kenn-io / kit

每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。

来自 GitHub 依赖图的完整解析依赖集合：27 个直接依赖与 64 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 91 个包，其中也包含从不交付的开发与测试版本固定：3 个存在已知公告，2 个为直接依赖。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 616,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Go": 2260742
      },
      "pushed_at": "2026-07-24T00:35:32Z",
      "created_at": "2026-05-13T18:03:16Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-24T00:34:13Z",
      "description": "general purpose shared toolkit library",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://kenn.io",
      "name": "Kenn Software",
      "type": "Organization",
      "login": "kenn-io",
      "company": null,
      "location": null,
      "followers": 133,
      "avatar_url": "https://avatars.githubusercontent.com/u/259885253?v=4",
      "created_at": "2026-02-06T14:36:48Z",
      "is_verified": null,
      "public_repos": 12,
      "account_age_days": 167
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2026-07-24T00:35:33Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2026-07-21T00:55:46Z"
        },
        {
          "tag": "v0.10.1",
          "kind": "patch",
          "published_at": "2026-07-20T16:18:33Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2026-07-15T19:36:21Z"
        },
        {
          "tag": "v0.9.3",
          "kind": "patch",
          "published_at": "2026-07-14T19:28:07Z"
        },
        {
          "tag": "v0.9.2",
          "kind": "patch",
          "published_at": "2026-07-13T16:53:30Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2026-07-13T11:59:09Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-07-13T04:09:32Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2026-07-12T20:20:08Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-07-11T23:14:23Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-07-11T13:04:54Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-07-10T12:30:51Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-07-07T22:40:01Z"
        },
        {
          "tag": "v0.2.1",
          "kind": "patch",
          "published_at": "2026-07-07T15:21:17Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-07-04T22:27:28Z"
        },
        {
          "tag": "v0.1.6",
          "kind": "patch",
          "published_at": "2026-06-12T20:37:41Z"
        },
        {
          "tag": "v0.1.5",
          "kind": "patch",
          "published_at": "2026-06-10T17:26:45Z"
        },
        {
          "tag": "v0.1.4",
          "kind": "patch",
          "published_at": "2026-06-06T03:33:40Z"
        },
        {
          "tag": "v0.1.3",
          "kind": "patch",
          "published_at": "2026-06-04T20:34:56Z"
        },
        {
          "tag": "v0.1.2",
          "kind": "patch",
          "published_at": "2026-06-02T13:05:58Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2026-06-02T00:39:06Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-06-01T13:14:38Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "b37e8deadfb1b588350ae720535030fc10b961a2",
          "body": "## Summary\n\nThis extracts Middleman's production worktree lifecycle into Kit so KWT and Middleman can share one implementation.\n\nThe new `git/managed` package covers the reusable mechanics for creating, importing, tracking, rolling back, and removing managed worktrees. Product-specific policy stays \n[…]\ne managed Git package tests\n- Focused KWT pull-request integration tests\n- Focused Middleman worktree and merge-request integration tests\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add managed Git worktree lifecycle (#53)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-24T00:34:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f72f014c5f8666b6388a01abfbe73af181acc257",
          "body": "A positive Fill `BatchSize` currently applies separately to every document, so pages of short documents still produce one encoder request per document and never fill the configured batches.\n\nThis change packs chunks across document boundaries within each scan page, then scatters vectors back to thei\n[…]\nindow before starting another, while concurrent fills can still save completed documents without waiting for an unrelated slow batch.\n\n\nCo-authored-by: David Riordan <riordan@users.noreply.github.com>",
          "is_bot": false,
          "headline": "vector: batch Fill chunks across documents (#52)",
          "author_name": "David Riordan",
          "author_login": "riordan",
          "committed_at": "2026-07-21T20:15:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "34e4de4f13d663d3b954db412a7020d4f09a1f39",
          "body": "Adds opt-in zstd compression for large loose CAS objects while preserving SHA-256 identity over decoded bytes and the existing raw object layout. The zero value remains raw-only and backward compatible.\n\n### Storage contract\n\n- Reads transparently support raw and compressed objects through streaming\n[…]\ne amplification for compression-eligible objects: writes stage logical and compressed forms before publishing the selected representation.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat(packstore): add compressed loose object storage (#49)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-21T00:51:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "776fb26173e217bad1d1527cb246211c403c2d84",
          "body": "The `WithBasicAuth` doc comment overstated the privacy of the credential\nresponse file relative to the process environment. It now just describes\nthe helper and the file's lifecycle. Comment-only change.",
          "is_bot": false,
          "headline": "Neutralize WithBasicAuth credential file doc (#51)",
          "author_name": "Phillip Cloud",
          "author_login": "cpcloud",
          "committed_at": "2026-07-20T16:17:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bf9eeebcd1b3737bc32667d00a03fc5e4ce6816b",
          "body": "Authenticated Git operations currently materialize credentials as one-shot executable shell scripts. On systems that assess new executables, Git-heavy automation pays for a new security scan on every invocation even though each helper exists for only one command.\n\nThis keeps credential values in an \n[…]\nal credential exchanges produced no XProtect scan entries for either the retired executable-helper prefix or the new response-file prefix.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Avoid endpoint scans for Git credential helpers (#50)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-20T15:50:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4bc3c2dc83552403eb874452417495f1629b62f",
          "body": "Embedded applications may choose a SQLite implementation for portability or deployment constraints, but Kit currently reopens databases through its built-in driver during capture and restore. That makes the recovery lifecycle inconsistent with the application's live database backend and can turn an \n[…]\nhe current mattn default; callers that opt in keep frozen capture, immutable restore proof, and packed-catalog publication on one backend.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Allow applications to select backup SQLite (#48)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-15T13:55:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "64573903f914e63b25a92061ba2bb69e6f15e85f",
