hanzoai / vfs

来自 GitHub 依赖图的完整解析依赖集合：7 个直接依赖与 28 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 35 个包，其中也包含从不交付的开发与测试版本固定：4 个存在已知公告，0 个为直接依赖。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 310,
      "has_wiki": true,
      "homepage": "https://hanzo.ai",
      "languages": {
        "Go": 194534,
        "ZAP": 2376,
        "Makefile": 1254,
        "Dockerfile": 680
      },
      "pushed_at": "2026-07-29T00:14:29Z",
      "created_at": "2026-05-08T17:52:45Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-28T04:03:46Z",
      "description": "S3-backed virtual block filesystem with PQ encryption — unlimited write storage for stateful services",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": null,
      "default_branch": "main",
      "license_spdx_raw": "NOASSERTION",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://hanzo.ai",
      "name": "Hanzo AI",
      "type": "Organization",
      "login": "hanzoai",
      "company": null,
      "location": "United States of America",
      "followers": 37,
      "avatar_url": "https://avatars.githubusercontent.com/u/16248274?v=4",
      "created_at": "2015-12-11T00:38:19Z",
      "is_verified": null,
      "public_repos": 159,
      "account_age_days": 3882
    },
    "license": {
      "state": "custom",
      "spdx_id": null,
      "raw_spdx": "NOASSERTION",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-05-19T07:20:11Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "acdc44fb76beb25ecb5daeaf03d205a774d097b7",
          "body": "make check runs gofmt -s -w . in place, and the tree was not gofmt-clean, so\nevery invocation left 7 modified files behind and a reader could not tell their\nown edits from the formatter's. Purely mechanical: trailing-comment alignment\nand import ordering, no semantic change (git diff -w reduces this to three\nimport lines that only moved position).\n\nCo-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "style: gofmt -s the tree so make check is idempotent",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-28T04:03:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "936e5e53f95e376ab91bff085a26900486f2128c",
          "body": "…ires\n\ngo.mod declares `go 1.26.5` while the builder pinned golang:1.26.4. The golang\nimages set GOTOOLCHAIN=local, so the base can never fetch a newer toolchain to\nsatisfy the directive and the build dies immediately:\n\n    go: go.mod requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local)\n\nA r\n[…]\nine and golang:1.26.5-alpine are\nthe same sha256:0178a641).\n\nPatch bump only, image variant preserved, and the target tag verified to exist\nbefore the change.\n\nCo-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requ…",
          "author_name": "z",
          "author_login": null,
          "committed_at": "2026-07-28T02:12:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4d47db27177cf8c9359021672f1b5a62ed83ece6",
          "body": "Co-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "chore(go): bump go directive to 1.26.5",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-27T23:09:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c22092c9d78494050e339e99ce12a0dc5ccbfe2",
          "body": "vfs was the last service reaching S3 through github.com/aws/aws-sdk-go-v2 while\nthe rest of the fleet (vm, commerce, licensing, ai) already used the Hanzo\nStorage Go SDK. Both speak S3, so either works against our own storage — but a\nsecond client meant a second credential model, a second retry poli\n[…]\nis lazy, so a missing key surfaces on\nthe first read rather than on the call — backend.ErrNotFound is mapped in both\nplaces so callers still see one sentinel.\n\nCo-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "s3: run on Hanzo Storage through hanzos3/go, not the AWS SDK",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-27T19:20:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1d67f85c04a3ad5d5aa32046004ca54cf166ab32",
          "body": "Superseded: the Hanzo GitHub App pushes a webhook, so the forge tracks GitHub\nwithout a per-repo workflow. This file called git.hanzo.ai/api/v1/.../mirror-sync\n— a Gitea API for a system we no longer drive — and would sit inert in every repo.\n\nOne mechanism, in one place, instead of ~350 copies of a cron.",
          "is_bot": false,
          "headline": "ci: drop the Gitea mirror-sync nudge",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-27T17:46:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb326b07e6a97ad99c9123feee99b086f5676447",
          "body": "git.hanzo.ai mirrors this repo by PULL on a ~10-minute interval, and arcd runs\nCI/CD there — so every push waited out that interval before anything built.\nThis asks Gitea to pull HEAD immediately.\n\nLatency only: the repo already mirrors via the App webhook, so a missing\nHANZO_GIT_TOKEN or a failed curl is non-fatal and never fails the push.\nIdempotent (mirror-sync just pulls HEAD) and concurrency-coalesced.",
          "is_bot": false,
          "headline": "ci: nudge git.hanzo.ai to pull on push",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-27T15:47:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "af3fac61a492207d95e7a292b8fec7a3b3e10c7b",
