lua-ai-global / governance

来自 GitHub 依赖图的完整解析依赖集合：0 个直接依赖与 283 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 279 个包，其中也包含从不交付的开发与测试版本固定：2 个存在已知公告，0 个为直接依赖。 有 4 个无法评估——没有已解析的版本、生态系统不受支持，或不在所列包清单之内。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [
        "agent-framework",
        "agent-security",
        "ai-agents",
        "ai-governance",
        "ai-safety",
        "audit-trail",
        "compliance",
        "eu-ai-act",
        "guardrails",
        "injection-detection",
        "iso-42001",
        "kill-switch",
        "llm-security",
        "mcp",
        "nist-ai-rmf",
        "owasp",
        "policy-engine",
        "prompt-injection",
        "typescript",
        "zero-dependencies"
      ],
      "is_fork": false,
      "size_kb": 3413,
      "has_wiki": true,
      "homepage": "https://heygovernance.ai",
      "languages": {
        "Python": 14087,
        "PLpgSQL": 3733,
        "Dockerfile": 1547,
        "JavaScript": 23272,
        "TypeScript": 1751579
      },
      "pushed_at": "2026-07-26T11:30:56Z",
      "created_at": "2026-03-11T20:01:35Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-26T11:29:03Z",
      "description": "Zero-dependency TypeScript SDK for AI agent governance: policy enforcement, injection detection, tamper-evident audit, and standards mapping (EU AI Act, OWASP, NIST, ISO 42001)",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript"
      ]
    },
    "owner": {
      "blog": "https://www.heylua.ai",
      "name": "Lua AI Global",
      "type": "Organization",
      "login": "lua-ai-global",
      "company": null,
      "location": null,
      "followers": 10,
      "avatar_url": "https://avatars.githubusercontent.com/u/186899738?v=4",
      "created_at": "2024-10-31T05:21:50Z",
      "is_verified": null,
      "public_repos": 9,
      "account_age_days": 633
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2026-07-20T11:54:52Z"
        },
        {
          "tag": "v0.18.2",
          "kind": "patch",
          "published_at": "2026-07-20T11:31:46Z"
        },
        {
          "tag": "v0.18.1",
          "kind": "patch",
          "published_at": "2026-06-26T10:30:59Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2026-06-26T07:46:06Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2026-05-07T21:40:28Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2026-04-30T17:38:39Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2026-04-30T14:28:18Z"
        },
        {
          "tag": "v0.14.1",
          "kind": "patch",
          "published_at": "2026-04-30T00:22:48Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2026-04-30T00:21:52Z"
        },
        {
          "tag": "v0.13.2",
          "kind": "patch",
          "published_at": "2026-04-30T00:24:09Z"
        },
        {
          "tag": "v0.13.1",
          "kind": "patch",
          "published_at": "2026-04-30T00:24:08Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2026-04-16T17:45:07Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2026-04-16T16:58:49Z"
        },
        {
          "tag": "v0.11.2",
          "kind": "patch",
          "published_at": "2026-04-16T00:13:26Z"
        },
        {
          "tag": "v0.11.1",
          "kind": "patch",
          "published_at": "2026-04-15T23:49:20Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2026-04-15T23:49:11Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2026-04-15T23:49:41Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-04-14T22:29:51Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "0a1e18f4dc506a7020d5136579afb8d4279f21f8",
          "body": "…#23 (#48)\n\nRemediates open Dependabot alert #23 (postcss <= 8.5.17, high). Bumps transitive postcss to 8.5.23 via overrides (within-major 8.x). Also carries transitive nanoid 3.3.15 -> 3.3.16. No major bumps.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security: bump postcss to patched within-major (8.5.23) — Dependabot …",
          "author_name": "Stefan Kruger",
          "author_login": "lua-stefan-kruger",
          "committed_at": "2026-07-26T11:28:53Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "32a52141acebdfd670751e107c96cca1f9fc7ba0",
          "body": "Bump @babel/core 7.29.0 -> 7.29.7 in examples/demo-app to remediate Dependabot alert #17 (arbitrary file read via sourceMappingURL comment, patched 7.29.6). Within-major transitive devDep bump; lockfile only. demo-app build verified green.",
          "is_bot": false,
          "headline": "security: consolidated low-severity remediation (#46)",
          "author_name": "Stefan Kruger",
          "author_login": "lua-stefan-kruger",
          "committed_at": "2026-07-25T08:09:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1ac95f82958668f1aeb441c1b12b7e7b11ea346c",
          "body": "Close within-major, bump-fixable HIGH Dependabot alerts in examples/demo-app.\n\n- js-yaml 4.1.1 -> 4.3.0 (GHSA-52cp-r559-cp3m, HIGH #22; also GHSA-h67p-54hq-rp68 MEDIUM #19)\n- brace-expansion 1.1.14 -> 1.1.16 (GHSA-3jxr-9vmj-r5cp, HIGH #21)\n- brace-expansion 5.0.5 -> 5.0.7 (GHSA-3jxr-9vmj-r5cp, HIGH \n[…]\nia major-scoped npm overrides so the two brace-expansion majors are fixed independently without cross-major downgrade. npm ci verified locally.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security: consolidated high remediation (#45)",
