools): broaden the fetch_url SSRF denylist beyond the #375 set (…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T14:52:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f8daad5ac9f86524648e0a587aa350753068c9f2",
          "body": "coretui_enabled_run_test.go, coretui_enabled_test.go, and\ncoretui_notifier_test.go reference !no_tui symbols (coreAgentAdapter,\nlaunchTUIv2 wiring) but carried no build constraint, so\n`go vet -tags no_tui ./cmd/...` and the slim build's tests failed\nwith \"undefined: coreAgentAdapter\". coretui_ui_tes\n[…]\ngo already had\nthe tag; these three now match it.\n\nPre-existing (predates the pkg/agent split); surfaced while\nverifying #443 under both tag combos.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "test(cli): add missing no_tui build tags to coretui test files (#450)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T14:40:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3cc70387abb6f277d9fb35a3cd5eafa7ab178623",
          "body": "…6 (#449)\n\nPR 6 (the last) of the pkg/compose extraction\n(docs/compose-extraction-design.md): the config→attach-options\ntranslation moves to the library.\n\n- compose.AttachOptions is the resolved attach-listener configuration;\n  BuildAttachOptions(cfg.Attach) translates the config file's attach\n  blo\n[…]\n construction, grant persistence, attach translation,\n  formatters) and the package-overview row.\n- Design doc marked complete: all six PRs on main.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(compose): add AttachOptions + BuildAttachOptions, completing #38…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T13:52:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "af0b98d0e6e97cf8ccd1a5202fe9c420ebfcb9aa",
          "body": "…) (#448)\n\nPR 5 of the pkg/compose extraction (docs/compose-extraction-design.md):\nthe on-demand multi-session machinery — exactly what any daemon serving\nPOST /sessions needs — moves from cmd/core-agent/multi_session.go into\npkg/compose as library surface:\n\n- BuildMultiSessionAuthn, SessionFactoryD\n[…]\ng/usage, and the compose package doc.\n\nBehavior identical apart from the WakeLoop usage-tap refinement\nalready documented in PR 4's CHANGELOG entry.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(compose): move multi-session construction into pkg/compose (#386…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T13:40:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "463c1a1f1680cc9f20d5d8a3300011ea52432c4e",
          "body": "… (#386) (#447)\n\nPR 4 of the pkg/compose extraction (docs/compose-extraction-design.md):\nthe wake-driven inbox loop every headless surface runs — block on\nWakeRequested, drain the inbox through an empty-prompt turn, account\nusage, repeat until ctx cancels — becomes runner.WakeLoop, resolving\nthe des\n[…]\nrored turn that\nnever completes no longer appends a partial usage row.\n\nTests: ctx-cancel return + Inject-drives-a-turn against the mock echo\nmodel.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(runner): add WakeLoop, consolidating the wake-driven inbox drain…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T13:23:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6300e59164412c0afefaaf67a9e404268a16820b",
          "body": "…rt (#386) (#446)\n\nPR 3 of the pkg/compose extraction (docs/compose-extraction-design.md):\nthe config-backed reference GrantStore lands and the bundled CLI wires\nit at gate construction, closing the split-brain \"allow always\"\ncontract — persistence now works for every prompter (TUI modal, stdin,\nHTT\n[…]\n (simulated restart)\n  allows the same call against a deny-everything prompter.\n\nSite permissions doc updated to describe the gate-owned grant flow.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(compose): wire ConfigGrantStore so \"allow always\" survives resta…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T13:09:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "19fa85ede1e95a80f21d2dd758c6c40df0e54df5",
          "body": "…ters (#386) (#445)\n\nPR 2 of the pkg/compose extraction (docs/compose-extraction-design.md):\nlift the zero-dependency builders, formatters, pricing operations, and\nthe ADK log-noise filter out of cmd/core-agent's package main into a\nnew pkg/compose library package, so cogo/scion/ax stop re-implement\n[…]\ne CLI-precedence glue stay in\nmain per the design doc's seam. The grant/config-persist helpers stay\nin tui_callbacks.go for PR 3 (ConfigGrantStore).\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(compose): add pkg/compose with the substrate builders and format…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T12:53:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c72c6949d447f37018242ad73f77dbf1286778e7",
          "body": "…386) (#444)\n\nPR 1 of the pkg/compose extraction (docs/compose-extraction-design.md):\nmake grant persistence a gate responsibility backed by an injectable\nstore, so the DecisionAllowAlways contract (\"persist a permanent\nallowlist entry\") holds for every consumer, not just the bundled TUI.\n\n- New Gra\n[…]\n-prompt suppression.\n\nThe config-backed reference store (compose.ConfigGrantStore) and the\nmain.go wiring land in PR 3 per the design doc's phasing.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(permissions): add GrantStore so \"allow always\" grants persist (#…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T12:32:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f9d5df303dfa452ccfedc49fa1f411c5ae7fa3e1",