          "body": "This workflow ran on a self-hosted actions-runner-controller pool. ARC is\ndecommissioned: CI executes inside git.hanzo.ai (Gitea Actions, .hanzo/workflows)\nand delivery is cd.hanzo.ai reconciling the reviewed image pin in\nhanzoai/universe. GitHub is a mirror and runs nothing.\n\nRemoved rather than repointed — there is no GitHub-side pool to move to, and\nleaving it would keep ARC load-bearing.",
          "is_bot": false,
          "headline": "ci: remove GitHub CI — native git.hanzo.ai + cd.hanzo.ai only",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-27T15:24:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "55c1afff2c46e2d2015fe2b9d0a9c7f3ba770f7d",
          "body": "Panic-driven denial of service in the AWS SDK for Go v2 EventStream decoder:\n\n    aws/protocol/eventstream  v1.7.5  -> v1.7.8   (patched in 1.7.8)\n    service/s3                v1.96.2 -> v1.97.3  (patched in 1.97.3)\n\nThis repo is an S3-backed block filesystem, so the S3 client is on the hot\npath ra\n[…]\nt latest, so the change carries the fix and\nnothing else; go get pulled the usual transitive companions along at\npatch level within v1.x.\n\nVerified: go build ./... exit 0, go test ./... 4 ok / 0 fail.",
          "is_bot": false,
          "headline": "fix(deps): patch the AWS SDK EventStream DoS",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-07-26T10:51:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "97596b837a4954d8632305d8d701ced9d1f357b4",
          "body": "Restore time is dominated by GetBlock (backend.Get -> blake3 verify -> age\ndecrypt -> cache), which zapdb's ChunkReader drives strictly sequentially.\nMeasures that path against a bounded parallel prefetch so the core-scaling\nheadroom is measured rather than assumed.\n\nWarm-up deliberately leaves files in the OS page cache: the cost under test\nis CPU-bound crypto+verify, not disk seek.",
          "is_bot": false,
          "headline": "test(vfs): benchmark the restore inner loop",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-07-26T08:46:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5754209c584dcb8e13f3ccbbc4031c759464a94",
          "body": null,
          "is_bot": false,
          "headline": "merge(fenced-store): consolidate onto main",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-22T00:19:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae359909c3e4409e26811226f68a2ce465078fea",
          "body": "…ut of the graph\n\nThe v0.3.x internal-engine sqlite drops the modernc.org dependency; with\nv0.6.5's replica routing this leaves zero modernc modules in the graph.\nComments updated to match.",
          "is_bot": false,
          "headline": "build(sqlite): bump hanzoai/sqlite v0.2.4 -> v0.3.2 — modernc fully o…",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-07-20T03:21:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "467c279522ba8ba17a1c199b21fea496d67e8c0f",
          "body": "… import (#7)\n\n* fix(sqlite): use hanzoai/sqlite (the one driver), drop direct modernc import\n\n* fix(sqlite): use hanzoai/sqlite (the one driver), drop direct modernc import\n\n---------\n\nCo-authored-by: Hanzo AI <ai@hanzo.ai>",
          "is_bot": false,
          "headline": "fix(sqlite): use hanzoai/sqlite (the one driver), drop direct modernc…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-10T09:22:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15b713992050a13dd68b85ed209195939d707496",
          "body": "…-write (#6)\n\n* replica: extract single-writer election to hanzoai/ha\n\nElection (Owner/IsOwner/Replicas/Member) was storage-agnostic pure Go with\nzero vfs-internal callers — it lived here only historically. It is now its\nown coordination primitive at github.com/hanzoai/ha so any singleton (cron,\nque\n[…]\nth\nthe S3-client owner. Tests: deposed-fenced, same-round re-ship, handoff\nlock-out, carry-forward-no-loss, and concurrent race proofs (20x race-stable).\n\n---------\n\nCo-authored-by: hanzo <z@hanzo.ai>",
          "is_bot": false,
          "headline": "replica: round-fenced writes (FencedStore) — close split-brain double…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-09T20:07:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e43cc3348aad320808398efa1ea1f5ae9a11ee32",
          "body": "…-write (v0.6.3)\n\nElection (hanzoai/ha) is coordination-free, so two replicas with divergent\nmembership views can each elect themselves the single writer for one org, and\nthe object store's unconditional Put ('overwriting is allowed') lets both\nclobber the mirror. FencedStore closes this at the stor\n[…]\ntionalStore seam; concrete minio store lives with\nthe S3-client owner. Tests: deposed-fenced, same-round re-ship, handoff\nlock-out, carry-forward-no-loss, and concurrent race proofs (20x race-stable).",
          "is_bot": false,
          "headline": "replica: round-fenced writes (FencedStore) — close split-brain double…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-09T17:08:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6cfcc195067f012a5ffb5f691203bd3c1ba88b83",
          "body": "* replica: extract single-writer election to hanzoai/ha\n\nElection (Owner/IsOwner/Replicas/Member) was storage-agnostic pure Go with\nzero vfs-internal callers — it lived here only historically. It is now its\nown coordination primitive at github.com/hanzoai/ha so any singleton (cron,\nqueue drain, bill\n[…]\nge for the concurrent replicator/ship loops).\nUnrelated to the ha extraction but folded in so this PR lands green rather\nthan override a known-bad check.\n\n---------\n\nCo-authored-by: hanzo <z@hanzo.ai>",
