公开记录
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-26 22:34 UTC

junhoyeo / contrabass

🎸 A project-level orchestrator for AI coding agents — Go & Charm stack implementation of OpenAI's Symphony

Go · TypeScriptApache-2.0★ 204 星标⑂ 24 复刻始于 2026年3月在 GitHub 上查看 ↗

junhoyeo/contrabass 的健康指数为 100 分中的 63 分,处于「中等」区间。 其得分最高的类别是Engineering Quality(81/100),最低的是Security(26/100)。 最近一次更新在 9 天前。 近期的大部分工作由 1 位贡献者完成。

63
总分 / 100
中等

软件健康指数

指标归入加权类别,统一采用 1–100 量表。总体分先取类别加权平均;当公开证据触发高风险司法辖区政策时,评级会按政策调整,并设置 49(有风险)的上限。AI 就绪度不计入总体分。

63
优秀85-100堪称典范;基本满足所有检验标准
良好70-84健康;仅有轻微不足
中等50-69可接受,但存在明显不足;建议进行审查
存在风险30-49存在重大薄弱环节;采用时应保持审慎
危急1-29问题严重(项目被弃置、仅有单一维护者、缺乏基本工程规范)
活力社区与采用可持续性与治理工程质量安全AI 就绪度

评分画像

每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形,而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。

所有权

Junho Yeo个人账户
1,608 关注者401 个公开仓库始于 2017年10月

该仓库由个人账户拥有。相较于组织支持的项目,单一所有者项目的延续性风险更高。

软件包生态系统

注册表软件包版本月下载量版本数最近发布
Gogithub.com/junhoyeo/contrabassv0.5.1-1110 天前

按类别列示的指标

活力

项目是否仍有生命——是否仍在编写代码,是否仍在发布版本?

74良好 · 占总体的 22%
评分方式
28.8/36推送新近度 — 最近一次推送于 9 天前
6.9/36提交节奏 — 52 周中有 10 周有提交
18/18提交量 — 最近一年 528 次提交
10/10OpenSSF Scorecard:Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
所用输入
commits_last_year528
human_commit_share1
days_since_last_push9
active_weeks_last_year10

发布纪律

90优秀
评分方式
27/27有发布版本 — 已发布 10 个发布版本
36/36发布时效 — 最近一次发布版本于 10 天前
27/27发布节奏 — 约每 14.5 天发布一次
0/10OpenSSF Scorecard:Signed-Releases — Project has not signed or included provenance with any releases.
所用输入
releases_count10
latest_release_tagv0.5.1
releases_from_tags
days_since_latest_release10
mean_days_between_releases14.5

社区与采用

项目是否拥有用户、下载量与关注度,并具备欢迎贡献者参与的配置?

59中等 · 占总体的 18%

流行度与采用

49存在风险
评分方式
37.4/60星标 — 204 个星标
11.3/25复刻 — 24 个复刻
0/15关注者 — 2 位关注者
所用输入
forks24
stars204
watchers2
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

社区健康

70良好
评分方式
22.5/22.5README
22.5/22.5许可证 — 可识别的许可证(Apache-2.0)
18/18CONTRIBUTING 指南
0/13.5行为准则
0/7.2议题模板
0/6.3PR 模板
所用输入
has_readme
has_license
has_contributing
has_issue_template
has_code_of_conduct
has_pull_request_template

可持续性与治理

项目能否在其成员之外延续——巴士系数、响应能力、由谁支持,以及软件包的维护状况?

64中等 · 占总体的 24%
评分方式
9/54巴士系数 — 1 位贡献者贡献了半数提交
5.2/22.5提交分布 — 头号贡献者编写了 77% 的提交
9.5/13.5贡献者广度 — 7 位贡献者
10/10OpenSSF Scorecard:Contributors — project has 5 contributing companies or organizations
所用输入
bus_factor1
contributors_sampled7
top_contributor_share0.771
评分方式
28.1/46.8议题解决 — 60% 的议题已关闭
34.3/38.3PR 接受 — 已裁定的 PR 中 43/48 已合并
0/15OpenSSF Scorecard:Code-Review — Found 0/8 approved changesets -- score normalized to 0
所用输入
merged_prs43
open_issues2
closed_issues3
issue_closed_ratio0.6
closed_unmerged_prs5
评分方式
10/30所有权背书 — 个人(用户)账户
0/20已验证域名 — 不适用于个人账户
23.1/25所有者影响力 — junhoyeo 有 1,608 位关注者
25/25既往记录 — 401 个公开仓库,账户约 8 年
所用输入
followers1,608
owner_typeUser
is_verified
owner_loginjunhoyeo
public_repos401
account_age_days3,213
已排除计分(无数据或不适用):已验证域名。 其余权重已重新归一化。
评分方式
25/25已发布且可解析 — go 上有 1 个软件包
35/35发布时效 — 最近一次发布于 10 天前
20/20版本历史 — 11 个已发布版本
20/20未被弃用 — 活跃,未被弃用或撤回
所用输入
packagesgithub.com/junhoyeo/contrabass
ecosystemsgo
any_deprecated
min_days_since_publish10

工程质量

基础的工程与文档实践是否到位?

81良好 · 占总体的 20%

工程实践

68中等
评分方式
24/24CI 工作流 — 4 个工作流
24/24存在测试
0/16Linter 配置
0/9.6Pre-commit 钩子
0/6.4.editorconfig
20/20OpenSSF Scorecard:CI-Tests — 8 out of 8 merged PRs checked by a CI test -- score normalized to 10
所用输入
has_ci
has_tests
has_editorconfig
has_linter_config
has_precommit_config

文档

100优秀
评分方式
30/30README
25/25文档目录
15/15文档 / 主页站点 — https://contrabass.dev
10/10仓库描述
10/10主题标签 — 9 个主题标签
10/10Wiki
所用输入
topicsai-agent, bubbletea, bubbletea-tui, coding-agent, golang, harness, openai, symphony, tui
has_wiki
homepagehttps://contrabass.dev
has_readme
has_docs_dir
has_description

安全

可见的安全与供应链实践是否稳固,且不存在未解决的高风险司法辖区暴露?

26危急 · 占总体的 16%

安全态势

26危急
评分方式
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — branch protection not enabled on development/release branches
2.5/2.5CI-Tests — 8 out of 8 merged PRs checked by a CI test -- score normalized to 10
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 0/8 approved changesets -- score normalized to 0
2.5/2.5Contributors — project has 5 contributing companies or organizations
0/10Dangerous-Workflow — dangerous workflow patterns detected
0/7.5Dependency-Update-Tool — no update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5许可证 — license file detected
7.5/7.5Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
5/5Packaging — packaging workflow detected
0/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
0/5SAST — SAST tool is not run on all commits -- score normalized to 0
0/5Security-Policy — security policy file not detected
0/7.5Signed-Releases — Project has not signed or included provenance with any releases.
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities — 71 existing vulnerabilities detected
所用输入
sourceopenssf_scorecard
checks_evaluated18
scorecard_versionv5.5.0
checks_inconclusive0
scorecard_aggregate2.6

AI 就绪度

该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件?这是一枚独立的实验性徽章——权重为 0.0,因此单独呈现,不影响总体健康评分。

76良好 · 占总体的 0%
评分方式
45/45代理指令 — AGENTS.md
0/15机器可读文档(llms.txt)
40/40可读的提交历史 — 100 次人类提交中有 98 次说明了意图(结构化标题或解释性正文)
所用输入
has_llms_txt
legible_history_share0.98
agent_instruction_filesAGENTS.md
agent_instruction_max_bytes11,092
评分方式
18/18一条命令的引导启动 — Makefile
22/22自动化测试
0/11Lint / 格式化配置
11/11静态类型检查 — packages/dashboard/tsconfig.json, packages/landing/tsconfig.json
10/10可复现环境 — Nix, lockfile
0/10已体现的代理实践 — 最近 100 次提交中没有代理编写的提交
0/8自动化维护 — 未观察到自动依赖更新
0/10OpenSSF Scorecard:Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
所用输入
has_nix
has_tests
lockfilesgo.sum
has_dockerfile
typed_language
bootstrap_filesMakefile
has_devcontainer
has_linter_config
typecheck_configspackages/dashboard/tsconfig.json, packages/landing/tsconfig.json
agent_commit_share0
toolchain_manifestsgo.mod
dependency_bot_commit_share0
评分方式
45/45可类型检查的代码 — Go(静态类型)
54.8/55可控的文件大小 — 采样的 242 个源文件中有 1 个超过 60KB
所用输入
primary_languageGo
largest_source_bytes76,784
source_files_sampled242
oversized_source_files1

关键数据

204GitHub 星标
7贡献者
528最近 12 个月提交数
9距最近推送天数
10发布版本数
1巴士系数(bus factor)
2开放议题
Go, npm软件包生态系统数

数据采集警告

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
  • GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

更多细节

Star 与 Fork 历史 0 ★ / 24 ⇿
0Star
24Fork
10发布

每颗 star 和每个 fork 的添加时间,来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方,二者可相互对照:稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时,它会作为增长真实性予以报告。

048121620242222026-032026-052026-07
主版本 0次版本 4修订 6
OpenSSF Scorecard 2.6 / 10
2.6综合