          "body": "…apter (#388) (#443)\n\nPhase 4 (the last) of the pkg/agent decomposition: the 22 Attach*\ncapability methods and the nine WithAttach* provider options move off\n*agent.Agent into a new pkg/attachadapter package. The frozen agent\nsurface sheds 22 methods + 9 options + ~11 fields; hosts that never\nserve \n[…]\nreaking changes and migration are documented in CHANGELOG.md; the\ndesign doc records the as-built phase-4 deviations. This completes\nthe #388 split.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "refactor(agent): move the attach capability surface into pkg/attachad…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T10:00:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "930479ba65a4cb113d17b21121631bcfe14c0e86",
          "body": "… pkg/agent (#388) (#441)\n\nPhases 2-3 of the pkg/agent decomposition, landed together ahead of the v2\nsurface freeze so consumers migrate once. pkg/agent now holds only the core\nAgent plus a narrow SubagentManager seam; the long-running-loop and\nfleet-of-subagents machinery live in two focused sibli\n[…]\neaking changes and before/after migration are documented in CHANGELOG.md;\ndocs/agent-package-split-design.md and the site docs are updated to match.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "refactor(agent): move autonomous driver and background manager out of…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T08:45:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d4d3599dd06b41cd42c16c4730fa79c8f3b4b059",
          "body": "Design-doc-first (Wave 3, human-led) for lifting ~5.5-6k lines of\nsubstrate-grade wiring out of `cmd/core-agent`'s `package main` into a new\n`pkg/compose` library package: on-demand multi-session construction, the\nattach-only wake loop, agentic-tool assembly, the MCP digest LLM fallback,\ncontext-cac\n[…]\n. Phasing stacks PRs 1-4 independently of\n#388 and PRs 5-6 behind the agent split + pkg/attachadapter.\n\nAdds the doc-index bullet to docs/README.md.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "docs: add pkg/compose extraction design (#386) (#442)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-27T08:39:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "852d143f5dafe14feeab70106f7becd239eb3ef2",
          "body": "…440)\n\nPhase 1 of the pkg/agent decomposition (docs/agent-package-split-design.md).\nAdds read-only Inner() and Emit() accessors that the split-out packages\nwill build on instead of reaching unexported fields, and routes the two\nfuture-cross-package call sites (autonomous.go's a.inner, inbox.go's\na.emit) through them. No behavior change; no consumer break.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(agent): add Inner/Emit accessor seam for package split (#388) (#…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T14:43:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0f1e0c744a94335fa790a984e51e42d059d0a361",
          "body": "Design-doc-first deliverable for Wave 3. Decomposes the pkg/agent god\npackage (autonomous driver / background manager / attach adapter) into\na stable core plus focused sibling packages behind a narrow seam, with\na clean-break attach adapter, before the v2 surface freezes. Records\nthe maintainer decisions: #388 before #386, clean-break adapter (no\nshims), export read-only accessors + keep RunOneTurn internal.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "docs(design): add pkg/agent split design doc (#388) (#439)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T14:30:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09839c20a7c308b6321b376a0e7f2651614a3a5a",
          "body": "…callout (#438)\n\nAdd two lead-in subsections to [Unreleased]: an at-a-glance\n'Breaking changes' callout for the attach loopback/auth default\n(#376), and a 'Security posture' summary tying the 2026-07\nAssisted-security sweep (#373-#384, #375) together. The detailed\nper-issue bullets under #### Security are unchanged.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "docs(changelog): summarize Wave 2 security posture + breaking-change …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T12:02:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9bb21571aa78ccd6aa9430ed6d297cc681cd5c61",
          "body": "…#433)\n\nThe peer hub accepted any Endpoint string with no validation or\nownership, and deregister/list were unauthenticated:\n\n- Exfil: a hostile registrant on a tokenless/shared-token hub could\n  publish an attacker endpoint; the TUI enumerated peers and on\n  /switch or /attach connected with the op\n[…]\nlowlist; every other peer endpoint\n  is contacted credential-less. Operator-typed /attach <url> stays\n  credentialed (explicit intent).\n\nCloses #384\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(attach): harden peer registry against exfil + unauth deregister (…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T11:59:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "015bb4cc112ed1a44fbcebfaaec59f568e5f45ae",
          "body": "A malicious page the operator visits could fire a CORS simple request\n(Content-Type: text/plain, JSON-shaped body — no preflight) at\nhttp://localhost:7777/sessions/default/inject; the side effect landed\neven though the response stayed unreadable, and the bootstrap session\nid (default) is well-known.\n[…]\nt type on\nevery write. No extra-allowed-origins knob: the flat Options struct\noffers no natural home for it, per the signed-off policy.\n\nCloses #383\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(attach): block browser CSRF against state-changing endpoints (#431)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T11:54:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "701b58ef909ccb8e5c7e880ebdf0c2eafcfb0709",