          "is_bot": false,
          "headline": "replica: extract single-writer election to hanzoai/ha (#5)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-09T06:23:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "06708b3f142237be5ab28ce3d00c5c12fd3514a5",
          "body": "go test -race requires cgo, but the self-hosted hanzo-build-linux-amd64\nrunner has no C compiler and defaulted CGO_ENABLED=0 (vfs is CGO-free in\nproduction), so both race steps failed — first with 'go: -race requires\ncgo', then 'C compiler gcc not found'. Every main run has been red on this\nfor many\n[…]\now the race detector\nactually runs (real coverage for the concurrent replicator/ship loops).\nUnrelated to the ha extraction but folded in so this PR lands green rather\nthan override a known-bad check.",
          "is_bot": false,
          "headline": "ci: enable cgo for the -race steps (pre-existing red)",
          "author_name": "hanzo",
          "author_login": null,
          "committed_at": "2026-07-09T06:22:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "576dc6217efb788924a3f52fd3ba1a9a296a6734",
          "body": "Election (Owner/IsOwner/Replicas/Member) was storage-agnostic pure Go with\nzero vfs-internal callers — it lived here only historically. It is now its\nown coordination primitive at github.com/hanzoai/ha so any singleton (cron,\nqueue drain, billing sweep) gets exactly-once WITHOUT importing a SQLite\nl\n[…]\ncloud/internal/org) migrate to hanzoai/ha in lockstep;\nthey pin vfs v0.6.2 so this main-only removal does not disturb them until\nthey bump. Removes owner.go + its two election tests; doc points at ha.",
          "is_bot": false,
          "headline": "replica: extract single-writer election to hanzoai/ha",
          "author_name": "hanzo",
          "author_login": null,
          "committed_at": "2026-07-09T05:55:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1dcfeb37694f0190d618b223bf2cd005e7bfd1e6",
          "body": "… + HRW election",
          "is_bot": false,
          "headline": "test(replica): benchmarks for snapshot/backup + push-pull replication…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T17:39:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8f6422b4e4eae4a41d327b006e3b80fac43b72e8",
          "body": "…ses (cloud dedup)",
          "is_bot": false,
          "headline": "feat(replica): export Version — the ONE content-hash any Store impl u…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T07:40:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a2d3a87d046053a30cef56dd7b0960f3e8cdbd84",
          "body": "…imitive for any SQLite user\n\nxorm/GORM services can't share a handle with SQLiteDB (Restore swaps the file). Expose\nSnapshotFile(path) (transient read handle, VACUUM INTO) + RestoreFile(path,data) (atomic\nswap) so a service using its OWN engine adopts HA: RestoreFile before opening, SnapshotFile\nin the push loop. SQLiteDB now wraps these (one and one way). Tests still green.",
          "is_bot": false,
          "headline": "feat(replica): handle-less SnapshotFile/RestoreFile — the adoption pr…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T05:18:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b3830f4a22409bd7c894df190edf90e02bc66f2",
          "body": "Completes the shared HA-SQLite lib: NewBackendStore(be) adapts any vfs backend.Backend\n(file locally, s3/SeaweedFS in prod) to the Replicator Store, with a cheap content-version\nsidecar (<key>.ver) so a reader answers Version() without fetching the whole DB. So a\nservice wires HA in one line: NewReplicator(key, NewBackendStore(be), OpenSQLite(path)).\nTest: full owner->vfs-backend->reader path over the real file backend (SQLite rows\nsurvive push/pull, incl. updates + the version-skip).",
          "is_bot": false,
          "headline": "feat(replica): BackendStore adapter — the ready Store over vfs backend",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T05:13:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bcc689fe130aefa96f5180c50d5bbab17bfaa54e",
          "body": "…P-0107)\n\nThe ONE importable durability library — promoted from cloud/internal/org (proven,\nbut internal + unimportable + only a memDB test) into hanzoai/vfs so EVERY service\nadopts the same code, never re-invents HA:\n- Replicator: per-org SQLite <-> vfs object store, whole-object WAL-checkpointed\n \n[…]\nder Push/Pull cycle + redundant-pull skip, HRW\ndeterminism/exclusivity/spread. Adoption contract (hydrate-on-open, single-writer\ngate, post-commit ship) documented for visor/iam/commerce/base rollout.",
          "is_bot": false,
          "headline": "feat(replica): shared HA-SQLite substrate for every Hanzo service (HI…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T04:53:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4a82f281c3bc215dddb16158c4c04587c4f595a4",
          "body": "…@v1.6.0) + build green\n\nCo-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "fix(deps): repair vanished pins / go.sum drift ( core-bump@latest age…",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-30T21:35:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "14dae3ea1b1f05fba853633e63e05b47efb67630",
          "body": null,
          "is_bot": false,
          "headline": "docs(brand): add hero banner",
          "author_name": "z",
          "author_login": "zeekay",