          "author_name": "Stefan Kruger",
          "author_login": "lua-stefan-kruger",
          "committed_at": "2026-07-24T11:47:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3d84e227312d64286a795adda877d76a3ff7c8bd",
          "body": "Bumps [esbuild](https://github.com/evanw/esbuild) to 0.28.1 and updates ancestor dependency [tsx](https://github.com/privatenumber/tsx). These dependencies need to be updated together.\n\n\nUpdates `esbuild` from 0.27.3 to 0.28.1\n- [Release notes](https://github.com/evanw/esbuild/releases)\n- [Changelog\n[…]\nndency-version: 4.22.4\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump esbuild and tsx in /examples (#21)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-23T08:18:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "baf454130661c3ab1ef06fe1f11b801f5195b5a2",
          "body": "Bumps [esbuild](https://github.com/evanw/esbuild) to 0.28.1 and updates ancestor dependency [tsx](https://github.com/privatenumber/tsx). These dependencies need to be updated together.\n\n\nUpdates `esbuild` from 0.27.3 to 0.28.1\n- [Release notes](https://github.com/evanw/esbuild/releases)\n- [Changelog\n[…]\ndency-version: 4.22.4\n  dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump esbuild and tsx (#20)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-23T08:18:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8eb2e7b9ff8fd77bf5feac21d27b328974e6734d",
          "body": "Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react). These dependencies needed to be updated together.\n\nUpdates `vite` from 8.0.8 to 8.1.0\n- [Release notes](https://github.com/vit\n[…]\nndency-version: 5.2.0\n  dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps-dev): bump vite and @vitejs/plugin-react (#28)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-23T08:18:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "926c326bdf745993a900af1df19674ff72c51138",
          "body": "`integrityChain.stats()` returned this process's last-written sequence/hash\nfrom an in-closure cache, so under multiple writers sharing one store it\nlagged other processes' writes — the one audit-chain reader left on\nprocess-local state after 0.18.2 made writes atomic and export()/verify()\ndurable-b\n[…]\n chain itself. Pre-1.0 minor bump per\n0.x semver (0.19.0); labeled BREAKING-ISH like 0.12.0. All in-repo callers\nupdated to await.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: DB-backed integrity chain stats (multi-process truth) (#40)",
          "author_name": "Rares Astilean",
          "author_login": "rares04",
          "committed_at": "2026-07-20T11:54:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7cc57dc63b1194be08e7b324825e82d849f04ae8",
          "body": "…nd (#35)\n\n* fix: allocate audit integrity sequence atomically per-org in Postgres (multi-pod safe)\n\nThe integrity audit chain held `sequence` and `previousHash` as process-local\nstate, resumed from the durable head only once at boot. Behind multiple pods\nsharing one Postgres database, each process \n[…]\nithout its fix); full suite 1450 pass, tsc clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: multi-process-safe audit integrity chain via atomic per-org appe…",
          "author_name": "Rares Astilean",
          "author_login": "rares04",
          "committed_at": "2026-07-20T11:30:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4bf70d52017a8cc762c5da44e084c148e9f625ac",
          "body": "…0.18.1)\n\nFold confusables (Cyrillic/Greek homoglyphs), collapse spaced-out chars,\nand strip markdown emphasis before matching, so obfuscated injections can\nno longer dodge keyword patterns. Add agent_worm_propagation and\nforced_tool_call built-ins (54 -> 56). Purely additive; no API changes.\n\nLIB v\n[…]\n-> 801 true positives (recall 37.26% -> 38.22%, F1 +0.92pp)\nfor one additional false positive; precision and FPR effectively flat.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(injection): evasion-resistant normalization + agentic patterns (…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-06-26T10:32:28Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0b90cce9835e82d11f60d0a982f4e27bca0cd205",
          "body": "Each organizationId now gets its own HMAC chain head, 1..N sequence, and\nwrite lock; org-less events share one chain (backward-compatible). Binds\norganizationId into the per-event hash when present; Postgres adapter now\npersists organization_id and uses a per-org unique sequence index.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(audit): scope tamper-evident chains per organization (0.18.0) (#25)",
          "author_name": "Scott Waddell",
          "author_login": "scotty595",
          "committed_at": "2026-06-26T07:35:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6f1992db358d8f668e65cba25bf510f00806e95f",