          "body": "…opback (#426)\n\nThe documented tokenless default (--attach-listen :7777, no\n--attach-token) bound all interfaces with zero authorization and no\nstartup warning: any LAN peer could read transcripts (/events), drive\nthe agent (/inject, /wake), and answer permission prompts\n(/perms/respond with allow-a\n[…]\n. No insecure-override flag by design.\n\nDocs and CLI help now show the loopback form; site reference pages\ndocument the startup policy.\n\nCloses #376\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(attach): refuse unauthenticated non-loopback binds, default to lo…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T11:48:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "83f16cf559661c7305939bf44c04ab8dd37788d8",
          "body": "…boundary (#436)\n\nThe gate called the built-in bash denylist \"non-overridable\" without\nacknowledging it is best-effort: a small regex set plus a hard-coded\nrm -rf target list, trivially evadable via quoting, $IFS/variable\nindirection, staging (curl … -o /tmp/x; sh /tmp/x), and uncovered\ntargets (rm \n[…]\n classes,\nand recommend allowlist-based execution (the safecmd-guarded prefix\nallow rules) as the hardened posture. No behavior change.\n\nCloses #381\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "docs(permissions): document bash denylist as defense-in-depth, not a …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T11:42:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b02fd2aeed139191a8eade33f6053dd16bc0f80",
          "body": "…e (#435)\n\nTwo related grant-scope bugs:\n\n#379: every MCP tool was gated under the single \"mcp\" namespace, so a\nDecisionAllowSessionTool grant for one benign MCP tool granted\nblanket un-prompted session approval to every MCP tool from every\nserver. The \"skill\" namespace collided the same way. New\nGa\n[…]\nthe mode prompt for in-scope operations, but out-of-scope\npaths still escalate via promptForPath. Non-file tools unchanged.\n\nCloses #379\nCloses #380\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(permissions): key session-tool grants per tool and keep path scop…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T11:36:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "39d72bbacd345d5985e3b0746c766af505006d58",
          "body": "…ecution (#434)\n\nThe .agents/ control plane was writable by the file tools and hook\ncommands ran via /bin/sh -c with no gate, so a model with any write\ncapability could add permissions.allow entries, flip the mode,\nregister a hook that runs arbitrary shell, or add a malicious stdio\nMCP server - a se\n[…]\nails\n  closed and runs nothing.\n\nBasename literals are kept in lockstep with the config/mcp loader\nconstants by tests in both packages.\n\nCloses #378\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(permissions,hooks): elevate control-plane writes and gate hook ex…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T11:30:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae3b141368c969d7e003268c45d978f02c531e08",
          "body": "The gate checked the lexical path while os.ReadFile / atomicWrite /\nos.Remove followed symlinks, so a symlink inside the project root\npointing at /etc, ~/.ssh, or ~/.aws/credentials let the model read\nor overwrite arbitrary targets while the gate saw an in-scope path.\nread_many_files with explicit p\n[…]\n\n- tools.absolutize resolves symlinks so the gate and the file I/O\n  see the same real target across read/write/delete/read_many_files.\n\nCloses #374\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(permissions): resolve symlinks before file-tool scope checks (#437)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T11:24:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2aefd95cf8b3c18f14422c9d6903c523e1e91a09",
          "body": "…s and verb grants (#430)\n\nPrefix-matched (`<verb> *`) bash allowlist rules and verb-scoped\nsession grants could be ridden past the prompt with shell\nmetacharacters: `cat f; rm -rf ~` matched `bash:cat *`, and after a\n`git` session grant `git status; evil` auto-approved. The default\nread_only bundle\n[…]\nrofile.\n- gate.go: verb-scoped session grants only apply when the command\n  passes the safecmd single-simple-command check.\n\nCloses #373\nCloses #382\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(permissions): require safecmd-verified argv for bash prefix allow…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T11:17:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bdd70114a8e7eda400960923321d757d3eb9c37b",
          "body": "fetch_url matched host names against the allowlist but never vetted\nthe addresses they resolve to: a wildcard allowlist entry reached the\ncloud metadata endpoint, and an allowlisted host under attacker DNS\ncontrol could rebind to a link-local IP between the check and the\ndial (TOCTOU).\n\n- Hard-block\n[…]\ntadata IP\nblocked, context cancellation aborting an in-flight fetch, and a\nguard-level table incl. the allow_metadata_endpoints opt-in.\n\nCloses #375\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(tools): add SSRF guard and IP pinning to fetch_url (#427)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T10:32:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "43f105b1b7f77151a75360c27885664303d5b1b8",
          "body": "Captures the 2026-07-26 maintainer sign-off for the Assisted-class\nsecurity issues (#373-#384) so implementation agents and reviewers\nhave the decision record in-tree: argv-aware safecmd matching, symlink\nfail-closed resolution, loopback-default attach with token-gated\nnon-loopback binds, the two-tier control-plane write policy, and the\nyolo-mode semantics after these land.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "docs: record Wave 2 security policy decisions in the cleanup plan (#425)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-26T10:10:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d285888e162745e88743e3918e325e67a46674ef",