          "committed_at": "2026-06-29T03:15:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "df7c60896bba96b7df4a6b189a87162376ebe2de",
          "body": null,
          "is_bot": false,
          "headline": "chore(brand): dynamic hero banner",
          "author_name": "z",
          "author_login": "zeekay",
          "committed_at": "2026-06-29T03:15:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9fd4b95bd0002cd7b31b15afd0d6a6e4c9490ca",
          "body": "… GitHub-hosted (#4)\n\nCo-authored-by: zeekay <z@hanzo.ai>",
          "is_bot": false,
          "headline": "ci: run on self-hosted ARC pool (hanzo-build-linux-amd64/deploy), not…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-06-20T03:39:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee33a6b1da1f1fe8b5e625f76b4da1cf8333c1d5",
          "body": "…ance.go\n\nThese instance-lifecycle accessors lived in the cloud-coupled mount.go (removed\nin v0.4.2). They are vfs-library surface, not a cloud concern — relocated here so\nthe standalone daemon, tests, and embedders keep the API while vfs stays\ncloud-free. Fixes the v0.4.2 API regression.",
          "is_bot": false,
          "headline": "vfs: restore Version/Instance/SetInstance/Shutdown in cloud-free inst…",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-12T03:03:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea13fb13be8a7bb23daf9c964a766f7b9f9550ab",
          "body": "… to cloud/{mounts,cmd}/vfs\n\nvfs is OSS and stands alone as a pure block-filesystem library; the private\ncloud aggregator imports vfs, never the reverse. mount.go (build-tagged but\nstill forcing the module require), its test, and cmd/vfsd relocated to cloud.\nGOWORK=off go build/test ./... green; hanzoai/cloud no longer in the graph.",
          "is_bot": false,
          "headline": "vfs: decouple from hanzoai/cloud — HIP-0106 mount adapter + vfsd move…",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-12T02:52:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9ea0d5b088b70b281738ba7791df9a7c1fbc3c2",
          "body": null,
          "is_bot": false,
          "headline": "docs: drop onyxd from the VFS consumer example list",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-11T04:52:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f33e8dbcc404bbdee66a3c7d3b472bf0eed9fd30",
          "body": "- Replace /USDL coin fixtures in sqlite_test.go and\n  pkg/mount/fuse_sqlite_test.go with USDC/USDT/BTC/ETH (generic\n  finance instruments)\n  path in LLM.md K8s sidecar pattern with generic 'tenant-bd' /\n  's3://tenant-vfs/'\n\nTests pass.",
          "is_bot": false,
          "headline": "chore: scrub  /  references from VFS test fixtures and docs",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-10T19:15:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a53837c0b88adc5f3667b0b61dbace6cddf67d45",
          "body": "Workspace-wide sync. luxfi/node already shipped on 1.26.4 in v1.30.6\n(commit 121aca1fa9); this is the cross-repo catch-up.",
          "is_bot": false,
          "headline": "deps: bump Go to 1.26.4 across go.mod, Dockerfiles, GH Actions",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-07T19:13:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d0c43d3fba2d1d4525ad85a100390f99d30557d4",
          "body": "* vfs: gate Mount() + cmd/vfsd behind cloud_mount build tag\n\nThe Mount(), SetInstance(), Shutdown() HTTP-server surface drags in\nhanzoai/cloud + hanzoai/zip. Downstream services that consume the\ncore block + FS API (vfs.VFS, vfs.FS, vfs.File, NewCrypto) directly\n—  ATS shard layer, KMS, BD — don't n\n[…]\n.\n\n* chore: bump go to 1.26.4\n\nPicks up upstream security fixes for crypto/x509, mime, net/textproto,\ncrypto/fips140. No dependency bumps — only the toolchain directive.\n\ngo test -race ./... is green.",
          "is_bot": false,
          "headline": "vfs: gate Mount() behind cloud_mount build tag + Go 1.26.4 (#3)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-06-07T14:51:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "015b2657d2d1334789f3c98c864d54cb7011d1c2",
          "body": "…lit)\n\nThree new primitives, all brand-neutral:\n\n  BlockTimeWorkload(blockTime, avgBlockBytes, monthsRetention,\n                    readAmp, objectBytes) -> Workload\n      Generic chain-style workload constructor parameterised by\n      block time so a single sweep covers 1ms..1s with one call.\n\n  Ti\n[…]\ns\n  TestTiered_24h_Hot_R2_Cold             — tiering math sanity\n  TestCluster_DedupKeepsWriterCostFlat   — 1w vs 11w cost identical\n  TestCluster_ReadersScaleGetCost        — 1, 11, 100, 1000 readers",
          "is_bot": false,
          "headline": "cost: add Tiered (hot SSD + cold archive) + Cluster (writer/reader sp…",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-03T16:28:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ce9ea9a54a8baf269d3d8856d957930035ed4eec",
          "body": "Adds pkg/cost with a brand-neutral pricing model:\n\n  Workload { StorageGB, PutsPerMonth, GetsPerMonth, EgressGBPerMonth }\n  Catalog: aws-s3-{standard,ia,glacier-instant}, cloudflare-r2,\n           do-spaces, gcs-{standard,coldline}, k8s-pvc-block\n  EstimateFor, CompareBackends, Report, FromBenchmark\n[…]\npackage contains no application-specific defaults. Validator\narchive shapes, sqlite snapshot pipelines, indexer workloads etc.\ncompose Workload themselves in their own repos; cost stays the\nprimitive.",
          "is_bot": false,