          "body": "Embedding endpoints can return output with the right shape that is still\nunusable for cosine distance: NaN or infinite components, or an all-zero\nvector. Nothing in the pipeline caught these, so `Fill` would stamp them\ninto a `Store` as complete work — and a stamped invalid vector looks\ndone forever\n[…]\na JSON `null`, so decode-boundary rejection has to live in\neach provider client.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Reject non-finite and zero-norm vectors in EncodeBatched (#47)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-07-14T19:26:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "be9060bdc700af2b3413e8d6383e48932cf96702",
          "body": "Applications cannot safely reserve a restore pathname before Kit opens it: a rename or symlink swap can leave application locking attached to one directory while Kit publishes into another. Missing targets have the same hazard if recursive creation resolves a replaced ancestor before the final root \n[…]\ncquiring the lease. A caller that waited for ownership therefore cannot overwrite content populated by the previous coordinated operation.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Coordinate restore against the pinned target (#46)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-13T16:51:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "19dfc35856362a8f42ec2eb6de6a0b357631cc74",
          "body": "Restore already verifies every content blob by SHA-256 and every database page against the snapshot map, while SQLite's full integrity scan can dominate large restores without providing equivalent corruption coverage. Applications need a way to retain those cryptographic checks and manifest-statisti\n[…]\nfile work appear stalled.\\n\\nThe backup package suite, full Go suite, and changed-code lint checks pass on Windows ARM64 with CGO enabled.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Make restore integrity checks optional (#45)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-13T11:57:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d673c4fd90f78966546fa632ca1d09dc1143a3f0",
          "body": "Valid format-v1 packs written by earlier encoders can contain multi-segment zstd frames whose declared window exceeds the decoded blob size. Kit used the decoded length as the decoder window and memory ceiling during import verification and buffered maintenance reads, causing otherwise valid packed \n[…]\nsized-window rejection.\n\nThis restores backward compatibility for existing packs while preserving bounded memory and typed limit failures.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Accept legacy zstd windows during pack reads (#44)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-13T04:06:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "be5fdc0c4214d8bcf4f332fa63735f568c346f28",
          "body": "Applications with stable logical metadata should not have to preserve every historical runtime database schema merely to restore an archive. Kit’s SQLite page snapshots remain valuable for byte-exact capture, but making them the only metadata authority forces archive compatibility and schema migrati\n[…]\nises capture, quick and full verification, failed and successful restore, overwrite safety, content recovery, and a later SQLite keyframe.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Support portable backup metadata (#43)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-13T04:03:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fd6e32ed32357c99885401af5786a561c943f9a3",
          "body": "Applications can legitimately retain authorized loose objects above Kit's default packing ceiling. The legacy seekable read path continued serving them, but adopting `OpenStream` applied `BlobBytes` to loose files and could make previously readable content unavailable even though loose verification \n[…]\nthe packstore benchmark observe stream closure, ensuring its successful measurements include terminal verification and descriptor release.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Preserve oversized loose streaming compatibility (#42)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-12T20:14:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6f8bb23acdabc02112f187e9760526ec91852352",
          "body": "The bounded-memory streaming engine is now complete, but its safety depends on application-owned catalog transactions, publication ordering, resource policy, and terminal verification. Those obligations should be usable without reconstructing them from implementation details.\n\nThis PR establishes th\n[…]\nmit is tagged. This keeps downstream compatibility evidence separate from public Kit artifacts while making it a real release requirement.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Document safe streaming packstore adoption (#41)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-12T19:35:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "73351498997875f2977cbe567bf2c13e452fe7eb",
          "body": "The streaming stack now crosses pack encoding, mixed reads, maintenance, and backup, but its guarantees were distributed across implementation tests and one-time measurements. Before applications can safely reconsider object-size policy, Kit needs permanent evidence that cross-layer authority orderi\n[…]\nnd historical performance ingestion remain external concerns, while Kit owns only reproducible Go workloads and generic regression policy.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Gate streaming compatibility and performance (#40)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-12T18:50:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "40c9305cd3a076b997502172562679eb11a1f527",
          "body": "Large attachment and extras workflows still buffered complete objects during capture, verification, and loose restore, even after pack I/O gained verified streaming. That kept operational memory proportional to object size and made parallel work multiply the pressure.\n\nUse bounded preparation scratc\n[…]\ntain whole-frame authentication rather than exposing unauthenticated prefixes. The repository format and manifest proofs remain unchanged.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Stream backup content with bounded memory (#39)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-12T15:50:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e699e22bc3c777f9d452f524eb0ff70f8315b4c5",