          "body": "…#423) (#424)\n\nBroadcaster.Close cancelled the pump goroutine's context and returned\nimmediately, without waiting for it to exit. The pump's Stream.Watch\nloop (and replayThenTail's Since loop) could therefore still be reading\nthe SQLite eventlog when Server.Close -> pool.Close returned, letting\nthe \n[…]\nted when its generator\nfully returns; the test asserts Close does not return until then. It\nfails without the wait and passes with it.\n\nCloses #423.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(attach): make Broadcaster.Close wait for pump/replay goroutines (…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T23:32:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0446201586cca5be031fa7054a50ab44baefa6d1",
          "body": "… (#416)\n\nThe startup summary and task-class message directed operators to\n\"override individual knobs with --model / --compaction-threshold\", but\nneither long flag was registered: --model was a silent no-op (only -m\nexisted) and --compaction-threshold was an unrecognized flag. Register\nboth — --mode\n[…]\ne config file: the\nprofile's tier model now fills in only when both --model is empty and\ncfg.Model.Name is still the substrate default.\n\nCloses #395\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(cli): register --model/--compaction-threshold, fix --ask sentinel…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T22:33:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f74679fbfacdedd9d17b8ede66b8e65879b49fd7",
          "body": "Resolver.seenRefs was mutated in Interpolate and ranged over in\nReportDrift without synchronization. The same resolver's InterpolateFunc\nis captured into sessionFactoryDeps.envInterp and reused by\nreproduceAgent, so concurrent POST /sessions drive concurrent map writes\nfrom multiple goroutines — a g\n[…]\n, errs) are read-only after NewResolver and\nneed no guard. Add a -race regression test exercising concurrent\nInterpolate + ReportDrift.\n\nCloses #371\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agentenv): guard Resolver.seenRefs against concurrent access (#411)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T22:27:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a0b37dad0f8abeb020b1e1d34e1ce43d067d9790",
          "body": "The .agents/config.json writer had three defects that made a\nLoad -> mutate -> Save round-trip lossy and insecure:\n\n- Unknown top-level keys were dropped: Save marshaled only the known\n  struct, so an older binary editing a config a newer binary wrote\n  deleted the newer fields. Save now preserves u\n[…]\nlevant\ntypo (a mistyped deny/allow) surfaces instead of being silently ignored,\nwhile still tolerating unknown keys for forward-compat.\n\nCloses #387\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(config): make persistence safe for its own schema (#406)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T22:20:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "34b3be7d67d087999d20e8cbbe5c4487a9a61b5e",
          "body": "…#413)\n\nThe /events stream advertised ProtocolVersion in the capabilities frame\nbut accepted no version from the client and never rejected a skewed one,\nso a future breaking bump would silently mis-render on old clients\ninstead of failing cleanly.\n\nClients may now declare the version they speak via \n[…]\nore\nany frame flows and a compatible client streams normally. Documents the\nnew header/param/status codes in the attach-http reference.\n\nCloses #389\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "feat(attach): negotiate and enforce SSE protocol version on /events (…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T22:14:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e4604ab78c8e36c70651a395e22d47f891d3c5f",
          "body": "replayThenTail and deliverBootFrames called send/sendTyped without\nholding b.mu. On a full subscriber buffer these paths invoke\ndetachLocked (delete(b.subs) + close(sub.ch)) concurrently with the\npump goroutine's locked iterate-and-send over the same map and channel.\nA single slow SSE consumer durin\n[…]\ngo exercising the concurrent dual-source\nsend; both new tests fail (panic) on the old code and pass under\n'go test -race' with the fix.\n\nCloses #377\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(attach): serialize broadcaster dual-source send under b.mu (#408)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T22:08:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba7f8cc1d2f0207a5614e271040e5718bbbdaff9",
          "body": "…420)\n\nmaybeEnforceCostCeiling ran only in the post-turn cleanup hook, but in\nharness-driven deployments the harness calls tracker.Append for the\nturn's main-model cost after that hook runs. The per-turn delta therefore\nsaw only in-turn internal appends (subtasks, summarizer) and missed the\nmain-mod\n[…]\n to the\ntracker) is measured. A runaway turn trips the cap by the start of the\nfollowing turn, which preflightCostCeiling then refuses.\n\nCloses #362\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): enforce per-turn cost ceiling against the settled turn (#…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T22:01:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0bfaed3bf48f6b07c1ab8e929e58541778e7bc8f",
          "body": "…(#419)\n\n* fix(agent): register subagent cancel before handle is visible\n\nSpawn registered the BackgroundHandle in m.agents (making it addressable\nby Stop) before wiring handle.cancel, which was set only after the slow,\nnetwork-capable tool/scheduler/model resolution. A Stop arriving in that\nwindow \n[…]\n the old\n200K and the new 1M window, so this stays green before and after #410\nlands.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>\n\n---------\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): register subagent cancel before handle is visible (#366) …",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:55:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f9a3454ae5a3d5c654a0799679de159a5f96865f",