来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身,而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用,并从安全评分中剔除(绝不按零分计)。Scorecard v5.5.0 · 2026-07-26 22:34 UTC

10Binary-Artifactsno binaries found in the repo
0Branch-Protectionbranch protection not enabled on development/release branches
10CI-Tests8 out of 8 merged PRs checked by a CI test -- score normalized to 10
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 0/8 approved changesets -- score normalized to 0
10Contributorsproject has 5 contributing companies or organizations
0Dangerous-Workflowdangerous workflow patterns detected
0Dependency-Update-Toolno update tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
10Maintained30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
10Packagingpackaging workflow detected
0Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 0
0SASTSAST tool is not run on all commits -- score normalized to 0
0Security-Policysecurity policy file not detected
0Signed-ReleasesProject has not signed or included provenance with any releases.
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities71 existing vulnerabilities detected
直接依赖 12
注册表软件包版本约束清单文件
Gocharm.land/bubbles/v2v2.0.0go.mod
Gocharm.land/bubbletea/v2v2.0.1go.mod
Gocharm.land/lipgloss/v2v2.0.0go.mod
Gogithub.com/BourgeoisBear/rastermv1.1.2go.mod
Gogithub.com/charmbracelet/logv0.4.2go.mod
Gogithub.com/charmbracelet/x/mosaicv0.0.0-20260304213900-0e78e2954235go.mod
Gogithub.com/fsnotify/fsnotifyv1.9.0go.mod
Gogithub.com/osteele/liquidv1.8.1go.mod
Gogithub.com/spf13/cobrav1.10.1go.mod
Gogithub.com/stretchr/testifyv1.11.1go.mod
Gogolang.org/x/syncv0.19.0go.mod
Gogopkg.in/yaml.v3v3.0.1go.mod
全部依赖 未采集