          "body": "Add conditions?: RegisteredConditionType[] to GovernanceConfig and\nmirror the engine's condition-registry surface\n(registerCondition / unregisterCondition / getRegisteredCondition /\ngetRegisteredConditions / clearConditionRegistry) on\nGovernanceInstance, so callers using the documented createGoverna\n[…]\nr\ncustom evaluators. Widen GovernanceConfig.defaultOutcome to the full\nPolicyOutcome union to match PolicyEngineConfig.defaultOutcome.\nUpdate the README's Quick Start with a Custom Conditions section.",
          "is_bot": false,
          "headline": "feat(sdk): expose custom conditions on createGovernance (0.17.0)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-05-07T21:39:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e94d681ad87d9f47cfbfeb18454c37a67a9be05",
          "body": "Per-policy multi-modal scan dispatch. scanModalities on PolicyRule,\ntextByModality on EnforcementContext, CONDITIONS_SUPPORTING_MODALITIES\nregistry, getScanText helper. Six content-scanning evaluators rewired;\ncombinators preserve parent's modality scope. Backward compatible —\n1,413 / 0 tests.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: governance-sdk@0.16.0",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T17:37:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "98d4d5e77822f208c20794ca3dbd540b47a56a49",
          "body": "feat(policy): per-rule scanModalities for content-scanning conditions",
          "is_bot": false,
          "headline": "Merge pull request #12 from lua-ai-global/feat/per-policy-modalities",
          "author_name": "Scott Waddell",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T17:36:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "423e372203d23e7177eeae8cb27eb3e9d134609c",
          "body": "Previous design (closed in cloud PR #4) put modality config on a global\norg-level toggle. That coupled unrelated policies and made no sense for\nmetadata-only rules (rate_limit, token_budget, kill_switch). Each policy\nthat semantically scans content should declare its own modality coverage.\n\nThis com\n[…]\nence, scanModalities\n  ignored on non-content-scanning rules, and combinator propagation.\n- Full suite: 1,413 / 0 (was 1,399 / 0).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(policy): per-rule scanModalities for content-scanning conditions",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T17:27:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a393d4080cbf481183cda1f73e024f8838b58782",
          "body": "…y pass\n\nThe auto-generated release notes only covered #9 (tool-result adapters).\nCode for #10 (multi-modal scan) and #11 (README honesty pass) shipped\nin 0.15.0 but neither got a CHANGELOG entry — the auto-release pulled\nfrom CHANGELOG.md so the GitHub Release body and the npm-displayed\nchangelog w\n[…]\ns the 0.15.0 entry with both missing sections.\nGitHub Release body has been updated to match.\n\nNo code change; documentation only.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(changelog): extend 0.15.0 entry with multi-modal + README honest…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T14:30:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "988db460ce0c232c7f6b5f13f86f5ac030ff4bc3",
          "body": "feat(scan): opt-in multi-modal scan orchestration",
          "is_bot": false,
          "headline": "Merge pull request #10 from lua-ai-global/feat/multi-modal-scanning",
          "author_name": "Scott Waddell",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T13:52:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f89155f9fb2a27b0e119873317bce85ef0ee5999",
          "body": "Two issues found by Cursor Bugbot on the multi-modal PR.\n\n**HIGH: scanMultiModal silently ignored onMissingScanner / onExtractError**\n\nScanOptions declared the two policy fields but the orchestrator never\nread them — they were only consumed by the separate `isFailClosed`\nhelper. A caller following t\n[…]\nn tests covering both issues plus the override\nhelper's defaulting behaviour. Full suite 1,399 / 0 (was 1,392 / 0\nbefore; +7 new).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(scan): honour fail-closed options + treat null returns as benign",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T13:44:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "df978db4b0ee0e454b161691ba074c8d438f7fe4",
          "body": "Closes the bypass where image, PDF, and audio content blocks pass\nthrough enforce() unscanned. Ships the orchestration only — actual\nOCR / PDF parsers / ASR are caller-supplied via a registry pattern,\nkeeping the zero-runtime-dep promise.\n\nAPI:\n- ModalityScanner interface (extractText: async (block)\n[…]\nact' optional peer-dep package\n  could ship a default OCR scanner for image, but stays out of the core\n  SDK to preserve zero-dep.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(scan): add opt-in multi-modal scan orchestration",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T13:29:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "66bb728e33285a3db2321199023220bf68abd51b",
          "body": "docs(sdk): README honesty pass — counts, audit chain, limitations",
          "is_bot": false,
          "headline": "Merge pull request #11 from lua-ai-global/chore/sdk-readme-honesty-pass",
          "author_name": "Scott Waddell",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T13:27:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8ab40f57ecb7932f52dd1a6063c0a80939b1dd3e",