          "body": "Packstore consumers can now stream verified content, but maintenance still decoded complete objects into memory before packing, repacking, or restoring loose authority. That left the former 64 MiB ceiling embedded in lifecycle mechanics even when application policy allowed a larger object.\n\nThis cha\n[…]\n establishes a stable workload for future PR gating and external longitudinal measurement without introducing benchmark-service coupling.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Stream packstore maintenance with bounded memory (#38)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-12T15:15:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6e49e0782362f583a73505f06854508f8564acd6",
          "body": "Large plain pack entries currently require complete raw and stored byte slices, tying heap use to object size and making the 64 MiB maintenance ceiling a technical constraint. Simply returning a decoder would be unsafe: consumers may receive a prefix before CRC, length, and SHA-256 verification fini\n[…]\ne document records these durable contracts and their crash-ordering consequences without carrying issue workflow or verification history.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Stream verified pack I/O with bounded memory (#36)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-12T14:19:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "14828d60941639ec9ca71f2d725f7a4b466c2096",
          "body": "Windows can assign an elevated-created private directory to the built-in Administrators group. A later non-elevated process can then be rejected even when the protected DACL grants access only to the same trusted principals, making the ownership policy stricter than the existing DACL policy.\n\nAlign \n[…]\nnged.\n\nThis keeps hardened directory validation consistent across elevated and non-elevated processes without weakening the file boundary.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Accept trusted Windows private-directory owners (#37)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-12T13:54:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4913c434419077632afe2365149c2dfcdc71f09",
          "body": "This repository now uses kata as its shared issue ledger, but agents had no repo-local contract explaining how to discover and maintain that state. Without that guidance, sessions can create duplicate issues, close unverified work, or leave orchestration attention metadata stale.\n\nAdd the managed ka\n[…]\ncan trust work.* signals. Keeping the block owned by kata init also makes future guidance updates reproducible instead of hand-maintained.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add kata agent workflow guidance (#35)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-12T01:54:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "021c246c6cc909dec27390ac22b4d29972e18203",
          "body": "Restore compatible repository packs directly into an optional application-owned packed-content target while preserving loose fallback for incompatible containers, entries, encodings, or filesystems. Whole-pack and selected-entry verification stays bounded, and callers that do not provide a packed ta\n[…]\nrwrite target's visible database intact on prepublication failure and makes retry and crash-orphan behavior explicit on Unix and Windows.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Restore verified content packs without loose-file fanout (#34)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-11T23:11:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c5b571356fa448becc0e698f9d4f0eeee4579386",
          "body": "Sealed content-addressed packs materially improve archive behavior, especially on Windows, but the physical lifecycle should not be tied to one application schema. This change establishes an application-neutral catalog boundary in Kit and moves loose publication, mixed reads, repair, packing, unpack\n[…]\nead modes.\n\nRepository guidance requires explicit user authorization before an agent requests a Roborev review or invokes a Roborev skill.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Extract reusable packed CAS storage (#33)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-11T13:03:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fc05aad51a521a343883c38164bcc61854db11c0",
          "body": "## Why\n\nKenn tools currently have to recreate OpenTelemetry provider, exporter, propagation, and shutdown wiring in each application. That makes standard environment-driven configuration harder to adopt consistently and leaves lifecycle/error handling up to every caller.\n\nThe standard `autoexport` f\n[…]\nin `git/cmd` and `vector/sqlitevec`; this change introduces no telemetry lint findings.\n\n<sup>generated by a clanker</sup>\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add environment-driven OpenTelemetry initialization (#32)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-07-10T11:36:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "857441fc9ca241efe64c92fff8965464d7db01aa",
          "body": "## Why\n\nmsgvault and kata both need to splice modal and positioned panels into already-rendered terminal views. Keeping separate private implementations makes ANSI corruption, wide-grapheme bugs, and inconsistent offscreen behavior likely as the callers evolve. Pulling in Bubble Tea or lipgloss at t\n[…]\ned golangci-lint, testify-helper, and nilaway checks passed\n- Module checksums verified\n\n<sup>generated by a clanker</sup>\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add ANSI-aware terminal screen overlays (#31)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-07-09T22:53:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8b786ab6a9b6bbe7e1efb1372da84c72c2c7bfa1",
          "body": "* Extract shared help footer reflow\n\nRoborev and kata currently maintain copies of the same footer packing algorithm. That duplication risks behavior drift, while directly sharing either implementation would couple callers to incompatible Charm major versions.\n\nProvide the primitive under kit's tui \n[…]\nwidth rules.\n\nGenerated with Codex\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>\n\n---------\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Extract shared help footer reflow (#29)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-07-09T22:36:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bff812f5831be17b3b1f3ba8a9a0252e8085facd",
          "body": "Terminal-facing content from agents, messages, and reviews is rendered by several Kenn tools, but each tool currently carries its own escape sanitization and display-width logic. Those copies have already diverged around control characters, ANSI preservation, invalid UTF-8, and wide graphemes, which\n[…]\n 2 skipped)\n- focused race, lint, testify-helper, and nilaway checks for `tui/termtext`\n\n<sup>generated by a clanker</sup>\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "tui: extract terminal text helpers (#30)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-07-09T21:21:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f5702fce9367e1a6ad08eeff9427998da3a28969",