本报告未能采集到解析后的依赖集合:GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

原始 JSON 报告 机器可读
{
  "data": {
    "repo": {
      "topics": [
        "ai-agent",
        "bubbletea",
        "bubbletea-tui",
        "coding-agent",
        "golang",
        "harness",
        "openai",
        "symphony",
        "tui"
      ],
      "is_fork": false,
      "size_kb": 3115,
      "has_wiki": true,
      "homepage": "https://contrabass.dev",
      "languages": {
        "Go": 1588066,
        "CSS": 27105,
        "Nix": 1599,
        "HTML": 367,
        "Astro": 3098,
        "Shell": 3344,
        "Python": 5368,
        "Makefile": 2475,
        "JavaScript": 79,
        "TypeScript": 281371
      },
      "pushed_at": "2026-07-17T05:04:56Z",
      "created_at": "2026-03-05T04:01:33Z",
      "owner_type": "User",
      "updated_at": "2026-07-26T11:30:32Z",
      "description": "🎸 A project-level orchestrator for AI coding agents — Go & Charm stack implementation of OpenAI's Symphony",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go",
        "TypeScript"
      ]
    },
    "owner": {
      "blog": "https://junho.io/about",
      "name": "Junho Yeo",
      "type": "User",
      "login": "junhoyeo",
      "company": null,
      "location": "Seoul, Korea",
      "followers": 1608,
      "avatar_url": "https://avatars.githubusercontent.com/u/32605822?v=4",
      "created_at": "2017-10-08T02:34:52Z",
      "is_verified": null,
      "public_repos": 401,
      "account_age_days": 3213
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.5.1",
          "kind": "patch",
          "published_at": "2026-07-16T12:36:39Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-05-10T20:51:41Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-05-10T19:40:50Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-03-31T14:17:03Z"
        },
        {
          "tag": "v0.2.2",
          "kind": "patch",
          "published_at": "2026-03-25T19:47:04Z"
        },
        {
          "tag": "v0.2.1",
          "kind": "patch",
          "published_at": "2026-03-12T02:33:40Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-03-12T02:31:21Z"
        },
        {
          "tag": "v0.1.2",
          "kind": "patch",
          "published_at": "2026-03-08T11:45:20Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2026-03-08T09:16:38Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-03-08T08:44:41Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "5fc728b15949d38ac8f78c8d97dc8b8a46a3a5d4",
          "body": "fix(dashboard): detail-sheet crash on null timeline; stable SSE consumption",
          "is_bot": false,
          "headline": "Merge pull request #53 from junhoyeo/agent/fix-dashboard-detail-sheet",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T05:04:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "acb83b350093c912a869abf89558c85cd6d72ba6",
          "body": "fix(cli): graceful SIGINT/SIGTERM in team mode; bound --until-empty redispatch",
          "is_bot": false,
          "headline": "Merge pull request #52 from junhoyeo/agent/fix-cli-signals",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T05:04:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e3ae4f9cbd8e5b10dac195007d7b463ee0f06874",
          "body": "fix(web): replace wildcard CORS with origin/Host validation; wire board SSE events",
          "is_bot": false,
          "headline": "Merge pull request #51 from junhoyeo/agent/fix-web-security",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T05:04:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "076b2429a0a668773a6405fbb7dd5d5a61596fbd",
          "body": "fix(tmux,team): exit-code marker completion detection; stop re-executing stale team state",
          "is_bot": false,
          "headline": "Merge pull request #50 from junhoyeo/agent/fix-tmux-completion",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T05:04:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8d8eb37245ced3f1f019b60b600088fc2a964719",
          "body": "fix(orchestrator): complete stalled/timed-out runs; harden dispatch gating",
          "is_bot": false,
          "headline": "Merge pull request #49 from junhoyeo/agent/fix-orchestrator-stalled-runs",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T05:04:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ae1d7ffe71b2ba984f8369d91ff027da71834cc",
          "body": "agentStageState is zero-initialized when a run starts, so the first\nclassifyAgentStage call measured elapsed from the zero time (~decades),\nalways exceeding the reviewing/testing thresholds. Every fresh run with\nan empty diff and near-zero token rate classified as Reviewing (step 4),\nand the monoton\n[…]\nes in the classifier\nRejected: initializing stageState.LastDiffChange in dispatchIssue | leaves directly-constructed entries (reconcile/tests) on the zero-time path\nConfidence: high\nScope-risk: narrow",
          "is_bot": false,
          "headline": "fix(orchestrator): anchor stage plateau clock on first snapshot tick",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c5f8c50127ddf896b35bd9a7a705ad05ab84a771",
          "body": "…h gating\n\nStalled and timed-out runs never reached completeRun: stopRun deleted the\nentry from o.running synchronously inside runCycle, on the same goroutine\nthat drains runSignals, so the watcher's done signal always arrived after\nthe delete and hit completeRun's not-found guard. Every stall/timeo\n[…]\nompleteRun owns removal and all failure bookkeeping for watched processes\nNot-tested: a kill-resistant process that outlives repeated interrupt attempts retains its entry (and agent slot) indefinitely",
          "is_bot": false,
          "headline": "fix(orchestrator): complete stalled/timed-out runs and harden dispatc…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "40b684841a93ba0476b7b5a30814dc5202962dc2",
          "body": "…nt-done by updated_at\n\nBackend down at page load left the dashboard on an eternal loading\ncard: the error from useSSE was only rendered on the post-state\nbranch, and the loading label reused a section heading. The pre-state\ncard now shows the connection error plus a reconnecting hint, with a\ndedica\n[…]\n contract beyond the ordering defect\nConfidence: high\nScope-risk: narrow\nNot-tested: pre-state error card (App has no test harness; verified via typecheck/build and by the useSSE error-dispatch tests)",
          "is_bot": false,
          "headline": "fix(dashboard): surface pre-snapshot connection errors and order rece…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1806f50be8cb73b8ffde4758342523855a97c49b",
          "body": "…ct, gate backoff reset on stream data\n\nThree data-layer defects in the SSE hook and its queue consumer:\n\n1. useSSE caps queueEvents at 1000 by splicing the front, which pins\n   the array length while shifting contents. QueuePanel consumed new\n   events via an absolute index cursor (events.slice(pro\n[…]\nective: consumers of queueEvents must track position by seq, never by array index\nNot-tested: reconnect backoff growth timing across repeated 200-then-drop cycles (only the reset placement is covered)",
          "is_bot": false,
          "headline": "fix(dashboard): make queue cursor trim-safe, re-sync board on reconne…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "879f768b3e13efd088e07794c5959de408f38914",
          "body": "…ching on every snapshot\n\nTwo failure modes in IssueDetailSheet:\n\n1. The Go timeline handler returns newSnapshot() for issues with no\n   workflow history, whose nil Nodes slice marshals as \"nodes\": null.\n   The empty-state check dereferenced timeline.nodes.length without a\n   guard, so opening the s\n[…]\nt error boundary | containment, not a fix; out of scope for this finding\nConfidence: high\nScope-risk: narrow\nNot-tested: server actually emitting \"nodes\": null end-to-end (covered via fetch mock only)",
          "is_bot": false,
          "headline": "fix(dashboard): stop detail sheet crashing on null timeline and refet…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "04323976456d964d11e76d9b0cc843db85a485c0",
          "body": "…ts to stdout\n\nRoot team-execution mode returned from run() before the single-agent\nsignal hook was installed, and runTeamExecutionLoop disables the\nteam-level handler, so `contrabass --no-tui` (or --dry-run) with\nteam.execution_mode=team had zero signal handling: Ctrl+C killed the\nprocess via the G\n[…]\n switch; moving it after the switch silently restores the default-kill behavior for team mode\nNot-tested: SIGTERM delivery (regression test exercises SIGINT; both share one NotifyContext registration)",
          "is_bot": false,
          "headline": "fix(cli): handle SIGINT/SIGTERM in team mode and stream headless even…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "919151a01b589fd53db9c718243dfe3524bd8115",
          "body": "The event forwarder in run() closed webEvents once orch.Events() ended.\nWith the server now publishing board mutations into the same channel via\nSetEventSink, shutdown raced: ctx cancel ends orch.Run, the forwarder\ncloses webEvents, while graceful Shutdown gives in-flight handlers up to\n5s — a POST/\n[…]\ne; hub shutdown is driven by ctx, never by closing the source\nNot-tested: natural orchestrator completion without ctx cancel now leaves SSE streams open until process exit (benign; process is exiting)",
          "is_bot": false,
          "headline": "fix(cmd): stop closing the web event sink when the orchestrator drains",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b4a6e70bc909016fa7e3a3fee9a3da1f0075fb8d",
          "body": "RecoverStaleLocks removed files ending in \".tmp\", but the Store names its\ncrash-leftover temp files \"<path>.tmp.<pid>.<unixnano>\" — nothing in the\nrepo ever creates a bare \".tmp\" file, so the recovery walk was a permanent\nno-op and temp litter accumulated. Match the \".tmp.\" infix instead. The\ntest p\n[…]\nriter never\nproduces, masking the mismatch; it now uses the real naming scheme.\n\nConfidence: high\nScope-risk: narrow\nNot-tested: aging out orphaned \".lock\" files (still unreclaimed, out of scope here)",
          "is_bot": false,
          "headline": "fix(team): match real temp-file names in stale lock recovery",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c4fc619c8bb2aed6af430962112f50e26dfc22a4",
          "body": "A team run that ends in a non-complete phase re-queues its board issue as\nretry with the claim cleared, and FindDispatchableIssue treats unclaimed\nretry issues as dispatchable. dispatchBoardIssues therefore re-selected a\ndeterministically failing issue forever with zero backoff, spinning\n`board disp\n[…]\nn ClaimedBy being non-empty; do not add stale-claim recovery that clears parked:max-dispatch-attempts without revisiting this loop\nNot-tested: concurrent dispatchers racing on the same board directory",
          "is_bot": false,
          "headline": "fix(board): cap per-issue dispatch attempts so --until-empty terminates",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f4b4e6abc82d8daf5fed186f21e40aafc769c89a",
          "body": "SetEventSink had no production caller, so publishEvent silently\nno-oped and the board_issue_created/updated/moved events emitted by\nthe HTTP board handlers never reached the hub. A second dashboard tab\n(or any stream subscriber) showed a stale Kanban board until a full\nreload. Both server constructi\n[…]\ntes now pass the hub's source\nchannel as the sink.\n\nConfidence: high\nScope-risk: narrow\nNot-tested: no cmd-level regression test; the publish path itself is covered by internal/web board handler tests",
          "is_bot": false,
          "headline": "fix(cmd): wire the web server event sink so board mutations broadcast",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "115cd933360f58f050ab940b17047b4748835e33",
          "body": "…ked deps\n\nFour related team state-machine fixes:\n\nCreateManifest overwrote an existing team's manifest and reset\nphase-state.json to plan on every `team run`, while leftover task files\nfrom the previous run stayed claimable — retrying a failed board issue\n(deterministic team name) silently re-execu\n[…]\n(non-terminal) team now requires removing its state dir; surface this in UX before automating cleanup\nNot-tested: EMFILE-style transient read errors in ListTasks (only permission errors are simulated)",
          "is_bot": false,
          "headline": "fix(team): guard team re-initialization and stop hard-failing on bloc…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e0e6c3a97692afe63a6ecb3b4c2b47039b2f80ef",