          "body": "The autonomous and resume loops emit a final checkpoint on every exit\npath, including context cancellation. emitFinalCheckpoint passed the\nloop's ctx straight to emitCheckpoint, so on the cancellation/shutdown\npath the DB write failed against the already-dead context and the\ncheckpoint was silently \n[…]\n keeping\nvalues for tracing) and bounds the write with finalCheckpointWriteTimeout\nso a wedged session service can't hang process exit.\n\nCloses #365\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): write final checkpoint on a detached context (#418)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:49:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3e10b3bee6b4320d6d1172f227d6605c7088de96",
          "body": "…ws (#417)\n\nderiveSubagentSessionID produced a deterministic <parent>:sub:<branch>\nid computed once at tool construction, so every invocation of a given\nsubagent shared one session row. DefaultInstruction urges parallel\ntool calls, so two concurrent invocations of the same subagent\ninterleaved each \n[…]\n\nname-addressed subtask and background-spawn callers pass an empty\ncomponent to intentionally keep their deterministic, resumable rows.\n\nCloses #364\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): isolate subagent invocations in per-invocation session ro…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:43:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3aafe0c6b32202ee117c4a4b187d7371406c5e20",
          "body": "Run wrapped each turn in a context.WithCancel but only Interrupt ever\ncalled cancel(), so an uninterrupted turn returned without cancelling\nand leaked a live cancellable child of the process-lifetime parent\nevery turn (classic lostcancel; thousands accrue in a long-lived\ndaemon). Cleanup now always \n[…]\nake Interrupt a no-op. Cancel registrations now carry a monotonic\ngeneration token and cleanup only clears when the generation matches.\n\nCloses #359\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): release per-turn context and fix Interrupt no-op (#412)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:38:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92025976c92246b11935ea15b9fd517106ace1e3",
          "body": "…404)\n\nrunSummarizer loaded the full unsliced session history on every call,\nso each successive compaction's LLM input was strictly larger than the\nconversation that triggered it: it re-fed every prior summary plus all\npre-boundary turns. Long sessions eventually exceeded the summarizer's\nown contex\n[…]\nthe backoff.\n- Replace the auto-checkpoint failure path's devNull writer with a real\n  log line so dropped task boundaries are visible.\n\nCloses #356\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): bound summarizer input and surface summarizer failures (#…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:32:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "702b09230ba4f29aa197ef6e9f0282c2490905a9",
          "body": "…e (#403)\n\nAgent.Compact and Agent.Checkpoint append a boundary event directly to\nthe parent session row. They are reachable out-of-band (AttachCompact\nover HTTP, the TUI /compact and /done slashes) with no in-flight-turn\ncheck. Firing one mid-turn races the runner's own AppendEvent against\nits stal\n[…]\nc threshold-driven path\n(runPendingCompaction / runPendingCheckpoint) runs before the turn's\ncancel is registered, so it is unaffected.\n\nCloses #355\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): guard Compact/Checkpoint against a mid-turn boundary writ…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:26:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "abe1b3f0b99704cdcee15042788fc9be54a9c84b",
          "body": "The autonomous driver's runOneTurn accumulated tokens and called\ntracker.AppendUsage on every event carrying UsageMetadata. Gemini\nreports usage cumulatively across streaming chunks within a model\nturn, so this both double-counted tokens (summing running totals) and\ninflated the tracker's turn count\n[…]\n matching the discipline already used in\nsubtask.go. Multiple model turns within one runOneTurn (tool loops)\naccumulate across Commits.\n\nCloses #353\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(agent): route autonomous usage accounting through TurnTap (#402)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:19:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d61e40b2df6a6398b7923286d020bcff16a9a588",
          "body": "…s (#410)\n\n* fix(usage): correct context-window table for current-gen Claude models\n\nContextWindowSizeFor mapped every claude-opus-4*/claude-sonnet-4* to\n200K unless a \"-1m\" suffix was present. Opus 4.6/4.7/4.8 and Sonnet 4.6\n(and Opus 5 / Sonnet 5) now ship a 1M window with no suffix, so on the\ndef\n[…]\nallback test pins claude-opus-4-7, whose\nwindow is now 1M rather than the stale 200K.\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>\n\n---------\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(usage): correct context-window table for current-gen Claude model…",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:13:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "03257781e1018640413f732bc1808188d1cd252a",
          "body": "PriceFor / PriceForWithSource discarded the pricing catalog's found\nflag, so a model with no rate resolved to a zero Pricing that was\nindistinguishable from a genuinely free model. The resulting $0 cost\nflowed silently into usage.Tracker totals and the\ncore_agent.session.cost_usd metric, hiding unkn\n[…]\ny both\nTotals() and TotalsByModel(). The cost metric gains a priced attribute\nso dashboards can tell an exact total from a lower bound.\n\nCloses #368\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(usage): distinguish unpriced turns from free ($0) models (#407)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T21:07:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fa6b8932e18003ccd22f4dce345a177ec6a64bf8",