          "headline": "cost: workload-neutral pricing primitive + vfs-cost CLI",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-03T06:06:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92d6b92e3d7b8550e554233226400098fbc0f88a",
          "body": "Adds five Go tests covering the four code-level concerns that gate\nusing VFS as the durable store for stateful services like luxd /\nzapdb:\n\n  TestCrashRecovery_Synced_Persists                   (#1)\n  TestCrashRecovery_UnsyncedWriteIsLost_NotCorrupted  (#1)\n  TestCompaction_SustainedWrite           \n[…]\ny — bootstrap timing needs\na real cluster + S3 backend to measure honestly, not a Go test.\n#7 ditto — the procedure is straightforward (vfsd export → tar →\nPVC → restore) but execution is operational.",
          "is_bot": false,
          "headline": "test+docs: production-readiness for VFS-backed stateful workloads",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-03T05:05:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e581710f57eb8716a32517c226474be456974298",
          "body": "Switch from gcr.io/distroless/static:nonroot to FROM scratch. The\nstatic Go binary gets CA certs, tzdata, /etc/passwd and /etc/group\n(nonroot uid/gid 65532) copied from the build stage.",
          "is_bot": false,
          "headline": "dockerfile: scratch runtime, drop gcr.io",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-02T10:40:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ab0d042fe2c9c1d8325075ca132f5258262366b8",
          "body": null,
          "is_bot": false,
          "headline": "merge: feat/no-local-replace",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-01T23:27:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b804b0c7e572da235ad1537e9bedfc1baae61396",
          "body": null,
          "is_bot": false,
          "headline": "merge: feat/cloud-mount",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-01T23:27:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9b2aa530e029f1905ab816b50c642e494f737d9",
          "body": "The `=> ../cloud` and `=> ../zip` replace directives were a parallel-dev\nhack. Cloud is now published at v0.1.0 (HIP-0106 unified binary) and\nzip at v0.2.0 (circuit-breaker primitive + multi-App isolation).\nResolve from GOPROXY — no local-dir pins remain.",
          "is_bot": false,
          "headline": "deps: drop local replace, pin cloud v0.1.0 + zip v0.2.0",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-19T19:17:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b0d1536f2109fb59e55349e163ad2d3ef46f5f90",
          "body": "* docs: canonical README opening per Hanzo OSS taxonomy\n\n* docs: add canonical SECURITY.md",
          "is_bot": false,
          "headline": "docs: canonical README opening + SECURITY.md (#2)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-19T06:53:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c3cfe975127fc5e67712832647d4229943743fb",
          "body": "* feat: cloud Mount() per HIP-0106\n\nAdds pkg/vfs.Mount(*zip.App, cloud.Deps) error so the unified Hanzo\nCloud binary can blank-import and register VFS alongside every\nother Hanzo subsystem.\n\nVFS has no public HTTP surface today — it's an S3-backed virtual\nblock filesystem driven through FUSE/CLI/sid\n[…]\n/pkg/vfs/ nesting). Standalone shim moved\nto cmd/vfs/ where applicable.\n\nPer Hanzo Go-stdlib pattern: repo IS the package.\n\n* refactor: flatten import path — github.com/hanzoai/cloud (drop /pkg/cloud)",
          "is_bot": false,
          "headline": "feat: cloud Mount() per HIP-0106 (#1)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-19T06:37:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a183d986687c7f4c0374c1f2a3e0828e19ab153f",
          "body": "…loud)",
          "is_bot": false,
          "headline": "refactor: flatten import path — github.com/hanzoai/cloud (drop /pkg/c…",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-19T06:05:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f54c815cb891f87f3461a402c73a2004155913eb",
          "body": "Subsystem code lives in package vfs at repo root. Importers now use\n`github.com/hanzoai/vfs` (no /pkg/vfs/ nesting). Standalone shim moved\nto cmd/vfs/ where applicable.\n\nPer Hanzo Go-stdlib pattern: repo IS the package.",
          "is_bot": false,
          "headline": "refactor: collapse pkg/vfs/ → root for clean import path",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-19T05:32:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "23a68a0710cf58989764b198ce5ad9dc6004d4d9",
          "body": "Adds pkg/vfs.Mount(*zip.App, cloud.Deps) error so the unified Hanzo\nCloud binary can blank-import and register VFS alongside every\nother Hanzo subsystem.\n\nVFS has no public HTTP surface today — it's an S3-backed virtual\nblock filesystem driven through FUSE/CLI/sidecar. Mount() exposes\nliveness/readi\n[…]\n + Block ZAP interface; full multi-block\nFile surface lands in follow-up PRs.\n\nTests:\n- pkg/vfs: TestMount_HealthReadyz + TestMount_PutGetRoundtrip green\n- existing TestRoundTrip + TestStats unchanged",
          "is_bot": false,
          "headline": "feat: cloud Mount() per HIP-0106",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-19T04:55:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b34500a498b0afdfcf2ab13925bb4133009dc79",
          "body": null,
          "is_bot": false,