          "body": "…CORS\n\nwithCORS set Access-Control-Allow-Origin: * on every plain REST/SSE\nroute with no Host or Origin validation, so any web page could read\nthe full orchestrator state, stream /api/v1/events, and drive\nPOST/PATCH mutations (stop agents, create/modify board issues) against\nthe localhost dashboard.\n[…]\nive: keep CONTRABASS_ALLOWED_ORIGINS parsing exact-origin only; pattern matching would reopen the bypass this fixes\nNot-tested: IPv6 bracketed Host/Origin variants beyond net.ParseIP loopback handling",
          "is_bot": false,
          "headline": "fix(web): validate Origin and Host on REST/SSE routes, drop wildcard …",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c196b7b9b0bf33275daa005ea62efe74bcf8f0c3",
          "body": "…e death\n\nTmuxRunner's only done signal was pane liveness, which is wrong in both\ndirections: the CLI is launched via send-keys inside the pane's interactive\nshell, so the pane stays alive after the command exits (#{pane_dead} never\nfires and the coordinator blocks on proc.Done forever, issue #39); \n[…]\n run to completion; a server entrypoint here will hang the exec phase\nNot-tested: real opencode/omx/omc binaries under tmux (mock CommandRunner only); fish-style shells where $? is not the exit status",
          "is_bot": false,
          "headline": "fix(tmux): detect task completion from the CLI's exit marker, not pan…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4a1f2833dd9b97d9f362f8d49736bb64e619c311",
          "body": "Once Run returned (source closed or ctx done) the hub had no closed\nstate, so a late Subscribe registered a channel nothing would ever\nwrite to or close. Reconnecting SSE clients subscribed to the dead hub\nand hung on keepalives forever, silently frozen. Subscribe now hands\nout an already-closed cha\n[…]\nibe signature must stay (int, <-chan T) for existing callers\nRejected: error return from Subscribe | breaks both stream handlers and cmd callers for no added signal\nConfidence: high\nScope-risk: narrow",
          "is_bot": false,
          "headline": "fix(hub): return closed channel from Subscribe after Run exits",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T04:08:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "080df797d4c330b737232788c65129b261ff565b",
          "body": "fix(agent): drain opencode stdout, split team CLI streams, unrace codex Stop",
          "is_bot": false,
          "headline": "Merge pull request #48 from junhoyeo/agent/fix-agent-runner-io",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T03:46:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2462db5bbdf738ae25f361c673c863ad5369dc96",
          "body": "fix(workspace): preserve issue-branch commits; clean plain-dir workspaces",
          "is_bot": false,
          "headline": "Merge pull request #47 from junhoyeo/agent/fix-workspace-branch-cleanup",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T03:46:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d740e744c9b5327a5fb4e3f4d246943caab64ee4",
          "body": "fix(tracker): assignee-aware claim safety across Linear/GitHub/local adapters",
          "is_bot": false,
          "headline": "Merge pull request #46 from junhoyeo/agent/fix-tracker-claim-safety",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T03:46:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e003a07698864f33076f7e1009ba767ed223dc98",
          "body": "Team coordination pre-provisions worker directories in temporary, non-Git bases. Repository mode must be determined before worktree registration lookup so these legitimate directories are retained instead of failing on git worktree list.\n\nConstraint: Existing plain directories are valid only after a\n[…]\ndation to existing paths\nTested: go test ./internal/workspace -race -count=1; go test ./internal/team -race -count=1; go test ./... -race -count=1; go vet ./...\nNot-tested: GitHub Actions Linux runner",
          "is_bot": false,
          "headline": "fix(workspace): preserve prepared plain workspaces",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T03:40:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1bbca97dfad0fcfea54f046a84ee72b4c686dd8a",
          "body": "A stale OpenCode server may require the full caller shutdown window to reap. Re-check cancellation before launching its replacement so deadline-bound callers do not start a new process after their work has expired. The regression fixture now confirms its interrupt trap is ready before recovery and a\n[…]\nline|TestOpenCodeRunner_ConcurrentStaleRecoveryReapsOnce|TestOpenCodeRunner_ConcurrentStaleRecoveryWaitsForFixedPort; go test ./... -race -count=1; go vet ./...\nNot-tested: GitHub Actions Linux runner",
          "is_bot": false,
          "headline": "fix(agent): honor recovery deadline before replacement",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-17T03:39:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3c8327532705b19efc528812595a80bc8f2fa5fb",
          "body": "OpenCode recovery now keeps one owner through stale-server reaping and\nreplacement, so concurrent sessions cannot race onto a still-held port or\nconsume one another's subprocess lifecycle. It also bounds SSE readiness and\nprotects shared servers from cancellation-only health failures.\n\nConstraint: S\n[…]\np\nTested: go test ./... -race; go vet ./...; focused lifecycle and policy tests under -race; GitNexus detect-changes (staged)\nNot-tested: Real OpenCode server behavior behind an external reverse proxy",
          "is_bot": false,
          "headline": "fix(agent): preserve shared runner recovery",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T18:10:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac0a54e2334108ad48dd14fb4714becfd8fa152e",
          "body": "Workspace recovery must distinguish a stale registration from an unrelated\nGit failure so a retry cannot destroy work or mutate Git state without\nevidence. It now fails closed on registration uncertainty, validates\nlinked-worktree metadata, and reclaims per-issue locks when idle.\n\nConstraint: Git em\n[…]\ngistration checks fail-closed before removing any workspace path\nTested: go test ./... -race; go vet ./...; GitNexus detect-changes (staged)\nNot-tested: Git versions older than the supported CI matrix",
          "is_bot": false,
          "headline": "fix(workspace): preserve valid issue workspaces",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T17:46:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "66af8f9285ee39643de0b3870774944c101aed91",
          "body": "Harden claim safety after review found verification, identity, and cross-process ownership gaps. GitHub claims now fail closed, local claims retain an advisory lock for an agent's lifetime, and recovered claims start as attempt 2.\n\nConstraint: A crashed process must release ownership without allowin\n[…]\nst ./internal/tracker ./internal/orchestrator -race; go vet ./internal/tracker ./internal/orchestrator; GitNexus staged detect_changes\nNot-tested: End-to-end restart against live GitHub or Linear APIs",
          "is_bot": false,
          "headline": "fix(tracker): make recovered claims exclusive",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T17:39:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "18ba859917d59e6e74294a675efcfb37d807cc1b",
          "body": "…e a git repo\n\nThe non-git fallback triggered on ANY `git rev-parse` failure: a\ntransient IO error or canceled context inside a real repo silently\ncreated a plain directory that later confused worktree bookkeeping.\nThe fallback now requires git's explicit \"not a git repository\" answer\nand fails clos\n[…]\nror text is the only discriminator — exit code 128 covers both cases\nConfidence: high\nScope-risk: narrow\nNot-tested: localized (non-English) git output makes non-git mode error instead of falling back",
          "is_bot": false,
          "headline": "fix(workspace): only fall back to plain dirs when definitively outsid…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T16:34:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "37623f3918189483e023a9cd79d1aeec9ca9efc5",
          "body": "…al issue IDs\n\n- GitHub returns 201 for POST /assignees even when it silently ignores\n  an assignee the token user cannot assign, so ClaimIssue reported\n  success on claims that never landed. The response body's assignees\n  are now verified.\n- parseRetryAfter treated RFC 9110 HTTP-date values as \"no\n[…]\nath\n  metacharacters, mirroring the workspace manager's validation.\n\nConfidence: high\nScope-risk: narrow\nNot-tested: GitHub API responses that omit the issue body on 201 (treated as success by design)",
          "is_bot": false,
          "headline": "fix(tracker): verify GitHub claims landed; harden Retry-After and loc…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T16:33:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a1d8d06595013cbc8140e085de0b8a2a59798187",
          "body": "…ce codex Stop\n\nFour reliability fixes in the agent runners:\n\n- opencode ensureServer trusted any cached entry with a URL: a crashed\n  server left a stale URL that every future Start reused and hung on.\n  Cached servers are now health-checked (any HTTP response counts) and\n  reaped + restarted when \n[…]\nigh\nScope-risk: moderate\nDirective: never receive from AgentProcess.Done inside the runner — wait on codexProcess.exited\nNot-tested: health-check behavior behind proxies that answer for dead upstreams",
          "is_bot": false,
          "headline": "fix(agent): reap dead opencode servers, order SSE before prompt, unra…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T16:30:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "77c9c070fe4ca274f734d80ad4d1f4b3cdc4651c",
          "body": "…ic writes\n\nThe daemon and the `contrabass board`/`team` CLIs open the same\nBoardDir from separate processes, but board mutations were guarded only\nby an in-process sync.Mutex:\n\n- The manifest read-modify-write in CreateIssueWithOptions could mint\n  the same NextIssueNumber twice, silently overwriti\n[…]\nefore lockBoardFile, never the reverse — lock ordering prevents deadlock\nNot-tested: NFS/network filesystems where flock semantics degrade; claim TOCTOU across processes (list-then-claim) is unchanged",
          "is_bot": false,
          "headline": "fix(tracker): flock local board mutations; unique temp files for atom…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T16:24:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "aa31ab38823b25faa46f803393db1a25de25dec0",
          "body": "…ocks alive\n\n- A worktree whose directory was deleted externally (rm -rf without\n  `git worktree remove`) leaves a stale registration that blocks every\n  `worktree add` at that path, making the issue permanently\n  undispatchable. Create now runs `git worktree prune` once and retries\n  when the add f\n[…]\ncted: refcounted lock table | complexity not justified by a map bounded at issue count\nConfidence: high\nScope-risk: narrow\nNot-tested: concurrent prune from two orchestrator processes on the same repo",
          "is_bot": false,
          "headline": "fix(workspace): prune stale registrations on create; keep per-issue l…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T16:21:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a823a344c7b7cae436f4d8d19d3a7389864c1541",
          "body": "…r as JSON\n\nTwo process-IO bugs that killed healthy agents:\n\n- The opencode startup scanner returned as soon as it saw the\n  \"listening on\" line, leaving the server's stdout pipe undrained.\n  Once the server logged ~64KB its writes blocked and the whole server\n  froze — every session on it stalled u\n[…]\n spawns a long-lived child process must keep draining (or discard) both of its output pipes for the process's lifetime\nNot-tested: real opencode/omx binaries (fixtures only); Windows pipe-buffer sizes",
          "is_bot": false,
          "headline": "fix(agent): drain opencode server stdout; stop parsing team CLI stder…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T16:19:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f158d93654cbbf54fe27d3ea7454b276ba3b0bcc",