          "body": "loadEvent re-fetched the whole session and linearly scanned its events\nfor every overlay row, so a Since/Watch over an N-event session issued\nN full-session Gets and scanned O(N) events each time — quadratic\nreplay, and Watch paid a full session load per newly-arrived event.\n\nReplace the per-row loa\n[…]\ned rows don't\nre-Get a missing session per row. Still goes through session.Service\nrather than ADK's schema, preserving the decoupling.\n\nCloses #361\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(eventlog): hydrate replay rows in O(N) instead of O(N^2) (#414)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T20:59:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6e887a12925be5518b4824b1cd65f10840228f07",
          "body": "Open opens two GORM connection pools against the same database — ADK's\ninside adkdatabase.NewSessionService and our overlay's — but Close shut\ndown only the overlay pool. Every Open/Close cycle (tests, multi-daemon\nsession churn) therefore leaked ADK's pool of connections and file\nhandles.\n\nHandle n\n[…]\n to skipping it if the\nservice isn't the expected shape, so an ADK internals change degrades\nto today's behavior rather than panicking.\n\nCloses #360\n\nSigned-off-by: Gari Singh <gari.r.singh@gmail.com>",
          "is_bot": false,
          "headline": "fix(eventlog): close ADK's connection pool in Handle.Close (#409)",
          "author_name": "Gari Singh",
          "author_login": "mastersingh24",
          "committed_at": "2026-07-25T15:46:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 21,
      "commits_last_year": 470,
      "latest_release_at": "2026-07-29T21:21:13Z",
      "latest_release_tag": "v2.8.0-dev.4",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 11,
      "days_since_latest_release": 1,
      "mean_days_between_releases": 1.4
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 62,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/go-steer/core-agent/v2",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/go-steer/core-agent/v2",
          "is_deprecated": false,
          "latest_version": "v2.7.0",
          "repository_url": "https://github.com/go-steer/core-agent",
          "versions_count": 18,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T19:12:38Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 10
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 6,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2026-07-17",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 33
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "example",
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": true,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "docs/site/tsconfig.json"
      ],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 100521,
      "source_files_sampled": 492,
      "oversized_source_files": 2,
      "agent_instruction_files": [
        "AGENTS.md",
        "examples/cloud-run-deploy/.agents/AGENTS.md",
        "examples/gke-deploy/.agents/AGENTS.md",
        "examples/gke-deploy/deploy/base/config/AGENTS.md",
        "examples/gke-parallel-triage/.agents/AGENTS.md",
        "examples/gke-troubleshoot-agent/deploy/base/config/AGENTS.md",
        "examples/multi-session-bearer/.agents/AGENTS.md",
        "examples/plan-first/.agents/AGENTS.md"
      ],
      "agent_instruction_max_bytes": 13592
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "charm.land/bubbletea/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.6"
        },
        {
          "name": "charm.land/lipgloss/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.3"
        },
        {
          "name": "github.com/anthropics/anthropic-sdk-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "github.com/glebarez/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.0"
        },
        {
          "name": "github.com/go-logr/stdr",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2"
        },
        {
          "name": "github.com/go-steer/core-tui",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.16.1"
        },
        {
          "name": "github.com/google/jsonschema-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.2"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/itchyny/gojq",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.12.19"
        },
        {
          "name": "github.com/modelcontextprotocol/go-sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.1"
        },
        {
          "name": "github.com/prometheus/client_golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.23.2"
        },
        {
          "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.67.0"
        },
        {
          "name": "go.opentelemetry.io/contrib/instrumentation/runtime",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.67.0"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/prometheus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.66.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "go.opentelemetry.io/otel/metric",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk/metric",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "golang.org/x/oauth2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.36.0"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.0"
        },
        {
          "name": "golang.org/x/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.43.0"
        },
        {
          "name": "google.golang.org/adk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "google.golang.org/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.283.0"