          "headline": "go.mod: bump go directive to 1.26.3 (security advisory)",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-13T04:27:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c9e57245fa857c48542a739f42fde2dcd38528b6",
          "body": "…macOS\n\nbazil.org/fuse dropped macOS support (commit 65cc252+). 0.3.0\nshipped Linux-only. This drop adds a parallel pkg/mount/fuse_darwin.go\nusing github.com/jacobsa/fuse, which still supports both macFUSE\n(kext) and fuse-t (userspace, no kext, SIP-friendly).\n\nSame Mount(*vfs.FS, mountpoint) signatu\n[…]\n → 100 rows survived umount+remount, integrity_check=ok\n\nReal FUSE mount, real SQLite opening test.db directly on the\nmountpoint, 100 INSERTs, unmount, remount, PRAGMA integrity_check.\nZero copy step.",
          "is_bot": false,
          "headline": "0.3.1: macOS FUSE via github.com/jacobsa/fuse — SQLite e2e passes on …",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T19:37:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb226d728150dab98d3e660e8443726b7408acd4",
          "body": null,
          "is_bot": false,
          "headline": "ci: bump Go to 1.25 (modernc/sqlite + bazil/fuse require it)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T18:46:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63345001917e6c6d18f5fc6348449a28eabf564c",
          "body": "The mount layer is no longer a stub. With `-tags fuse` on Linux,\nSQLite (and any POSIX consumer) opens files directly on the\nmountpoint — no intermediate copy. Default builds stay\ndependency-light: bazil.org/fuse + bazil.org/fuse/fs are gated\nbehind the build tag.\n\nWhat's new\n----------\n- pkg/mount/\n[…]\nevs use the in-process API + the SQLite\n  byte-roundtrip test in pkg/vfs/sqlite_test.go (already shipped).\n- Local NVMe disk cache (write-back tier) lands in 0.4.0; today the\n  cache is in-memory LRU.",
          "is_bot": false,
          "headline": "0.3.0: bazil.org/fuse mount + SQLite-on-FUSE e2e test (linux)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T18:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2380df121699c0a621fa33b38f9907912b944de6",
          "body": "Adds the byte-addressed File API and a multi-file FS over the block\nVFS — the layer SQLite (and any other POSIX consumer) needs. FUSE\nmount lands in 0.3.0; until then the API is in-process Go.\n\nWhat's new\n----------\n- pkg/vfs/fs.go — FS with inode tree, directory ops (Mkdir, Create,\n  Lookup, ReadDi\n[…]\n.0: gcs + azureblob backends.\n- 0.6.0: K8s sidecar mode + Helm chart.\n- 1.0.0: chunked uploads, multipart resume, GC for orphan blocks\n  via a refcount map at metadata/refs.zap.age, Prom/OTel metrics.",
          "is_bot": false,
          "headline": "0.2.0: multi-block files + FS layer + SQLite roundtrip proven",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T18:37:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "837e5bac961a8724d540b7178f37e180e3e1c217",
          "body": "…rypto)\n\nPhase 0.1.0 — production-shaped scaffold for the S3-backed virtual block\nfilesystem. Stateful services (IAM, BD, ATS, TA, KMS, onyxd, lqd\nsnapshots) get unlimited disk via S3 with PQ-encrypted blocks; the\nhot tier is a configurable LRU cache. Companion to hanzo/replicate\n(WAL streaming) — `\n[…]\n cache layer\n- 0.3.0: gcs + azureblob backends\n- 0.4.0: K8s sidecar mode + Helm chart\n- 0.5.0: WASI guest mode\n- 1.0.0: chunked uploads, multipart resume, GC for orphan blocks,\n  metrics + SLO targets",
          "is_bot": false,
          "headline": "initial: vfs scaffold (block layer + file:// + s3 backends + age PQ c…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T17:59:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 1,
      "commits_last_year": 50,
      "latest_release_at": "2026-05-19T07:20:11Z",
      "latest_release_tag": "v0.1.0",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 11,
      "days_since_latest_release": 70,
      "mean_days_between_releases": null
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/hanzoai/vfs",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/hanzoai/vfs",
          "is_deprecated": false,
          "latest_version": "v0.6.6",
          "repository_url": "https://github.com/hanzoai/vfs",
          "versions_count": 17,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T03:21:14Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 19162,
      "source_files_sampled": 34,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.54.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-5cv4-jp36-h3mw",
              "GO-2026-5025",
              "GO-2026-5026",
              "GO-2026-5027",
              "GO-2026-5028",
              "GO-2026-5029",
              "GO-2026-5030",
              "GO-2026-5942"
            ],
            "fixed_version": "0.56.0",
            "advisory_count": 8,
            "oldest_advisory_days": 67
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.2",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5841"
            ],
            "fixed_version": "1.18.7",
            "advisory_count": 1,
            "oldest_advisory_days": 1
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.52.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 21
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.37.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 14
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 3,
          "moderate": 1
        },