          "body": "…ir workspaces\n\nTwo Create/Cleanup contract violations:\n\n- Create's fallback chain was -b → -B → attach. When the per-issue\n  branch already exists with prior commits (retry after a partial run,\n  resumed issue), -b fails and -B re-created the branch AT HEAD,\n  silently discarding the agent's commit\n[…]\nr reintroduce `worktree add -B` on this path — attach must win when the branch exists\nNot-tested: git localized (non-English) error output would bypass the plain-dir fallback and surface the raw error",
          "is_bot": false,
          "headline": "fix(workspace): stop resetting existing issue branches; clean plain-d…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T16:11:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4c0e3941c6f985b9c1884378a9793eb07a4ea8b9",
          "body": "The orchestrator's orphan-claim recovery flips any Claimed issue absent\nfrom its in-memory managed set back to Unclaimed and re-dispatches it.\nAll three tracker adapters fed it wrong data:\n\n- Linear: FetchIssues selected no assignee, so a teammate's In Progress\n  issue mapped to Claimed, was \"recove\n[…]\nve: any new tracker adapter must map \"claimed by me\" to Claimed, exclude \"claimed by others\", and never hardcode Unclaimed\nNot-tested: live Linear/GitHub API shapes (covered by httptest fixtures only)",
          "is_bot": false,
          "headline": "fix(tracker): make claim recovery assignee-aware across all adapters",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T16:09:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "078c091d50a42d8ac5eb4cb931dca56943973d1b",
          "body": "…e-test\n\ntest(agent): stabilize Codex protocol shutdown fixture",
          "is_bot": false,
          "headline": "Merge pull request #44 from junhoyeo/agent/fix-codex-protocol-sequenc…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T12:55:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb64de3665c94e98691e3554a508c795c089873d",
          "body": "fix(project): make dashboard release hook executable",
          "is_bot": false,
          "headline": "Merge pull request #45 from junhoyeo/agent/fix-release-dashboard-hook",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T12:32:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "03d00cc72f61a7cf7899aac666df2459d23d3b9b",
          "body": "GoReleaser v2 executes each before-hook as a process, so the shell builtin cd\nfailed before artifacts could be produced. Run Bun with an explicit working\ndirectory and keep the marker touch as a separate executable hook.\n\nConstraint: GoReleaser hooks are executed without a shell\nRejected: Remove the\n[…]\nators\nTested: go test -p 1 ./... -count=1; go vet ./...; git diff --check; failed v0.5.0 release log\nNot-tested: clean GoReleaser release environment (validated by the v0.5.1 tag workflow after merge)",
          "is_bot": false,
          "headline": "fix(project): make dashboard release hook executable",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T12:29:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b9e386fc3b4ddc0738645f221a47e9d17cfc078b",
          "body": "The protocol-sequence helper used to exit immediately after emitting its event,\nletting the stream goroutine remove the process before the test could exercise\nStop. Keep the fixture alive until the test interrupts it so the asserted\nshutdown path is deterministic.\n\nConstraint: Production runner beha\n[…]\nocolSequence$ -count=25; go test -race ./internal/agent -run ^TestCodexProtocolSequence$ -count=10; go test -p 1 ./... -count=1; go vet ./...; GitNexus detect-changes\nNot-tested: GitHub Actions matrix",
          "is_bot": false,
          "headline": "test(agent): stabilize Codex protocol shutdown fixture",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T12:15:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "74e84c91faf856e52dd3d5d710629547cd6d813e",
          "body": "fix: clarify Nix package and release metadata",
          "is_bot": false,
          "headline": "Merge pull request #43 from junhoyeo/agent/fix-nix-release-contract",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T12:06:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aab3206db1c837472b481689a89735db5efe2030",
          "body": "…ation\n\nThe Nix release-contract correction must be validated on top of the MCP and\nconfiguration fixes now merged into main. This merge preserves the original PR\ncommits while testing their combined behavior before #43 is merged.\n\nConstraint: Shared PR branch history must not be rebased or squashed\n[…]\nrge validation is required\nTested: go test -p 1 ./... -count=1; go vet ./...; git diff --cached --check; GitNexus detect-changes\nNot-tested: nix build and nix flake check (validated by GitHub Actions)",
          "is_bot": false,
          "headline": "chore(project): integrate MCP contract fixes before Nix release valid…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T12:04:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "10823b2721462219ca192c2f4992ec7f62aaeb24",
          "body": "fix: preserve Codex and MCP contracts",
          "is_bot": false,
          "headline": "Merge pull request #42 from junhoyeo/agent/fix-mcp-config-contract",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T12:02:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d7467dde14a30d6a9d4e5228fd334aa7e2510c8d",
          "body": "The package attribute set is not recursive, so its version field is not visible\nto the linker flags. Derive the linker metadata from the flake revision directly,\nmatching the package version and allowing the Nix build to evaluate.\n\nConstraint: Nix is unavailable in the local development environment\n\n[…]\nerived from the same flake revision\nTested: go test -p 1 ./... -count=1; go vet ./...; git diff --check; GitNexus detect-changes\nNot-tested: nix build and nix flake check (validated by GitHub Actions)",
          "is_bot": false,
          "headline": "fix(project): restore Nix version linker metadata",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T12:02:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6b906765e69e8e0d1de5bdeab790656760d1367b",
          "body": "The flake currently produces a headless CLI, so dashboard startup must fail with a clear remediation and the install guide must state that boundary. Release metadata now derives from the flake revision instead of an unpushed tag-runner mutation.\n\nConstraint: Dashboard assets are generated from JS de\n[…]\ntend Nix derivation before changing the package from headless to dashboard-enabled\nTested: go test -p 1 ./... -count=1; go vet ./...\nNot-tested: nix build and nix flake check (Nix unavailable locally)",
          "is_bot": false,
          "headline": "fix(project): make Nix dashboard limits explicit",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T11:54:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dbc8053f672e7d5c747c9eb1115bafebd3e6b2b4",
          "body": "Legacy model aliases must configure the Codex runner, and the MCP tool list must not promise an orchestrator snapshot in event-driven team mode. The effective-config metadata now matches the runner lifecycle.\n\nConstraint: Team dashboards expose events rather than an orchestrator StateSnapshot\nReject\n[…]\no test ./cmd/contrabass ./internal/config ./internal/web; go test ./internal/agent -count=1; go vet ./cmd/contrabass ./internal/config ./internal/web\nNot-tested: End-to-end MCP client interoperability",
          "is_bot": false,
          "headline": "fix(project): preserve Codex and MCP contracts",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T11:47:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ec6cfb3aa36e7b4947ab706457921fa076eef16c",
          "body": "…nfig\n\nfeat: add Streamable HTTP MCP and configurable orchestration",
          "is_bot": false,
          "headline": "Merge pull request #41 from vmxmy/feat/mcp-streamable-orchestrator-co…",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T11:30:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "505fb7faf7318a4641ea3ec7cc34ed5baf82b1f3",
          "body": "add nix support (Flake)",
          "is_bot": false,
          "headline": "Merge pull request #38 from zvictor/flake",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-07-16T11:27:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a47a0225abf9877cbde6e73e615f127c2654eb89",
          "body": null,
          "is_bot": false,
          "headline": "chore(project): remove historical openspec scaffold",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-07-10T04:45:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ddcc5a06c29f7747ddd64646615fa69422901fd",
          "body": null,
          "is_bot": false,
          "headline": "feat(config): add validated effective config pipeline",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-07-10T04:28:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa823b40308a7c7f28bc194162cae02fe2715de1",
          "body": null,
          "is_bot": false,
          "headline": "refactor(orchestrator): move runtime policy into config",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-07-10T02:44:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6f410e3032ef2b3a15687c81cdcd7dbf91698f96",
          "body": null,
          "is_bot": false,
          "headline": "feat(web): add streamable MCP connection support",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-07-10T02:42:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "38f737427d411fe96ec651084e89c27ff60aab9f",
          "body": null,
          "is_bot": false,
          "headline": "update nix on release",
          "author_name": "zvictor",
          "author_login": "zvictor",
          "committed_at": "2026-05-23T11:56:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e81780ed8d5675711d1eb5e1ed3d2c217654c934",
          "body": null,
          "is_bot": false,
          "headline": "add support to nix (flake)",
          "author_name": "zvictor",
          "author_login": "zvictor",
          "committed_at": "2026-05-23T11:55:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "847caf9664cb9a4d6f1fd92bb7c5851fbdac010c",
          "body": null,
          "is_bot": false,
          "headline": "docs(project): rewrite README feature sections for v0.4.0",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-05-10T20:50:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9997c77f41d3789de0164b7ae55a9828459e4fa3",
          "body": null,
          "is_bot": false,
          "headline": "fix(project): regenerate bun.lock with pinned bun@1.3.4 for CI parity",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-05-10T19:38:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a1fe9394a6a4b1384ad25cbe189bc9a7ce1907a6",
          "body": "fix(workspace,orchestrator,timeline,dashboard,build): handle non-git dirs, claim leaks, stage/ETA, i18n, build tags",
          "is_bot": false,
          "headline": "Merge pull request #37 from junhoyeo/fix/pr35-review-followup",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-05-10T07:50:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "98d3827aff5bc189ea5a34779afe14440818bc00",
          "body": "…dirs, claim leaks, stage/ETA, i18n, build tags\n\nfix(workspace): handle non-git base dirs and sanitize issue IDs\n- Add runGitQuick to detect git binary availability\n- Fall back to plain directory when not in a git repo\n- Add issueIDPattern regex to prevent path traversal\n\nfix(orchestrator): release \n[…]\ndashboard_dist build tag with fallback embed\n- Add embed_dashboard_fallback.go for builds without JS assets\n- Fix main.go to use fs.Stat instead of nil check\n\nchore(project): auto-fix go fmt [skip ci]",
          "is_bot": false,
          "headline": "fix(workspace,orchestrator,timeline,dashboard,build): handle non-git …",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-05-10T06:38:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "30fdbc47911e02033cd97c7ba4e9103b4e75b7e2",
          "body": "feat: dashboard redesign + codex 0.128 support + verify-gate hardening",
          "is_bot": false,
          "headline": "Merge pull request #35 from vmxmy/feat/dashboard-zh-cn-pr",
          "author_name": "Junho Yeo",
          "author_login": "junhoyeo",
          "committed_at": "2026-05-10T03:36:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb0528e22a3c9601653d6b7771074675ebea82f2",
          "body": "feat(orchestrator,dashboard): improve session liveness signals",
          "is_bot": false,
          "headline": "Merge pull request #12 from vmxmy/chore/improve-dashboard-liveness",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:51:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d8a111fcb8163a022d92e99581edf919b6ed3f79",