        },
        {
          "name": "google.golang.org/genai",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.55.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "gorm.io/gorm",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.31.1"
        },
        {
          "name": "mvdan.cc/sh/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.13.1"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 8,
        "merged_prs": 359,
        "open_issues": 25,
        "closed_ratio": 0.851,
        "closed_issues": 143,
        "closed_unmerged_prs": 15
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "mastersingh24",
          "commits": 469,
          "avatar_url": "https://avatars.githubusercontent.com/u/5595790?v=4"
        },
        {
          "type": "User",
          "login": "ptone",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/40845?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.998
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci-docs.yml",
        "ci.yml",
        "docs-lint.yml",
        "docs.yml",
        "e2e-real-provider.yml",
        "e2e-recipe-gke-troubleshoot.yml",
        "pricing-regen.yml",
        "release-images.yml",
        "release.yml",
        "version-fallback.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 6,
            "reason": "project has 2 contributing companies or organizations -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 8,
            "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "16 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "2ba938a2dfdd59c8dae9222101b20739dbb6ce1b",
        "ran_at": "2026-07-31T09:35:04Z",
        "aggregate_score": 3.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-30T23:54:56Z",
      "oldest_open_prs": [
        {
          "number": 201,
          "created_at": "2026-07-10T21:47:41Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 203,
          "created_at": "2026-07-10T22:03:33Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 204,
          "created_at": "2026-07-11T10:38:15Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 542,
          "created_at": "2026-07-30T22:20:43Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 545,
          "created_at": "2026-07-30T22:37:28Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 546,
          "created_at": "2026-07-30T22:52:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 547,
          "created_at": "2026-07-30T22:58:12Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 549,
          "created_at": "2026-07-30T23:12:51Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-30T23:54:42Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 142,
          "created_at": "2026-06-09T14:25:54Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 158,
          "created_at": "2026-06-10T21:15:17Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 159,
          "created_at": "2026-06-10T21:15:21Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 160,
          "created_at": "2026-06-10T21:15:22Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 200,
          "created_at": "2026-07-10T21:44:24Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 202,
          "created_at": "2026-07-10T22:00:44Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 208,
          "created_at": "2026-07-12T11:30:49Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 215,
          "created_at": "2026-07-13T13:08:37Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 230,
          "created_at": "2026-07-13T18:40:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 263,
          "created_at": "2026-07-15T18:55:56Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 330,
          "created_at": "2026-07-20T11:24:02Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 331,
          "created_at": "2026-07-20T11:24:21Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 346,
          "created_at": "2026-07-21T08:43:07Z",
          "last_comment_at": "2026-07-21T09:10:00Z",
          "last_comment_author": "mastersingh24"
        },
        {
          "number": 348,
          "created_at": "2026-07-21T12:33:53Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 476,
          "created_at": "2026-07-28T19:29:15Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 521,
          "created_at": "2026-07-29T18:09:16Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 530,
          "created_at": "2026-07-30T18:52:13Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 531,
          "created_at": "2026-07-30T18:52:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 532,
          "created_at": "2026-07-30T18:52:30Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 533,
          "created_at": "2026-07-30T18:52:53Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/go-steer/core-agent",
    "host": "github.com",
    "name": "core-agent",
    "owner": "go-steer"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 61,
      "inputs": {
        "security": 36,
        "vitality": 76,
        "community": 46,
        "governance": 54,
        "engineering": 86
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 76,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "commits_last_year": 470,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 11
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "11/52 weeks with commits",
                "points": 7.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 11
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "470 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 470
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "releases_count": 21,
              "latest_release_tag": "v2.8.0-dev.4",
              "releases_from_tags": false,
              "days_since_latest_release": 1,