        "advisory_count": 11,
        "affected_count": 4,
        "assessed_count": 35,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "bazil.org/fuse",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230120002735-62a210ff1fd5"
        },
        {
          "name": "github.com/hanzoai/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.2"
        },
        {
          "name": "github.com/hanzos3/go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/jacobsa/fuse",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260302145937-f1ba38d60fdf"
        },
        {
          "name": "github.com/luxfi/age",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/zeebo/blake3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.4"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "bazil.org/fuse",
            "direct": true,
            "version": "v0.0.0-20230120002735-62a210ff1fd5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hanzoai/sqlite",
            "direct": true,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hanzos3/go",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jacobsa/fuse",
            "direct": true,
            "version": "v0.0.0-20260302145937-f1ba38d60fdf",
            "ecosystem": "go"
          },
          {
            "name": "github.com/luxfi/age",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/blake3",
            "direct": true,
            "version": "v0.2.4",
            "ecosystem": "go"
          },
          {
            "name": "filippo.io/hpke",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-ini/ini",
            "direct": false,
            "version": "v1.67.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hanzoai/csqlite",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hanzoai/sqlcipher",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/crc32",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/crc64nvme",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/md5-simd",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/philhofer/fwd",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rs/xid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tinylib/msgp",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/assert",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.52.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": false,
            "version": "v3.0.1",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 35,
        "direct_count": 7,
        "indirect_count": 28
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "zeekay",
          "commits": 9,
          "avatar_url": "https://avatars.githubusercontent.com/u/285707?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": false,
      "has_tests": true,
      "ci_workflows": [],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 31 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": null,
            "reason": "no workflows found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 9,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": null,
            "reason": "No tokens found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "10 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "acdc44fb76beb25ecb5daeaf03d205a774d097b7",
        "ran_at": "2026-07-29T00:24:59Z",
        "aggregate_score": 2.4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-28T04:03:12Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/hanzoai/vfs",
    "host": "github.com",
    "name": "vfs",
    "owner": "hanzoai"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": "High-Risk Jurisdiction Policy applies a 75% multiplier to weighted overall health and gives it an At risk ceiling of 49.",
      "notes": [
        {
          "code": "jurisdiction_overall_adjustment",
          "params": {
            "cap": 49,
            "pct": 75
          }
        }
      ],
      "value": 34,
      "inputs": {
        "security": 34,
        "vitality": 69,
        "community": 21,
        "governance": 43,
        "engineering": 54,
        "high_risk_jurisdiction_cap": 49,
        "high_risk_jurisdiction_multiplier": 75,
        "weighted_overall_before_jurisdiction": 46,
        "overall_after_jurisdiction_multiplier": 34
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 69,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 59,
            "inputs": {
              "commits_last_year": 50,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 11
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "11/52 weeks with commits",
                "points": 7.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 11
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "50 commits in the last year",
                "points": 15.3,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 50
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "good",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 84,
            "inputs": {
              "releases_count": 1,
              "latest_release_tag": "v0.1.0",
              "releases_from_tags": false,
              "days_since_latest_release": 70,
              "mean_days_between_releases": null
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "1 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 70 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 70
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "cadence unknown (single release)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence_unknown",