          "body": "feat(orchestrator,dashboard): surface task phase + ETA",
          "is_bot": false,
          "headline": "Merge pull request #11 from vmxmy/chore/surface-task-phase-and-eta",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:51:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "000bdca3dc1cbaf76475cf9f1b7a2dd90589e21b",
          "body": "feat(orchestrator): revalidate blockers on running issues",
          "is_bot": false,
          "headline": "Merge pull request #10 from vmxmy/chore/orchestrator-revalidate-blockers",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:49:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "91bb77d821369677e765370cb640d4431e2b94b4",
          "body": "feat(orchestrator): orphan run-attempt recovery",
          "is_bot": false,
          "headline": "Merge pull request #9 from vmxmy/chore/orchestrator-orphan-recovery",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:47:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b31caa198c1009751e5b609534f2982ffd50588",
          "body": "feat(orchestrator,docs): ship+archive verify-success-with-diff",
          "is_bot": false,
          "headline": "Merge pull request #8 from vmxmy/chore/verify-success-with-diff",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:46:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b470463052885018cdc6cf002888dfd1722e1871",
          "body": "test(dashboard): cover Stop button in IssueDetailSheet",
          "is_bot": false,
          "headline": "Merge pull request #7 from vmxmy/chore/stop-running-agent",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:45:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "06b0974da77ee792eedac5e8d7fb67d87f5f0645",
          "body": "feat(agent): surface omx token usage metrics",
          "is_bot": false,
          "headline": "Merge pull request #6 from vmxmy/chore/surface-omx-token-usage",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:43:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "50f8a1e737e1562ca08c5e88a630f41fc608a82c",
          "body": "feat(tracker,orchestrator): gate claims on Linear BlockedBy",
          "is_bot": false,
          "headline": "Merge pull request #5 from vmxmy/chore/gate-claims-on-blocked-by",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:42:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5538cb9246b4b8aebd41415a2c5750977e1751ec",
          "body": "docs(openspec): archive fix-codex-app-server",
          "is_bot": false,
          "headline": "Merge pull request #4 from vmxmy/chore/archive-fix-codex-app-server",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:40:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15e83dd1285060212ba4da76f3342da4ce71b09c",
          "body": "…imeline\n\ndocs(openspec): archive sync-linear-workflow-timeline",
          "is_bot": false,
          "headline": "Merge pull request #3 from vmxmy/chore/archive-sync-linear-workflow-t…",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:39:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee11011f960dcc235382a918f5dbbb5ae265cb29",
          "body": "…gate\n\ndocs(openspec): archive harden-verify-success-gate",
          "is_bot": false,
          "headline": "Merge pull request #2 from vmxmy/chore/archive-harden-verify-success-…",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:37:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "99c0f6a2e875844a4973b631f0d51744c6c719f2",
          "body": "All T1-T9 tasks already landed on feat/dashboard-zh-cn-pr base:\n- T1: RunningIssue liveness fields in snapshot.go\n- T2: lastActivityAt/lastHeartbeatAt tracking in orchestrator_runtime.go\n- T3: diffStat probe in snapshot.go\n- T4: readIterationProgress from .omx/state/run-state.json\n- T5: SSE heartbea\n[…]\nonent with eviction + useSSE queue channel\n- T9: AgentLogs filters team/stalled and queue-channel events\n\nArchive moves change to openspec/changes/archive/ and promotes\ndelta specs to openspec/specs/.",
          "is_bot": false,
          "headline": "docs(openspec): archive improve-dashboard-liveness change",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:26:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "145424cf452228ab3566206933915e2891e57e43",
          "body": "All 7 tasks (T1-T7) implemented and verified. Archived to\nopenspec/changes/archive/2026-05-08-surface-task-phase-and-eta/.",
          "is_bot": false,
          "headline": "docs(openspec): archive surface-task-phase-and-eta",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:20:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7087d38ccfc5de3b3d47736b480926902fa56cdd",
          "body": "T6: Replace bare phase_label cell with StagePill component — 5-step\nhorizontal pill (filled-past / active / outline-future boxes) with\nlocalized stage name above. Falls back to phase_label when agent_stage\nis empty. Bilingual stage labels: 探索/编辑/测试/复核/收尾.\n\nT7: Add \"Done by\" column after Diff. Render\n[…]\nsed ≥ 60s, dash otherwise. Never shows a countdown.\n\nAlso: add agent_stage/agent_stage_step/eta_completion_at/eta_confidence\nto RunningEntry in types.ts; add i18n keys (stages, doneBy, elapsedNormal).",
          "is_bot": false,
          "headline": "feat(dashboard): render stage pill + Done-by cell in SessionsTable",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:20:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "05dd4960ea660af435ef3bb0d7530df76e2f3e1d",
          "body": "T5: Table-driven tests covering all five classifier rules, monotonic\nclamp, ETA confidence bands (low-early, low-quiet, medium, high),\nstage propagation across ticks, and state cleanup on run release.",
          "is_bot": false,
          "headline": "test(orchestrator): add producer-side tests for stage classifier + ETA",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:20:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b0dbb5452ca8bbd8590283e9cd659ab4665915f3",
          "body": "T1: Add 4 additive wire-format fields to RunningEntry in snapshot.go:\n  AgentStage, AgentStageStep, ETACompletionAt (omitempty), ETAConfidence (omitempty).\n\nT2: Implement classifyAgentStage with agentStageState struct.\n  Five named stages (Exploration/Editing/Testing/Reviewing/Wrapping),\n  monotonic\n[…]\nmedium/high). Returns empty rfc3339 when confidence is low.\n\nT4: Wire stage+ETA into Snapshot() loop. Per-run agentStageState\n  embedded in runEntry; cleaned up automatically on delete(o.running, id).",
          "is_bot": false,
          "headline": "feat(types,orchestrator): add task phase + ETA fields to RunningEntry",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:20:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6b0e909f046b55a073f3165f9dae92ab08281835",
          "body": "All 11 spec tasks were already satisfied on the base branch\n(feat/dashboard-zh-cn-pr) via the gate-claims-on-blocked-by sibling:\n- releaseBlockedRunning() added to orchestrator.go\n- buildOpenIDSet() + unresolvedBlockers() helpers present\n- Called after dispatchUnclaimedIssues in runCycle\n- 4 table-d\n[…]\nAndReverts, NoBlockedByLeavesRunning,\n  DoneBlockerLeavesRunning, UpdateStateFailureLogged\n- Race-detector clean (go test -race, 10.682s)\n\nSpec archived as 2026-05-08-orchestrator-revalidate-blockers.",
          "is_bot": false,
          "headline": "docs(openspec): archive orchestrator-revalidate-blockers",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:13:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bacc9c43b49047c0c7c21135cd1283f7b99c4be3",
          "body": "All 9 tasks completed (T1.1, T1.2, T2.1, T3.1–T3.4, T4.1, T4.2).\nSpec promoted to openspec/specs/orphan-claim-recovery/spec.md.",
          "is_bot": false,
          "headline": "docs(openspec): archive orchestrator-orphan-recovery",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:07:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea4e95ff9fe252cf5b8c54b66f8b0532dd8c6490",
          "body": "Add TestRecoverOrphanedClaims_LoggedOncePerRestart to verify that\ncalling recoverOrphanedClaims twice for the same orphaned issue (as\nhappens when dispatch is deferred by max-concurrency) logs\norphan_claim_recovered exactly once, while still overriding the issue\nstate to Unclaimed on both ticks.",
          "is_bot": false,
          "headline": "test(orchestrator): cover orphan_claim_recovered log-dedup across ticks",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:06:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8760876b500ef840e4610d0d2f4a4054abde551",
          "body": "…ce per restart\n\nTrack a recoveredSet map on the Orchestrator struct (cleared on startup,\nnever reset during the process lifetime) so that orphan_claim_recovered\nis emitted at most once per issue per orchestrator restart. The state\noverride (Claimed → Unclaimed) still fires on every tick until the issue\nis dispatched, satisfying the spec requirement that recovery fires every\ntick until dispatch succeeds.",
          "is_bot": false,
          "headline": "feat(orchestrator): add recoveredSet to log orphan_claim_recovered on…",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:06:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "708cc6881499d76ae250249309491189903dfcaf",
          "body": null,
          "is_bot": false,
          "headline": "docs(openspec): archive verify-success-with-diff",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:01:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7512113d4c3e09899a497e5e0ea4a4f535bf0e84",
          "body": "Add TestSuccessGate_HollowRunReroutesToBackoff, the T5 integration\ntest for the verify-success-with-diff spec. Two table-driven scenarios:\n- hollow success rejected: workspace branch HEAD stays at claim SHA,\n  verifier blocks Released transition (asserts Released==0, no backoff).\n- real success proc\n[…]\nnner emits Succeeded,\n  Released transition occurs normally (UpdateIssueStateCount>=1).\n\nUses the existing newGitWorkspaceManager and commitBeforeSuccessRunner\nhelpers. No pre-existing tests modified.",
          "is_bot": false,
          "headline": "feat(orchestrator): cover verify-success-with-diff T5 integration",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T07:01:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3d2c63835393a088d5d88d7984e49cd3c029b3a2",
          "body": "Cover five behaviors: button renders for running entries, absent for\nnon-running, transitions to disabled stopping state on click with\ncorrect POST endpoint, resets on error response, and clears when kind\ntransitions away from running via SSE-driven re-render.",
          "is_bot": false,
          "headline": "test(dashboard): add Stop button tests for IssueDetailSheet",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T06:55:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4a3bf962fb4935533c1da00309a2984b687a5dd9",
          "body": "Extend fetchIssuesQuery with inverseRelations { nodes { type issue { identifier } } }\nand add extractBlockedBy helper that filters for type==\"blocks\" entries.\nnormalizeIssue now sets BlockedBy from this helper instead of hardcoding []string{}.",
          "is_bot": false,
          "headline": "feat(tracker): expose Linear BlockedBy via inverseRelations",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T06:51:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3721567935af96371249893266e3e5939c415826",
          "body": "TestReadOmxMetrics: table-driven tests for well-formed, missing, corrupt,\nand unknown-fields cases. TestMonitorProcess_EmitsSessionUsageOnMetricsChange:\nverifies first-write fires, same-totals suppresses, increased-totals fires.",
          "is_bot": false,
          "headline": "test(agent): cover OmxMetrics and session.usage emission semantics",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T06:49:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "93fa3ea6af42babe3e7fb5c90e038da8b7d9c73b",
          "body": "Add OmxMetrics struct, readOmxMetrics helper, and throttled emission\nlogic in monitorProcess poll loop. Reads <workspace>/.omx/metrics.json\nevery poll cycle and emits session.usage only when cumulative token\ntotals strictly increase. Missing file returns (nil, nil) so non-omx\nrunners are unaffected. No changes to orchestrator, hub, or frontend.",
          "is_bot": false,
          "headline": "feat(agent): surface omx token usage metrics via session.usage event",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T06:48:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8ea0257f42d26c7174984872186dc85583f0236f",