          "body": "* backup: add ContentSource hook for capture reads\n\n* backup: fix data race in ContentSource test fixture\n\nThe mapSource test fixture's opens counter was incremented from concurrent\ncapture workers without synchronization, causing race detector failures in\nTestCaptureAttachmentsFromSource and TestCa\n[…]\nurce end to end.\n\n* backup: document ContentSource capture semantics\n\n* backup: document ContentSource ctx and size-accuracy contract\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "backup: optional ContentSource hook for capture reads (#28)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-09T16:06:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d8cd2a459051a4b9c7cdaca21eb2253a349b2e42",
          "body": "Adds two packages extracted from msgvault's backup subsystem, generalized for reuse:\n\n- **`pack`** — content-addressed blob container format: sealed-immutable pack files with optional zstd compression, XChaCha20-Poly1305 encryption, and CRC32C-checksummed footers. Blobs are verified by content hash \n[…]\n writing, and pack reading bounds all untrusted lengths before allocation.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add pack and backup packages (#26)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-07T22:38:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9477d249370c15ddd1765290b415771d0d119914",
          "body": "## Summary\n\nTwo independent fixes that make the vector package usable at ~100k-document scale. Found while building and querying a real 116k-chunk, 2560-dim generation.\n\n**1. `Fill` document-level concurrency (`vector/flow.go`)**\n\n`Fill` encoded one document at a time: each scan page walked its docu\n[…]\nrialization or join order regresses (verified: fails against the old SQL).\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "vector: Fill concurrency and sqlitevec KNN join-order fix (#27)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-07-07T13:49:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "871b76058334a0b9e5d2c48c23aa6f7d96b67530",
          "body": "Vector encoding queues were previously only available inside msgvault, which made the crash-safe claim/release/complete mechanics hard to reuse in other Kenn tools. This PR moves that SQL-backed task queue into kit as an app-neutral helper while keeping schema ownership with callers.\n\nThe queue vali\n[…]\n_embeddings table shape as the default schema.\n\nValidation: go test ./...; go vet ./...\n\n<sup>generated by a clanker</sup>\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Extract vector encoding queue (#25)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-07-04T22:25:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "60b0dab773764acffbcc93cb538a872d6c55b058",
          "body": "* Bound safe.directory git probes\n\n* Fix safe-directory probe regression test PATH",
          "is_bot": false,
          "headline": "Bound safe.directory git probes (#24)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-06-23T02:32:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d685a8742c0cbd7e1546fb43f40bdb632833467b",
          "body": "## Summary\n\n- Move selfupdate release discovery away from unauthenticated `api.github.com` as the default path by following the GitHub web `/releases/latest` redirect and constructing conventional release asset URLs.\n- Add optional static `ReleaseManifestURL` support; a manifest can be as small as `\n[…]\n` and `go run ./cmd/testify-helper-check ./...` currently report pre-existing issues in `git/cmd`; the selfupdate-scoped lint checks pass.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Make selfupdate avoid GitHub API rate limits (#22)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-06-16T00:22:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a81635f3ee3a34fd0b853fac027eba273e7d672a",
          "body": "## Summary\n\n- switch Windows daemon `StartDetached` back to `DETACHED_PROCESS` so daemon startup does not expose `CONIN$` to terminal probes\n- move `CREATE_NO_WINDOW` to non-interactive `git/cmd` subprocess creation, including safe-directory config probes\n- add Windows regression tests for daemon co\n[…]\navior at the known non-interactive git spawn sites instead.\n\nFixes #19.\n\n## Validation\n\n- `go test ./...`\n- `go vet ./...`\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "[codex] Fix Windows daemon console probe hang (#20)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-12T20:36:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4f73c103bf2025f592a00830e64985fd145de6c8",
          "body": "## Summary\n\nFixes #18.\n\n- Route `git/cmd.Runner` process creation through a shared helper.\n- On Windows, set `CREATE_NO_WINDOW` for git child processes so console-less callers do not get visible `git.exe` console windows.\n- Keep non-Windows command construction unchanged.\n- Normalize a couple of Win\n[…]\nual `go.kenn.io/kit/git/cmd.Runner` calls confirmed the unpatched path created visible windows; patched path stayed quiet.\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "[codex] Hide git runner console windows on Windows (#21)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-12T12:20:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f98bb8f52c2e82bdcf7a7590ea22fc46863ff6fa",
          "body": "* Add Renovate dependency updates\n\nRenovate is now the dependency-update path used by roborev, and kit should follow the same workflow instead of relying on Dependabot-style configuration. Keeping the managers explicit limits automated PRs to the dependency surfaces this repo actually has today: pin\n[…]\nenovate.json\n\nGenerated with Codex\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>\n\n---------\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add Renovate dependency updates (#17)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-11T14:27:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "41ac34e50ba7d57bb4b8f0ef50ff77f82a0dbcac",
          "body": "## Summary\n- `workflow_dispatch` runs were grouped by `github.ref` (`refs/heads/<branch>`) while `pull_request` runs were grouped by `head_ref` (bare branch name), so a dispatched CI run on a branch was never cancelled when a push to the same branch superseded it, and vice versa\n- Use `github.ref_na\n[…]\ngroup; PR runs and `main` push runs remain separate groups\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Unify CI concurrency group across trigger events (#15)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-10T19:19:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "de6e42d91764b9f780bee038ca643ad4ed61c81c",
          "body": "…#13)\n\n## Summary\n\n- gitcmd's sanitized environment (`GIT_CONFIG_GLOBAL` → empty file, `GIT_CONFIG_NOSYSTEM=1`) hides the user's `safe.directory` entries; git only honors `safe.directory` from protected configuration, so repos owned by another user (root-squashed volumes, container mounts) fail ever\n[…]\nner now resolves the repo root\n\nFixes kenn-io/roborev#838.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Forward user safe.directory entries through gitcmd config isolation (…",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-10T17:25:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b4b839bf7e194f9534d48cf285bd1f11cb66e7c4",