              "mean_days_between_releases": 1.4
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "21 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 21
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~1.4 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 1.4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 46,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 11,
            "inputs": {
              "forks": 1,
              "stars": 6,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "6 stars",
                "points": 11.3,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 54,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 18,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.998
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "merged_prs": 359,
              "open_issues": 25,
              "closed_issues": 143,
              "issue_closed_ratio": 0.851,
              "closed_unmerged_prs": 15
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "85% of issues closed",
                "points": 39.8,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 85
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "359/374 decided PRs merged",
                "points": 36.7,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 359,
                      "decided": 374
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "followers": 2,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "go-steer",
              "public_repos": 7,
              "account_age_days": 103
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "2 followers of go-steer",
                "points": 3.4,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 2,
                      "login": "go-steer"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "7 public repos, account ~0 yr old",
                "points": 7.1,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 7
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/go-steer/core-agent/v2"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 10
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 10 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 10
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "18 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 18
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 86,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "10 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [
                "adk",
                "agent",
                "anthropic",
                "claude",
                "gemini",
                "golang",
                "llm",
                "mcp",
                "vertex-ai"
              ],
              "has_wiki": false,
              "homepage": "https://go-steer.github.io/core-agent/",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://go-steer.github.io/core-agent/",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "9 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 36,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 36,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 3.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "16 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 6
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 76,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "AGENTS.md",
                "examples/cloud-run-deploy/.agents/AGENTS.md",
                "examples/gke-deploy/.agents/AGENTS.md",
                "examples/gke-deploy/deploy/base/config/AGENTS.md",
                "examples/gke-parallel-triage/.agents/AGENTS.md",
                "examples/gke-troubleshoot-agent/deploy/base/config/AGENTS.md",
                "examples/multi-session-bearer/.agents/AGENTS.md",
                "examples/plan-first/.agents/AGENTS.md"
              ],
              "agent_instruction_max_bytes": 13592
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, examples/cloud-run-deploy/.agents/AGENTS.md, examples/gke-deploy/.agents/AGENTS.md, examples/gke-deploy/deploy/base/config/AGENTS.md, examples/gke-parallel-triage/.agents/AGENTS.md, examples/gke-troubleshoot-agent/deploy/base/config/AGENTS.md, examples/multi-session-bearer/.agents/AGENTS.md, examples/plan-first/.agents/AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, examples/cloud-run-deploy/.agents/AGENTS.md, examples/gke-deploy/.agents/AGENTS.md, examples/gke-deploy/deploy/base/config/AGENTS.md, examples/gke-parallel-triage/.agents/AGENTS.md, examples/gke-troubleshoot-agent/deploy/base/config/AGENTS.md, examples/multi-session-bearer/.agents/AGENTS.md, examples/plan-first/.agents/AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 67,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "docs/site/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "docs/site/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "docs/site/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 100521,
              "source_files_sampled": 492,
              "oversized_source_files": 2
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "2/492 source files over 60KB",
                "points": 54.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 492,
                      "oversized": 2
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "moderate",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "example_dirs": [
                "example",
                "examples"
              ],
              "has_mcp_signal": true,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example, examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example, examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-31T09:35:23.554648Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/g/go-steer/core-agent.svg",
  "full_name": "go-steer/core-agent",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}