          "body": "The repo treats root README as source of truth and generates\npackages/governance/README.md from it via scripts/sync-readme.mjs at\nprepublish + CI. The original commit on this branch only edited the\npackage README directly, which CI flagged as drift on PR #11.\n\nThis commit:\n- Re-applies all the hones\n[…]\ne / Limitations & Honest Scope /\nmulti-modal opt-in framing / full plugin export list including\nmcp-allowlist + mcp-call-recorder.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: apply README honesty pass to root + sync to package",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T13:24:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ec13865fda5eb7b8fd6c47f4597bce1465a9d3f7",
          "body": "- 12 framework integrations (was \"10\"): 10 featured + MCP toolkit + Bedrock.\n- 47 export paths (was \"44\"); plugin export list now lists all 16 paths\n  (mcp-allowlist and mcp-call-recorder were missing).\n- 1,340 tests (was \"1,328\").\n- Tamper-evident audit chain promoted to a hero callout — it's a\n  c\n[…]\nders.\n- Multi-modal disclaimer reframed as opt-in roadmap (cost/latency/egress\n  reasons mean it ships opt-in, not on-by-default).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(sdk): README honesty pass — counts, audit chain, limitations",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T13:22:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ad9e68e94eedff634cc38a7699a0fbebf5fd2f2d",
          "body": "feat: tool-result scanning for langchain / openai-agents / genkit / l…",
          "is_bot": false,
          "headline": "Merge pull request #9 from lua-ai-global/feat/tool-result-other-adapters",
          "author_name": "Scott Waddell",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T13:21:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "276e65140144297f4679eebb6b765da9a0f24907",
          "body": "Two findings on the 0.15.0 wrapper rollout:\n\n1. LlamaIndex — BlockedToolResult.ruleId is `string | null`, but\n   LlamaIndexJSONValue explicitly excludes null per the SDK contract.\n   The unchecked cast `as LlamaIndexJSONValue` would let a null ruleId\n   slip through and trip downstream JSON walkers \n[…]\n\ngovernance-wrapper convenience (not in the SDK), so callers there\ncan already accept arbitrary shapes.\n\nTests: 1,372, 0 failures.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: bugbot — null violates LlamaIndexJSONValue, OpenAI invoke contract",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T10:48:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2854f535fa5cf92473652de940520ff0f6656728",
          "body": "Bugbot caught: the LangChain wrap unsafely cast `input as Record<string,\nunknown> | undefined` before handing it to scanResult. LangChain's\nDynamicTool inputs are commonly strings, and an unchecked cast would\nlet a string flow through to ctx.input — typed as Record<string,\nunknown> in EnforcementCon\n[…]\nnt still gets scanned via\nctx.outputText (which scanToolResult populates from the tool's return\nvalue, regardless of input shape).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(langchain): guard input cast before passing to scanToolResult",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T08:15:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6529c31c5821cf8e4d35877fafbbf55a2b29153c",
          "body": "…lamaindex (0.15.0)\n\n0.14 wired tool-result scanning into the Mastra processor + MCP adapter\nonly. 0.15 rolls the same protection out to the four other adapters\nthat already do tool wrapping at construction time:\n\n  - LangChain — wraps tool.invoke (both governTool and governTools)\n  - OpenAI Agents \n[…]\npublic type breakage. Tests that mock tool returns\nmay need `scanToolResults: false` to skip the helper.\n\n1,372 tests, 0 failures.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: tool-result scanning for langchain / openai-agents / genkit / l…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T00:48:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6ee87a5b0d183e10164109f7eeeac86dcfbcc431",
          "body": "…ases\n\nci: auto-create GitHub Release on tag push",
          "is_bot": false,
          "headline": "Merge pull request #8 from lua-ai-global/feat/auto-create-github-rele…",
          "author_name": "Scott Waddell",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T00:38:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c7000be513ccc1c7697f2d9f9983317cc115e67",
          "body": "Releases were falling out of sync — v0.13.1 / v0.13.2 / v0.14.0 / v0.14.1\nall had tags + npm publish but no GitHub Release entries until I created\nthem by hand today. Future tags should auto-publish a Release with notes\npulled from the matching CHANGELOG section.\n\nAdds a \"Create GitHub Release\" step\n[…]\n —\nemits a `::warning::` so we notice but the npm publish has already\nhappened by that step. We can backfill notes manually after.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: auto-create GitHub Release on tag push",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T00:24:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "13e00616be80e54a06abddc82cb038e16cefb1a5",