          "body": "## Summary\n- Replace `DETACHED_PROCESS` with `CREATE_NO_WINDOW` in `detachChild` on Windows: a console-less child makes every console-subsystem descendant (git, taskkill, agent CLIs) allocate a new visible console window, which users of kenn-io/roborev#834 saw as rapid terminal pop-ups; a hidden con\n[…]\n creation.\n- Document the invariant in `daemon/AGENTS.md`.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Run Windows detached daemons on a hidden console (#14)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-10T16:28:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "94bced88ba70b9d63eb6564fd5976d55b2702b3c",
          "body": "## Summary\n\n`gitrepo.MainRoot` needs to distinguish git-bare baked linked worktrees from submodule worktrees. Middleman-style checkouts can use a per-worktree git dir whose common git dir is a bare repository, and the previous logic fell through to the submodule `core.worktree` lookup even though th\n[…]\n`go test ./git/repo -run TestMainRootReturnsCheckoutRootForBareBackedWorktree -count=1`\n- `go test ./...`\n- `go vet ./...`\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Handle git-bare baked linked worktree roots (#12)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-09T21:21:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "357af04a6a2bd7e7c22d5983c435fad38811b3eb",
          "body": "## Summary\n\n- `gitcmd.Runner` with `NullGlobalConfig` pointed `GIT_CONFIG_GLOBAL` at\n`os.DevNull`. On Windows `os.DevNull` is `NUL` (the null device), and\nsome Git for Windows builds — notably on **ARM64** (git\n2.54.0.windows.1) — fail with `fatal: unable to access 'NUL': Invalid\nargument` when told\n[…]\n `NUL`, all\nkit-routed git calls failed there. CI runners on Windows x64 tolerate\n`NUL`, which is why this was not caught earlier.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Fix gitcmd NullGlobalConfig to use an empty file, not NUL (#11)",
          "author_name": "Wes McKinney",
          "author_login": "wesm",
          "committed_at": "2026-06-06T03:05:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8655e60927c11d344e5558429afdcdba525d3229",
          "body": "## Summary\n- add a shared PostHog telemetry reporter with caller-owned API key, application, env prefix, anonymous distinct ID, and option-based event allowlists\n- enforce privacy defaults and property sanitization for daemon telemetry captures\n- add build-tag/process-level telemetry disabling plus \n[…]\nck ./...\n- go tool nilaway -include-pkgs=go.kenn.io/kit ./...\n- go tool gotestsum --format pkgname-and-test-fails -- ./...\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add shared PostHog telemetry reporter (#10)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-04T20:31:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "24a948bfdcc9a74376e58aabf37c74ce80584448",
          "body": "## Summary\n- Add repo-level and scoped agent instruction files with matching\nCLAUDE.md symlinks.\n- Add Go-focused prek hooks for builtin hygiene, formatting,\ngolangci-lint, testify helper checks, NilAway, and tests.\n- Add NilAway as a Go tool dependency and clean up existing lint/test\nfindings so the hooks pass.",
          "is_bot": false,
          "headline": "chore: add agent instructions and Go hook enforcement (#8)",
          "author_name": "Phillip Cloud",
          "author_login": "cpcloud",
          "committed_at": "2026-06-02T16:01:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "98a91e0995d307d1a554b0fcda1186fa96c78eb9",
          "body": "## Summary\n- add daemon.Listen with locked Unix stale socket cleanup and bind\n- validate daemon listen paths and private runtime directories with safefile checks\n- expose functional WithXYZ listen options for callers like kata\n\n## Validation\n- go test ./daemon ./safefileio\n- GOOS=windows GOARCH=amd64 go test -c ./daemon -o /tmp/kit-daemon-windows.test.exe\n- GOOS=windows GOARCH=amd64 go test -c ./safefileio -o /tmp/kit-safefileio-windows.test.exe\n- go test ./...\n- roborev review --branch --wait",
          "is_bot": false,
          "headline": "Add safe daemon Unix socket listen (#7)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-02T13:05:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7088ce00aa1604c4909d222a121ce051a4e84fc7",
          "body": "Fix Windows private directory/file ownership checks used by daemon runtime storage.\\n\\nThis accepts ownership by either the token user SID or token owner SID, preserving explicit token-user ACL grants while allowing elevated/admin-token-created objects to validate correctly.\\n\\nAlso adds CI coverage across Linux, macOS, and Windows using gotestsum.",
          "is_bot": false,
          "headline": "Honor Windows token owner for private files",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-06-02T00:38:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb9a4960cedb2718587aeddb1868db0da39a5eb5",
          "body": "## Summary\n- add go.kenn.io/kit/selfupdate with configurable GitHub release update\nchecks\n- support cache handling, semver/dev-build comparison, checksum lookup,\nverified downloads, archive extraction, and staged binary install\n- add migration notes for agentsview and msgvault\n\n## Validation\n- go test ./selfupdate\n- go test ./...\n- go vet ./...\n\n---------\n\nCo-authored-by: OpenAI Codex <noreply@openai.com>",
          "is_bot": false,
          "headline": "Add selfupdate package (#3)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-05-29T20:53:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8931aeb591a8cf6e7d26ec67e4f74264ab036b7d",
          "body": "## Summary\n- Added a root `LICENSE` file with the Apache License 2.0 text\n- Included the Kenn Software copyright notice\n\n## Testing\n- Not run (not requested)\n\n---------\n\nCo-authored-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "Add Apache 2.0 license for Kenn Software (#4)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-05-29T20:52:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "39e914a5ba1c977911c7fc6e6462327d20ff1eb0",
          "body": "## Summary\n- add go.kenn.io/kit/logging with slog format, level, env override, run\nID, and TTY-aware setup helpers\n- add optional JSON file logging with stderr fanout, retained rotation,\nruntime size enforcement, and file-only/discard logger support\n- document generic migration guidance without private repo references\n\n## Validation\n- go test ./...\n- go test -race ./logging\n- roborev fix --open --list",
          "is_bot": false,
          "headline": "Add reusable slog logging package (#5)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-05-29T20:52:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b01e3d308f634a79c65421dc5b1b4856012aab07",