          "body": "T1–T7.2 landed via 559b75f. T7.3 `go test ./...` confirmed green\non cb7cc62 (full suite + dashboard bun test 53/53).\n\nSync delta specs (linear-comment-sync, linear-issue-detail,\nworkflow-timeline) merged into top-level openspec/specs/.",
          "is_bot": false,
          "headline": "docs(openspec): archive sync-linear-workflow-timeline",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T06:42:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b79e87922d0a29ec4fca5100c50ff610c5dcf68",
          "body": "T1–T8 landed across the codex app-server hardening commit series\n(ae8fb0f → 10a8ffb). Verifier confirmed all 18 codex tests pass.\n\nDelta spec codex-runner-protocol synced to openspec/specs/.",
          "is_bot": false,
          "headline": "docs(openspec): archive fix-codex-app-server",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T06:38:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "da6890152e04bde0c6876424c84370597d632b70",
          "body": "T1+T2+T3 landed via 751e6fd, b4b672a, ce442c8 with the e2e regression\nfix in cb7cc62. Verifier confirmed all orchestrator and workspace\ntests pass under -race.",
          "is_bot": false,
          "headline": "docs(openspec): archive harden-verify-success-gate",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T06:37:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb7cc62fbeabf1f8f9d825bc4fde096472936e0b",
          "body": "After harden-verify-success-gate T2 (b4b672a), workspace.Manager.Create\nprovisions real git worktrees, so the e2e helper's plain temp dir is no\nlonger a valid base. Initialize a git repo with an initial commit in\nnewTeamTestWorkspaceManager and drop the now-harmful pre-MkdirAll loop\n(Manager handles workspace dir provisioning itself).\n\nRestores TestTeamPipelineFullCycle, TestTeamPipelineContextCancellation,\nand TestTeamPipelineAgentFailure.",
          "is_bot": false,
          "headline": "fix(test/e2e): init git in workspace test helper",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T06:34:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "67476d66540fe08f18a4b51d3cc85c3a5439ae4a",
          "body": "…pshot\n\nOperators previously had no way to confirm which binary was actually\nserving traffic without shelling in and running `--version`. Surface\nthe ldflags-injected build metadata through the existing /api/v1/state\nSSE feed and render it as a small commit chip in the dashboard header.\n\nBackend:\n- \n[…]\nses for `--version`.\n\nFrontend:\n- types.ts adds optional build_info on StateSnapshot.\n- AppLayout header renders `<version>@<commit>` next to the queue\n  count, with build date in the title attribute.",
          "is_bot": false,
          "headline": "feat(dashboard): expose build info (version/commit/date) in state sna…",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-08T03:33:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "559b75f5d1d1c762c774f556f5820e7609e4d265",
          "body": "Replace the OMX runtime checkpoint stack with one semantic changeset that carries the Linear workflow timeline, dashboard issue detail surface, stop-agent controls, and supporting OpenSpec documents. The local timeline remains canonical while Linear comment sync is an opt-in projection, so dashboard\n[…]\ne2e git-worktree tests.\n\nConfidence: High for targeted Linear timeline/dashboard scope; full-suite residual failures are documented outside this change path.\n\nCo-authored-by: OmX <omx@oh-my-codex.dev>",
          "is_bot": false,
          "headline": "feat(project): ship dashboard workflow timeline sync",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T22:03:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f453e6f3426e0861c33b2ace1b8dbd65dec9a5fe",
          "body": "The hardening workflow template set `codex.binary_path: codex`\n(bare top-level CLI), which made `internal/agent.CodexRunner`\nspawn `codex` directly. Codex 0.128's top-level CLI enters an\ninteractive REPL that requires a TTY, so it failed immediately\nwith \"Error: stdin is not a terminal\" against cont\n[…]\ntocol the runner speaks\nlives behind that subcommand. Aligning the template with the\ndefault makes the hardening workflow runnable out of the box and\nmatches what the production workflow already uses.",
          "is_bot": false,
          "headline": "fix(testdata): use codex app-server in hardening workflow",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T15:37:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2910336017b5076c37a6b36cd8e0dd494dffe113",
          "body": null,
          "is_bot": false,
          "headline": "docs(openspec): mark harden-verify-success-gate T1+T2+T3 landed",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T06:55:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ce442c86814306264d2d7cfa3303f1dd903045c8",
          "body": "Implements T3 of harden-verify-success-gate. Adds four\nintegration / unit tests pinning the contracts established by T1\nand T2:\n\n- TestVerifyGate_GitErrorRoutesToWorkspaceInvalid (orchestrator):\n  uses a missingBranchWorkspaceManager that seeds a real git repo\n  but never creates issue.BranchName, s\n[…]\ne worktree pointer file. Locks in the\n  tear-down + recreate behavior on top of the new \"verify\n  registered\" check.\n\ngo test -race ./internal/workspace/ ./internal/orchestrator/\npasses; go vet clean.",
          "is_bot": false,
          "headline": "test(orchestrator,workspace): cover harden-verify-success-gate (T3)",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T06:54:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b4b672acc92a781c7597ec98a53017ed889ebeb3",
          "body": "Implements T2 of harden-verify-success-gate. Manager.Create\npreviously called git worktree add with issue.ID (a UUID like\n\"4eef6617-…\") as both the path stem and the branch name. Down-\nstream verify-success-with-diff and dashboard rendering both\nexpect issue.BranchName (\"symphony/zii-65\"), which pro\n[…]\nace tests pass; orchestrator\ntests still pass; the harden-verify-success-gate T1 fix\n(success_unverified_workspace_invalid backoff route) keeps\nworking as the safety net for any future workspace bugs.",
          "is_bot": false,
          "headline": "fix(workspace): create per-issue git worktree on Issue.BranchName (T2)",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T06:47:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "751e6fdfd8e88e41e500fba9bfad2d6cc89b7964",
          "body": "Implements T1 of harden-verify-success-gate. The default fail-open\narm in handleAgentDone's success switch is replaced by three\nexplicit reason-keyed branches:\n\n- \"branch_unchanged\" — unchanged: emit\n  success_unverified_branch_unchanged + enqueueContinuation.\n- \"git_error\" — NEW fail-close: emit\n  \n[…]\naims, so the underlying workspace bug must\neither be fixed (T2) or persist visibly in the retry queue.\n\nT2 (workspace.Manager.Create registering a real worktree) and T3\n(tests) are tracked separately.",
          "is_bot": false,
          "headline": "feat(orchestrator): fail-close on verifyBranchAdvanced git_error (T1)",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T04:47:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab929715ae3b622de80cfd0b40d087b3c4b5501f",
          "body": "Live ZII-65 demo proved verify-success-with-diff's fail-open on\ngit_error (Decision 3 of its design.md) trades real safety for a\nhypothetical legitimacy preserved. Persistent workspace-creation\nbugs surface as `exit status 128` from `git rev-parse`, and the\ngate's fail-open path rubber-stamps every \n[…]\nregister a real worktree; ClaimHeadSha refers to the\n  worktree's HEAD\n- tasks.md (118 lines) — T1 (orchestrator switch-arm), T2 (workspace\n  Create rewrites), T3 (tests), parallel-friendly task graph",
          "is_bot": false,
          "headline": "docs(openspec): add harden-verify-success-gate change",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T04:47:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7cd90db430e120ab97c8e3fb688df7b5f864b9b7",
          "body": "Implements ZII-58 (N1 of the dashboard IDE redesign tracked under\nZII-57). Adds a Sidebar + Main + Sheet layout to replace the\n12-column SessionsTable with a status-aware navigation model.\n\nNew components:\n- AppLayout.tsx — SidebarProvider wrapper that derives the queue\n  groups (Active / Queue / Re\n[…]\n sidebar groups, tabs, or detail-sheet sections in the\nfollow-up sub-tasks (ZII-59 N2 wiring + ZII-60 N3 detail panel).\n\nBuild verified: pnpm run build → 1871 modules, 333 KB JS\n(105 KB gzip), 921 ms.",
          "is_bot": false,
          "headline": "feat(dashboard): N1 IDE-style three-pane skeleton",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T02:58:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "294db738af0cc63bc92c8a431b40391fd20b5c3d",
          "body": "Two distinct fixes consolidated because both correct rendering bugs\nvisible in the running dashboard right now:\n\n1. Per-issue tokens / diff stats / activity timestamps were freezing\n   on the page until manual reload. Root cause: the SSE StatusUpdate\n   event payload only carries top-level Stats (To\n[…]\ntom properties stay defined alongside\n   the new shadcn tokens. Components migrate to shadcn primitives\n   incrementally per ZII-55; once that lands, index.legacy.css can be\n   removed in a follow-up.",
          "is_bot": false,
          "headline": "feat(dashboard): periodic snapshot refresh + restore legacy CSS vars",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T02:53:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "56d863fea05f5c1bd0d8f47a0458d4399ae6711c",
          "body": "Replace \"Contrabass\" with \"Ziikoo\" in three user-visible places:\n- packages/dashboard/index.html — <title>Ziikoo 控制台</title>\n- packages/dashboard/src/components/Header.tsx — <h1>Ziikoo</h1>\n- packages/dashboard/src/i18n/messages.ts — mascotAlt: 'Ziikoo 吉祥物'\n\nUpdates Header.test.tsx assertion to match.",
          "is_bot": false,
          "headline": "feat(dashboard): rebrand to Ziikoo",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-07T02:52:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "65fd1ffe42c7482de68746d9ea808a43607592b7",
          "body": "Today the dashboard shows started_at and last_activity_at, both of\nwhich answer \"is it alive\" but neither answers \"when can I move\non?\". The naive answers — a shrinking remaining-time number or a\npercent progress bar — both regress under codex's high run-to-run\nvariance: ZII-45 took 2 min, ZII-44 to\n[…]\n6/T7\n                            in parallel after T5)\n\nOut of scope: cross-run reference-class forecasting (deferred\nuntil ~20 completed runs are persisted) and stage detection for\nnon-codex runners.",
          "is_bot": false,
          "headline": "docs(openspec): add surface-task-phase-and-eta change",
          "author_name": "blueyang",
          "author_login": "vmxmy",
          "committed_at": "2026-05-06T22:18:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 10,
      "commits_last_year": 528,
      "latest_release_at": "2026-07-16T12:36:39Z",
      "latest_release_tag": "v0.5.1",
      "releases_from_tags": false,
      "days_since_last_push": 9,
      "active_weeks_last_year": 10,
      "days_since_latest_release": 10,
      "mean_days_between_releases": 14.5
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 57,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/junhoyeo/contrabass",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/junhoyeo/contrabass",
          "is_deprecated": false,
          "latest_version": "v0.5.1",
          "repository_url": "https://github.com/junhoyeo/contrabass",
          "versions_count": 11,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-16T12:32:28Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 10
        }
      ]
    },
    "popularity": {
      "forks": 24,
      "stars": 204,
      "watchers": 2,
      "fork_history": {
        "days": [
          {
            "date": "2026-03-07",
            "count": 2
          },
          {
            "date": "2026-03-08",
            "count": 1
          },
          {
            "date": "2026-03-14",
            "count": 1
          },
          {
            "date": "2026-04-06",
            "count": 1
          },
          {
            "date": "2026-04-19",
            "count": 1
          },
          {