          "body": "scope_boundary and network_allowlist read ctx.targetPath / ctx.targetUrl,\nbut evaluateToolCall (the path that powers Mastra's processOutputStep)\nwasn't populating either. So this rule looked correct and silently\nnever fired:\n\n  - condition: { type: scope_boundary, params: { blockedPaths: [\"/etc/**\"]\n[…]\nrs would\nnaturally expect.\n\nTests: 1,372 (+2 — scope_boundary on args.path, network_allowlist on\nargs.url, both at stage process).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: extract targetPath/targetUrl in evaluateToolCall (0.14.1)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-30T00:07:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b2e1c8f72cd626312c1f7755fcc1a9ead4107688",
          "body": "CHANGELOG covers the tool_result stage, scanToolResult helper, wrapTool\non GovernanceProcessor, toolFieldExtraction registry, and the MCP cleanup\nthat delegates output scanning to the policy engine.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: bump governance-sdk to 0.14.0 + CHANGELOG entry",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-29T23:26:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d28176b31c6bfaf87e24235d781d399b65ead037",
          "body": "Closes the framework gap where tool-call return content (file contents,\nclipboard, scraped pages, MCP returns) reached the LLM unscanned. The\nMastra processor lifecycle has no hook between tool execute() and the\nnext LLM call, so scanning has to happen inside tool.execute() — exposed\nvia wrapTool/wr\n[…]\nlock payload = redacted { blocked, reason, ruleId } so the LLM adapts\n  naturally on next turn without seeing the original content\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add tool_result stage + wrapTool helper for tool-output scanning",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-29T22:58:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ce32af5a8ddf50aee4fcdf659cb301d07ce8559a",
          "body": "Previously remoteRegister() returned a synthetic `{ level: 0 }` as\na placeholder — the comment said \"authoritative values arrive after\nfirst enforce()\", but callers that cached the level (e.g. the\nMastra processor's agentLevel field) then sent that 0 on every\nsubsequent enforce. Rules gating on `age\n[…]\nkup.\n\nFalls back to the old synthetic receipt when the API is unreachable\nor returns non-200, so register() still never throws for the\ncaller. The next enforce() carries authoritative data either way.",
          "is_bot": false,
          "headline": "Remote register: fetch authoritative score/level from API (0.13.2)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-22T00:21:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b0f1ed52e5e2b950f2f2be30cd2ff37f4967d6c5",
          "body": "Streaming adapters generate one streamId per stream and inject it,\nplus a slice index, into metadata on every per-chunk enforce call.\nLets cloud dashboards collapse N per-chunk audit rows into one\nlogical operation for reviewers. Additive — pure metadata, no\npublic API change.\n\nApplies to pre-post-stream.ts (used by Anthropic, LangChain, Vercel\nAI, etc.) and mastra-processor-stream.ts (Mastra's per-chunk API).",
          "is_bot": false,
          "headline": "Tag streaming enforce calls with stable streamId (0.13.1)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-21T17:22:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a1a545a43e69b0fdbc5de7109b0d6a3885527564",
          "body": "- OTel conventions default flips from \"both\" to \"gen_ai\"; governance\n  spans now correlate with Anthropic/OpenAI/Vercel-AI spans out of the\n  box. Pass conventions: \"both\" to keep emitting legacy governance.*\n  op names alongside.\n- createMCPTrustRegistry and createChainAuditor emit a one-shot\n  con\n[…]\nthe warning.\n- 1,340 tests, 0 failures (3 new tests pin the 0.13 OTel default).\n\nBoth changes were promised in the 0.12 CHANGELOG.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Release governance-sdk 0.13.0",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-16T17:44:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "85075e284dd34d494ce55c83a3548cf253e17881",
          "body": "- Durable integrity chain: chain state persists to storage atomically\n  and resumes on restart via getChainHead(); legacy adapters degrade\n  gracefully with onAuditError warning\n- OTel GenAI semantic conventions: dual-emit gen_ai.* attributes\n  alongside governance.* for APM correlation; conventions\n[…]\nlti-modal gap\n- Postgres schema: integrity columns in base DDL, BIGINT sequence,\n  unique partial index; auto-migration on connect\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Release governance-sdk 0.12.0",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-16T16:53:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cdea38a365fb0f4355ab18b3d6c077a87d9226f5",
          "body": "Adds infrastructure to keep packages/governance/README.md (the file npm\npublishes) in sync with the repo-root README:\n\n- scripts/sync-readme.mjs — generates the package README from the root,\n  normalizing repo-relative links to absolute GitHub URLs so they resolve\n  on npmjs.com. Idempotent.\n- prepu\n[…]\nns.\n- CI guard added to .github/workflows/ci.yml — fails the build if anyone\n  commits a manual edit to the package README without running the sync.\n\nNo code changes. SDK behavior identical to 0.11.1.",