          "body": "## Summary\n- add a shared daemon package for endpoint parsing, runtime files, probing/discovery, detached startup, and process liveness\n- provide a strict shared /api/ping contract plus reference handler\n- harden discovery/startup with compatibility scanning, cancellation propagation, prefix validat\n[…]\nt -c ./daemon -o /tmp/kit-daemon-windows.test.exe\n\n## Review\n- roborev review job 224 was addressed, commented, and closed\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add shared daemon lifecycle primitives (#2)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-05-28T12:36:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cab0809b788d6df9eecfa534d93047f5b678d2a1",
          "body": "## Summary\n- add shared git subpackages for defensive command execution, env sanitization, remote validation, repo helpers, locking, worktrees, and test repos\n- add golangci-lint config with importas aliases for the git package tree\n- copy the testify helper analyzer and command from middleman\n\n## Verification\n- go test ./...\n- golangci-lint run ./...\n- go run ./cmd/testify-helper-check ./...\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add shared git tooling packages (#1)",
          "author_name": "Marius van Niekerk",
          "author_login": "mariusvniekerk",
          "committed_at": "2026-05-26T17:59:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ffc742925504b23af4fbd4b258cb2e3e198ff08a",
          "body": null,
          "is_bot": false,
          "headline": "Initialize Go telemetry library",
          "author_name": "Marius van Niekerk",
          "author_login": null,
          "committed_at": "2026-05-21T20:26:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 22,
      "commits_last_year": 48,
      "latest_release_at": "2026-07-24T00:35:33Z",
      "latest_release_tag": "v0.12.0",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 9,
      "days_since_latest_release": 0,
      "mean_days_between_releases": 1.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 37,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "go.kenn.io/kit",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": null,
          "registry_url": "https://pkg.go.dev/go.kenn.io/kit",
          "is_deprecated": false,
          "latest_version": "v0.12.0",
          "repository_url": null,
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-24T00:34:08Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 0
        }
      ]
    },
    "popularity": {
      "forks": 2,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2026-06-11",
            "count": 1
          },
          {
            "date": "2026-07-21",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 2,
        "total_forks": 2
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 101710,
      "source_files_sampled": 292,
      "oversized_source_files": 4,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md",
        "daemon/AGENTS.md",
        "daemon/CLAUDE.md",
        "git/AGENTS.md",
        "git/CLAUDE.md",
        "safefileio/AGENTS.md",
        "safefileio/CLAUDE.md",
        "selfupdate/AGENTS.md",
        "selfupdate/CLAUDE.md",
        "tools/testifyhelpercheck/AGENTS.md",
        "tools/testifyhelpercheck/CLAUDE.md",
        "vector/AGENTS.md"
      ],
      "agent_instruction_max_bytes": 6784
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.81.1",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 1,
            "oldest_advisory_days": 2
          },
          {
            "name": "golang.org/x/crypto",
            "direct": true,
            "version": "v0.53.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 16
          },
          {
            "name": "golang.org/x/text",
            "direct": true,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 9
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 2,
          "critical": 1
        },
        "advisory_count": 3,
        "affected_count": 3,
        "assessed_count": 91,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 2
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/BurntSushi/toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/asg017/sqlite-vec-go-bindings",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.6"
        },
        {
          "name": "github.com/charmbracelet/x/ansi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.11.7"
        },
        {
          "name": "github.com/gofrs/flock",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.13.0"
        },
        {
          "name": "github.com/klauspost/compress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.18.6"
        },
        {
          "name": "github.com/leanovate/gopter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.11"
        },
        {
          "name": "github.com/mattn/go-runewidth",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.24"
        },
        {
          "name": "github.com/mattn/go-sqlite3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.14.44"
        },
        {
          "name": "github.com/oklog/ulid/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.1.1"
        },
        {
          "name": "github.com/posthog/posthog-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.12.6"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "go.opentelemetry.io/contrib/exporters/autoexport",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.69.0"
        },
        {
          "name": "go.opentelemetry.io/contrib/propagators/autoprop",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.69.0"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/metric",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk/metric",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "golang.org/x/crypto",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.53.0"
        },
        {
          "name": "golang.org/x/mod",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.36.0"
        },
        {
          "name": "golang.org/x/perf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260615155930-9e4b9ddef5b6"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.0"
        },
        {
          "name": "golang.org/x/sys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.46.0"
        },
        {
          "name": "golang.org/x/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.44.0"
        },
        {
          "name": "golang.org/x/text",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.38.0"
        },
        {
          "name": "golang.org/x/tools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.45.0"
        },
        {
          "name": "modernc.org/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.53.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/asg017/sqlite-vec-go-bindings",
            "direct": true,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/burntsushi/toml",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": true,
            "version": "v0.11.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gofrs/flock",
            "direct": true,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": true,
            "version": "v1.18.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/leanovate/gopter",
            "direct": true,