            "date": "2026-04-27",
            "count": 1
          },
          {
            "date": "2026-04-28",
            "count": 2
          },
          {
            "date": "2026-05-01",
            "count": 1
          },
          {
            "date": "2026-05-06",
            "count": 2
          },
          {
            "date": "2026-05-12",
            "count": 1
          },
          {
            "date": "2026-05-13",
            "count": 1
          },
          {
            "date": "2026-05-20",
            "count": 1
          },
          {
            "date": "2026-05-23",
            "count": 1
          },
          {
            "date": "2026-05-29",
            "count": 1
          },
          {
            "date": "2026-06-10",
            "count": 1
          },
          {
            "date": "2026-06-14",
            "count": 1
          },
          {
            "date": "2026-06-15",
            "count": 1
          },
          {
            "date": "2026-06-28",
            "count": 1
          },
          {
            "date": "2026-07-21",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 22,
        "total_forks": 24
      },
      "star_history": null,
      "open_issues_and_prs": 2
    },
    "ai_readiness": {
      "has_nix": true,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "packages/dashboard/tsconfig.json",
        "packages/landing/tsconfig.json"
      ],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 76784,
      "source_files_sampled": 242,
      "oversized_source_files": 1,
      "agent_instruction_files": [
        "AGENTS.md"
      ],
      "agent_instruction_max_bytes": 11092
    },
    "dependencies": {
      "manifests": [
        "go.mod",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "charm.land/bubbles/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.0"
        },
        {
          "name": "charm.land/bubbletea/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.1"
        },
        {
          "name": "charm.land/lipgloss/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.0"
        },
        {
          "name": "github.com/BourgeoisBear/rasterm",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.2"
        },
        {
          "name": "github.com/charmbracelet/log",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.2"
        },
        {
          "name": "github.com/charmbracelet/x/mosaic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260304213900-0e78e2954235"
        },
        {
          "name": "github.com/fsnotify/fsnotify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.0"
        },
        {
          "name": "github.com/osteele/liquid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.1"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.1"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.19.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 43,
        "open_issues": 2,
        "closed_ratio": 0.6,
        "closed_issues": 3,
        "closed_unmerged_prs": 5
      },
      "bus_factor": 1,
      "bot_contributors": 3,
      "top_contributors": [
        {
          "type": "User",
          "login": "junhoyeo",
          "commits": 403,
          "avatar_url": "https://avatars.githubusercontent.com/u/32605822?v=4"
        },
        {
          "type": "User",
          "login": "vmxmy",
          "commits": 101,
          "avatar_url": "https://avatars.githubusercontent.com/u/8231405?v=4"
        },
        {
          "type": "User",
          "login": "Yeachan-Heo",
          "commits": 9,
          "avatar_url": "https://avatars.githubusercontent.com/u/54757707?v=4"
        },
        {
          "type": "User",
          "login": "timur-z-ya-ru",
          "commits": 5,
          "avatar_url": "https://avatars.githubusercontent.com/u/240998397?v=4"
        },
        {
          "type": "User",
          "login": "tanvesh01",
          "commits": 2,
          "avatar_url": "https://avatars.githubusercontent.com/u/52021185?v=4"
        },
        {
          "type": "User",
          "login": "zvictor",
          "commits": 2,
          "avatar_url": "https://avatars.githubusercontent.com/u/181076?v=4"
        },
        {
          "type": "User",
          "login": "ImgBotApp",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/31427850?v=4"
        }
      ],
      "contributors_sampled": 7,
      "top_contributor_share": 0.771
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "gofmt_autofix.yml",
        "nix.yml",
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "8 out of 8 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/8 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 5 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 0,
            "reason": "dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "71 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "5fc728b15949d38ac8f78c8d97dc8b8a46a3a5d4",
        "ran_at": "2026-07-26T22:34:10Z",
        "aggregate_score": 2.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-17T05:06:36Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-17T05:04:57Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 39,
          "created_at": "2026-05-31T00:23:42Z",
          "last_comment_at": "2026-07-22T07:25:06Z",
          "last_comment_author": "Keesan12"
        },
        {
          "number": 40,
          "created_at": "2026-05-31T01:15:11Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/junhoyeo/contrabass",
    "host": "github.com",
    "name": "contrabass",
    "owner": "junhoyeo"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 63,
      "inputs": {
        "security": 26,
        "vitality": 74,
        "community": 59,
        "governance": 64,
        "engineering": 81
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 74,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 64,
            "inputs": {
              "commits_last_year": 528,
              "human_commit_share": 1,
              "days_since_last_push": 9,
              "active_weeks_last_year": 10
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 9 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "10/52 weeks with commits",
                "points": 6.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 10
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "528 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 528
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 10,
              "latest_release_tag": "v0.5.1",
              "releases_from_tags": false,
              "days_since_latest_release": 10,
              "mean_days_between_releases": 14.5
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "10 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 10 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 10
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~14.5 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 14.5
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 59,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 49,
            "inputs": {
              "forks": 24,
              "stars": 204,
              "watchers": 2,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "204 stars",
                "points": 37.4,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 204
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "24 forks",
                "points": 11.3,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 24
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "2 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 64,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "at_risk",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 34,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 7,
              "top_contributor_share": 0.771
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 77% of commits",
                "points": 5.2,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 77
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "7 contributors",
                "points": 9.5,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 7
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 5 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "merged_prs": 43,
              "open_issues": 2,
              "closed_issues": 3,
              "issue_closed_ratio": 0.6,
              "closed_unmerged_prs": 5
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "60% of issues closed",
                "points": 28.1,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 60
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "43/48 decided PRs merged",
                "points": 34.3,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 43,
                      "decided": 48
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/8 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 73,
            "inputs": {
              "followers": 1608,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "junhoyeo",
              "public_repos": 401,
              "account_age_days": 3213
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1,608 followers of junhoyeo",
                "points": 23.1,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1608,
                      "login": "junhoyeo"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "401 public repos, account ~8 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 401
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 8
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/junhoyeo/contrabass"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 10
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 10 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 10
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "11 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 81,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "8 out of 8 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "ai-agent",
                "bubbletea",
                "bubbletea-tui",
                "coding-agent",
                "golang",
                "harness",
                "openai",
                "symphony",
                "tui"
              ],
              "has_wiki": true,
              "homepage": "https://contrabass.dev",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://contrabass.dev",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "9 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "critical",
        "name": "Security",
        "value": 26,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 26,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 2.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "8 out of 8 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/8 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 5 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "dangerous workflow patterns detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "71 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 7
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 76,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.98,
              "agent_instruction_files": [
                "AGENTS.md"
              ],
              "agent_instruction_max_bytes": 11092
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "98 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 98,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "has_nix": true,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "packages/dashboard/tsconfig.json",
                "packages/landing/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "packages/dashboard/tsconfig.json, packages/landing/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "packages/dashboard/tsconfig.json, packages/landing/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Nix, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Nix, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 76784,
              "source_files_sampled": 242,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/242 source files over 60KB",
                "points": 54.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 242,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-26T22:34:29.512164Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/junhoyeo/contrabass.svg",
  "full_name": "junhoyeo/contrabass",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}

评分是信号,而非担保。 评分反映的是 GitHub 上公开可见的实践——不是代码审计,也不是安全保证。

缺失数据将被剔除并重新归一化权重,绝不按零分计。方法论已版本化并公开:指标 v1.13.0、模式 v0.27.0—— 完整方法论 · 指标知识库.

单项结果在整体记录中的位置: 汇总统计Go.