          "is_bot": false,
          "headline": "build(sdk): automate README sync to prevent npm/repo drift (0.11.2)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-16T00:13:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5cff57903c705dd8fd7cf7ff126d0d636fba98a6",
          "body": "The packages/governance/README.md (what npm publishes) had drifted ~3\nrelease cycles behind the repo-root README. Replace with a copy of the\nroot README so npm users see the same content GitHub viewers see —\nincluding 'What this is NOT' scope disclosures, 0.11 module removals,\nand behavioral-scorer demotion.\n\nRelative links normalized to absolute GitHub URLs so they resolve when\nread on npmjs.com.\n\nNo code changes. SDK behavior identical to 0.11.0.",
          "is_bot": false,
          "headline": "docs(sdk): sync npm README with repo (0.11.1)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T23:48:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b0fb63e0f42d386fb9f65554c014917cfffb32b3",
          "body": "- Cut 'Eval traces' section (module removed in 0.11)\n- Cut governance-sdk/eval-trace, eval-scorer, eval-types from Export Paths\n- Cut governance-sdk/plugins/mcp-annotations from Export Paths\n- Demote behavioral-scorer mention; flag dynamic trust scoring as future work\n- Demote metrics, otel-hooks un\n[…]\nervability/eval pipeline; no built-in\n  eval store\n- Adapter footer: 10 featured + 3 specialty (was 4 before mcp-annotations cut)\n- CHANGELOG: full 0.11.0 entry covering removals, demotions, migration",
          "is_bot": false,
          "headline": "docs(sdk): scope-honesty README pass for 0.11",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T22:32:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "500c8329a166a4fd19dc6988c733cd27d016b9db",
          "body": "Removes five modules with no Cloud consumers and no competitor treating\nthem as load-bearing features:\n\n- governance-sdk/eval-trace, governance-sdk/eval-scorer,\n  governance-sdk/eval-types — in-memory ring buffer + naive eval-adjustment\n  scoring loop. Use a real eval harness (inspect-ai, PyRIT, Gar\n[…]\n) and the supply-chain policy\n  primitive (governance-sdk/supply-chain) remain.\n\nAlso bumps to 0.11.0 and trims package.json exports from 49 to 44 entries.\nTests: 1,358 → 1,328. All pass; build clean.",
          "is_bot": false,
          "headline": "chore(sdk): delete eval-*, mcp-annotations, supply-chain-sbom (BREAKING)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T22:29:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cfda2024a8a431fd1ec6e585c46402a7118bf663",
          "body": "GovernMCPConfig.traceCollector is removed alongside gov.eval. Tool-call\naudit events still fire via gov.audit; users who want span-level traces\nshould wire OTel at the framework adapter layer (a real OpenInference\nexporter is on the v0.12 roadmap).",
          "is_bot": false,
          "headline": "chore(sdk): drop traceCollector from MCP plugin (BREAKING)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T22:26:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0311291229c6e8c1820cd701317978fa23a39ed6",
          "body": "The in-memory eval result store and trace collector hung off\nGovernanceInstance.eval were unused by every audited consumer\n(governance-cloud has zero references) and easily mistaken for a real\neval pipeline. The submodule files (eval-trace, eval-scorer, eval-types)\nare removed in a follow-up commit.\n\nMigration: route eval results from inspect-ai / PyRIT / Garak / Phoenix\n/ Langfuse / Braintrust into your audit stream directly via gov.audit.log().",
          "is_bot": false,
          "headline": "chore(sdk): remove gov.eval API surface (BREAKING)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T22:25:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3efb12300e062c73b6903e5f146cb981b5fad6fa",
          "body": "Historical 0.10 removal/rename context belongs in CHANGELOG, not the\ntop-of-funnel README.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: drop migration/rename notes from README",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T21:52:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6ebd19767f33a21688b00c5bce59b503d226e031",
          "body": "CycloneDX of the npm tree is low-signal for SDK consumers; keeping\nEd25519 agent identity which stands on its own.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: drop SBOM / supply-chain sections from README",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T21:50:40Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d00d126e08f2626afaf22759ad099bf2b13cd6e1",
          "body": "…ame dryRun→simulatePolicy",
          "is_bot": false,
          "headline": "docs: sync README to 0.10.1 — remove sandbox/federation/red-team, ren…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T21:49:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "60d6fa97e7002883158bf9ae50679a3c4680b336",