                    "params": {}
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 21,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "at_risk",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 44,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file present, not a recognized license",
                "points": 16.9,
                "status": "partial",
                "details": [
                  {
                    "code": "license_custom",
                    "params": {}
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 43,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 31 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "followers": 37,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "hanzoai",
              "public_repos": 159,
              "account_age_days": 3882
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "37 followers of hanzoai",
                "points": 11.4,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 37,
                      "login": "hanzoai"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "159 public repos, account ~10 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 159
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 10
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/hanzoai/vfs"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 8
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 8 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "17 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 17
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 54,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "at_risk",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 30,
            "inputs": {
              "has_ci": false,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": "https://hanzo.ai",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://hanzo.ai",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 34,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Signed-Releases, Token-Permissions. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 75% multiplier to Security posture and gives it an At risk ceiling of 49.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "dangerous_workflow",
                    "packaging",
                    "signed_releases",
                    "token_permissions"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "jurisdiction_posture_adjustment",
                "params": {
                  "cap": 49,
                  "pct": 75
                }
              }
            ],
            "value": 18,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 13,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 5,
              "scorecard_aggregate": 2.4,
              "high_risk_jurisdiction_cap": 49,
              "high_risk_jurisdiction_multiplier": 75,
              "security_posture_after_multiplier": 18,
              "security_posture_before_jurisdiction": 24
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 31 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no workflows found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "No tokens found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "10 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 35 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 35
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 11,
              "affected_packages": 4,
              "assessed_packages": 35,
              "unassessed_packages": 0,
              "affected_by_severity": "moderate 1, unknown 3",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 35,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "good",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 75,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": true,
              "exposures": [
                {
                  "role": "contributor_organization",
                  "count": 1,
                  "country": "Russia"
                }
              ],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 20
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "Russia: contributor_organization (1)",
                "points": 75,
                "status": "partial",
                "details": [
                  {
                    "code": "jurisdiction_exposure",
                    "params": {
                      "role": "contributor_organization",
                      "count": 1,
                      "country": "Russia"
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 60,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.98,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "49 of 50 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 49,
                      "sampled": 50
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 50",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 50
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 19162,
              "source_files_sampled": 34,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/34 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 34,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [],
  "report_type": "repository",
  "generated_at": "2026-07-29T00:25:03.641896Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/h/hanzoai/vfs.svg",
  "full_name": "hanzoai/vfs",
  "license_state": "custom",
  "license_spdx": null
}