            "version": "v0.2.11",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": true,
            "version": "v0.0.24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-sqlite3",
            "direct": true,
            "version": "v1.14.44",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/ulid/v2",
            "direct": true,
            "version": "v2.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/posthog/posthog-go",
            "direct": true,
            "version": "v1.12.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/exporters/autoexport",
            "direct": true,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/autoprop",
            "direct": true,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": true,
            "version": "v0.53.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": true,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/perf",
            "direct": true,
            "version": "v0.0.0-20260615155930-9e4b9ddef5b6",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": true,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": true,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": true,
            "version": "v0.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": true,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": true,
            "version": "v0.45.0",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/sqlite",
            "direct": true,
            "version": "v1.53.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aclements/go-moremath",
            "direct": false,
            "version": "v0.0.0-20210112150236-f10218a38794",
            "ecosystem": "go"
          },
          {
            "name": "github.com/beorn7/perks",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bitfield/gotestdox",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dnephin/pflag",
            "direct": false,
            "version": "v1.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-json",
            "direct": false,
            "version": "v0.10.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/shlex",
            "direct": false,
            "version": "v0.0.0-20191202100458-e7afc7fbc510",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/munnerz/goautoneg",
            "direct": false,
            "version": "v0.0.0-20191010083416-a7dc8b61c822",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_golang",
            "direct": false,
            "version": "v1.23.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_model",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/common",
            "direct": false,
            "version": "v0.67.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/otlptranslator",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/procfs",
            "direct": false,
            "version": "v0.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/bridges/prometheus",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/aws",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/b3",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/jaeger",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/propagators/ot",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/prometheus",
            "direct": false,
            "version": "v0.66.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/stdout/stdoutlog",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/stdout/stdoutmetric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/log",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/log",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/proto/otlp",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/nilaway",
            "direct": false,
            "version": "v0.0.0-20260528182042-490362de4fb6",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v2",
            "direct": false,
            "version": "v2.4.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260706201446-f0a921348800",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260706201446-f0a921348800",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.81.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.11",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": false,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "gotest.tools/gotestsum",
            "direct": false,
            "version": "v1.13.0",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/libc",
            "direct": false,
            "version": "v1.73.4",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/mathutil",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/memory",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 91,
        "direct_count": 27,
        "indirect_count": 64
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 48,
        "open_issues": 0,
        "closed_ratio": 1,
        "closed_issues": 3,
        "closed_unmerged_prs": 2
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "wesm",
          "commits": 24,
          "avatar_url": "https://avatars.githubusercontent.com/u/329591?v=4"
        },
        {
          "type": "User",
          "login": "mariusvniekerk",
          "commits": 21,
          "avatar_url": "https://avatars.githubusercontent.com/u/73973?v=4"
        },
        {
          "type": "User",
          "login": "cpcloud",
          "commits": 2,
          "avatar_url": "https://avatars.githubusercontent.com/u/417981?v=4"
        },
        {
          "type": "User",
          "login": "riordan",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/227472?v=4"
        }
      ],
      "contributors_sampled": 4,
      "top_contributor_share": 0.5
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "bench.yml",
        "ci.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 3,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 1,
            "reason": "Found 5/30 approved changesets -- score normalized to 1",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 9 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 10,
            "reason": "all dependencies are pinned",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 9,
            "reason": "SAST tool is not run on all commits -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 7,
            "reason": "3 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "b37e8deadfb1b588350ae720535030fc10b961a2",
        "ran_at": "2026-07-24T13:46:40Z",
        "aggregate_score": 6.8,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-24T00:43:25Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-24T00:34:08Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/kenn-io/kit",
    "host": "github.com",
    "name": "kit",
    "owner": "kenn-io"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 63,
      "inputs": {
        "security": 72,
        "vitality": 74,
        "community": 24,
        "governance": 66,
        "engineering": 76
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 74,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 57,
            "inputs": {