          "body": "Patch release. Everything here is opt-in and the default behaviour of\ncreateGovernance() with no integrityAudit config is byte-identical to\n0.10.0.\n\n- Mark `recordOutcome` optional on GovernanceInstance so hand-rolled\n  mocks in consumer test suites keep compiling. Always populated at\n  runtime by createGovernance().\n- Guard the runWithOutcome() call-site with `?.` for the same reason.\n\nNo behavioural changes, no removed exports, no rename of any existing\nsymbol.",
          "is_bot": false,
          "headline": "v0.10.1 — opt-in integrityAudit + recordOutcome (strictly additive)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T12:03:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ba467f49d4fc56ba93fdc868a29a7594e8a958e4",
          "body": "Until now, createIntegrityAudit() was a separate opt-in wrapper that only\ncovered explicit integrity.log() calls. That meant \"tamper-evident audit\"\nquietly excluded register(), enforce(), audit.log(), kill-switch — the\nactual surface of the SDK. Fix that.\n\nNew: `createGovernance({ integrityAudit: { \n[…]\noes NOT\" table\nso readers don't assume 'every agent action' is covered when what we\nmean is 'every action routed through the SDK.'\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "complete-visibility audit chain: every SDK action is HMAC-chained",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T11:59:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cd59a244a2967be81a22428af81be5ff838345e4",
          "body": "Cut features that were named bigger than they were:\n- Remove federation/* (advisory stub, no protocol, no signature\n  enforcement). Cross-cluster posture exchange lives in Cloud.\n- Remove sandbox/* (node:vm is not a security boundary). Use OS-level\n  isolation; action-gating remains as plain policy \n[…]\ndit events are NOT\n  hash-chained by default — wrap with createIntegrityAudit().\n\n1348 / 1348 tests pass. Build clean. Lint clean.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.10.0 — scope honesty release",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T11:25:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "adda21416176e88e74c314ed1da274f48d5ff176",
          "body": "wiring path, scope caveats across standards modules\n\nScore inflation + weight rationale:\n- Document WHY each of the 7 dimension weights is what it is, in the\n  source. Opinionated defaults (identity/permissions 1.5, guardrails 1.3,\n  observability 1.2, auditability/compliance 1.0, lifecycle 0.8), no\n[…]\ncs\" and \"OpenTelemetry\n  integration\" wording to accurately reflect the zero-dep nature.\n\nTests: 1369 -> 1381 (+12), all additive.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "P1 polish: scoring rationale, kill-switch priority clamp, ML classifier",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T10:51:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c5c752742a81cc49875b444b04ee63a681ec8508",
          "body": "Address 11 launch blockers from the pre-HN audit. Where tractable, ship real\nfeature completions rather than just rewording; where not, reframe honestly.\n\nReal feature completions (new code, not just README):\n\n- Sandbox: add runInVmSandbox() using node:vm for real execution isolation\n  (timeout, no \n[…]\nwhile adding real CycloneDX via\na new export path.\n\nTests: 1291 -> 1369 (+78), all additive, zero regressions.\nLint + build clean.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "pre-launch hardening: honesty + real feature completions",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-15T10:34:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "020bd68c7a31da10eb64926a5828c384c3e5b5bd",
          "body": "- scripts/build-og-image.mjs uses satori + resvg to render a 1280x640 card\n  with wordmark, tagline, a working code snippet showing a blocked outcome,\n  and the standards footer strip (EU AI Act / OWASP / NIST / ISO 42001)\n- Fonts (Inter + JetBrains Mono, SIL OFL) auto-download on first run, so\n  th\n[…]\nial\n  preview can reference it without a regen step\n- satori + @resvg/resvg-js added as root devDependencies (generator-only;\n  not shipped in any published tarball — zero-dep rule intact for the SDK)",
          "is_bot": false,
          "headline": "chore: add OG social-preview image + reproducible generator",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T22:34:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f4b2573ec86bfb95d5c7401d0e0054c239867a53",
          "body": "The package README (shown on npmjs.com/package/governance-sdk) was stale\nrelative to the root README. Sync so the next release automatically ships\nthe updated comparison table, badges, feature coverage, and tamper-evident\naudit proof snippet. No release cut — ships with the next code release.",
          "is_bot": false,
          "headline": "docs(sdk): sync package README to monorepo root",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T22:24:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15eaa98da8b5d46f41c2219ee3438702e1a7819f",