              "commits_last_year": 48,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 9
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "9/52 weeks with commits",
                "points": 6.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "48 commits in the last year",
                "points": 15.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 48
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 22,
              "latest_release_tag": "v0.12.0",
              "releases_from_tags": false,
              "days_since_latest_release": 0,
              "mean_days_between_releases": 1.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "22 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 22
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~1.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 1.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 2,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "2 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 66,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "at_risk",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 36,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 4,
              "top_contributor_share": 0.5
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 50% of commits",
                "points": 11.2,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 50
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "4 contributors",
                "points": 5.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 9 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "excellent",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "merged_prs": 48,
              "open_issues": 0,
              "closed_issues": 3,
              "issue_closed_ratio": 1,
              "closed_unmerged_prs": 2
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "100% of issues closed",
                "points": 46.8,
                "status": "met",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "48/50 decided PRs merged",
                "points": 36.7,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 48,
                      "decided": 50
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 5/30 approved changesets -- score normalized to 1",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "followers": 133,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "kenn-io",
              "public_repos": 12,
              "account_age_days": 167
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "133 followers of kenn-io",
                "points": 15.3,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 133,
                      "login": "kenn-io"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "12 public repos, account ~0 yr old",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 12
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "go.kenn.io/kit"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 0
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 0 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "26 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 76,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 72,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 68,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 6.8
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 5/30 approved changesets -- score normalized to 1",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 9 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "all dependencies are pinned",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 9",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "3 existing vulnerabilities detected",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 91 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 91
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 86,
            "inputs": {
              "source": "osv",
              "advisories": 3,
              "affected_packages": 3,
              "assessed_packages": 91,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 1, unknown 2",
              "direct_affected_packages": 2
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "2 affected: golang.org/x/crypto v0.53.0 (unknown), golang.org/x/text v0.38.0 (unknown)",
                "points": 24.7,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 2,
                      "packages": "golang.org/x/crypto v0.53.0 (unknown), golang.org/x/text v0.38.0 (unknown)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 91,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 4
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "excellent",
        "name": "AI Readiness",
        "value": 88,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.98,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md",
                "daemon/AGENTS.md",
                "daemon/CLAUDE.md",
                "git/AGENTS.md",
                "git/CLAUDE.md",
                "safefileio/AGENTS.md",
                "safefileio/CLAUDE.md",
                "selfupdate/AGENTS.md",
                "selfupdate/CLAUDE.md",
                "tools/testifyhelpercheck/AGENTS.md",
                "tools/testifyhelpercheck/CLAUDE.md",
                "vector/AGENTS.md"
              ],
              "agent_instruction_max_bytes": 6784
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md, daemon/AGENTS.md, daemon/CLAUDE.md, git/AGENTS.md, git/CLAUDE.md, safefileio/AGENTS.md, safefileio/CLAUDE.md, selfupdate/AGENTS.md, selfupdate/CLAUDE.md, tools/testifyhelpercheck/AGENTS.md, tools/testifyhelpercheck/CLAUDE.md, vector/AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md, daemon/AGENTS.md, daemon/CLAUDE.md, git/AGENTS.md, git/CLAUDE.md, safefileio/AGENTS.md, safefileio/CLAUDE.md, selfupdate/AGENTS.md, selfupdate/CLAUDE.md, tools/testifyhelpercheck/AGENTS.md, tools/testifyhelpercheck/CLAUDE.md, vector/AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "48 of 49 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 48,
                      "sampled": 49
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 87,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0.163,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "8 of the last 49 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 8,
                      "sampled": 49
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "all dependencies are pinned",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 99,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 101710,
              "source_files_sampled": 292,
              "oversized_source_files": 4
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "4/292 source files over 60KB",
                "points": 54.2,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 292,
                      "oversized": 4
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-24T13:46:58.007380Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/k/kenn-io/kit.svg",
  "full_name": "kenn-io/kit",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}