          "body": "…overage\n\n- Add comparison table (vs NeMo Guardrails, Guardrails AI, LangChain guardrails)\n- Add badges: install size, dependencies-0, types, CI\n- Expand Features from 6 sections to 11 (adds OWASP Agentic, NIST AI RMF,\n  ISO 42001, Ed25519 agent identity, supply chain + SBOM, eval loop + red team,\n \n[…]\ndd top-level examples/README.md explaining local/ hosted/ demo-app/ shared/\n- Bump examples governance-sdk dep from ^0.8.2 to ^0.9.0\n- Add version + description + license to root monorepo package.json",
          "is_bot": false,
          "headline": "docs: major README rewrite — comparison table, badges, full feature c…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T22:21:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "47f02736f26c1a77967b019bbcf71a274ed4d3a9",
          "body": "… fix stale badges\n\n- Untrack and gitignore CLAUDE.md (root + packages/governance) — internal dev notes\n- Align root engines to >=20 (matches governance-sdk requirement)\n- Replace hardcoded test-count badge with live CI status badge\n- Drop stale '945+ tests' line from CONTRIBUTING\n- Add keywords to \n[…]\nbility\n- Add tag-vs-version verification step to publish workflow\n- Replace :white_check_mark:/:x: shortcodes with Unicode in SECURITY.md\n- Add top-level CHANGELOG.md pointing to per-package changelog",
          "is_bot": false,
          "headline": "chore(oss): pre-publish hygiene — gitignore CLAUDE.md, align engines,…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T22:15:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5bb292094782348d5ee6b4d5f0a7c988a7f8321d",
          "body": "Node 18 reached EOL in April 2025 and several existing crypto-heavy\ntests (Ed25519 agent identity, HMAC audit-integrity chain, agent\nidentity tokens) fail on Node 18 in CI. Node 20+ has been green\nthroughout.\n\n- engines.node bumped from >=18 to >=20 in governance-sdk\n- CI matrix dropped 18, added 24 (current LTS)\n- CHANGELOG entry under 0.9.0 (Breaking)",
          "is_bot": false,
          "headline": "chore(sdk): drop Node 18 support; CI matrix is now [20, 22, 24]",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T21:55:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d36341bb23b17a2801e0ad84db42bed7c6c98ec",
          "body": "Removed adapter stubs that didn't meaningfully govern anything:\n\n- plugins/crewai, plugins/autogen, plugins/semantic-kernel — primarily\n  Python / C# frameworks; the JS stubs don't map onto the real agent\n  runtimes. Python support is via the Lua Governance REST API.\n- plugins/a2a — inter-agent mess\n[…]\napter.\n\nREADMEs refactored to a single Featured tier (10 adapters) and a\nSpecialty tier (MCP, Bedrock) with honest scope framing. The prior\n\"20 adapters\" marketing claim is retired.\n\n1,291 tests pass.",
          "is_bot": false,
          "headline": "chore(sdk): prune 8 unsupported adapter stubs; bump to 0.9.0",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T21:42:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4fb9147498263bf923972c3b2612bbbe90bf0108",
          "body": "Every featured adapter now supports input pre-scan, output post-scan,\nstreaming post-scan (buffered / sliding / per-chunk), and tool-call\nenforcement. Shared helpers in pre-post-enforce.ts + pre-post-stream.ts.\n\nNew exports per adapter:\n\n- Vercel AI: createGovernanceMiddleware returns transformParam\n[…]\n; opt out per stage via { preprocess: false }\nor { postprocess: false }. Streaming mode defaults to \"buffered\" —\nthe safest option, swappable to \"sliding\" / \"per-chunk\" per adapter.\n\n1,395 tests pass.",
          "is_bot": false,
          "headline": "feat(sdk): full pre/post + streaming coverage across featured adapters",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T21:42:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27653a6cb7ba1ff54eabac3a6de78129556dcd24",
          "body": "Two new helper modules that every framework adapter with LLM input/\noutput scanning routes through. Keeps outcome handling, masking, and\ncallbacks consistent across adapters.\n\npre-post-enforce.ts:\n  - enforcePreprocess(gov, text, options) — pre-scan user input before\n    the LLM sees it. Throws on b\n[…]\ns are caught\n      * per-chunk: fastest, weakest — scans each chunk in isolation\n  - Chunk-type-agnostic via extractText / buildMaskedChunk callbacks,\n    so each adapter plugs in its own chunk shape.",
          "is_bot": false,
          "headline": "feat(sdk): add shared pre/post + streaming enforcement core",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T21:41:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d1c27412edd01380bdddb2858471f103c37694e8",
          "body": "Tighten the lead-paragraph callout, rewrite the bottom Governance\nCloud section with a side-by-side OSS vs Cloud capability table, and\nlink each Known Limitation to the cloud feature that addresses it\nso OSS readers can self-discover the upgrade path. Drop the stale\nreference to the private \"governance-sdk-enterprise\" package — that\nname shouldn't appear in the public README.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: sharpen Governance Cloud upgrade CTAs in SDK README",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-14T14:20:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "022b70cd604a70fab6d9cfb48fa1a5720dbdf814",
          "body": "New policy condition that gates tool calls behind Ed25519 identity\nverification. The SDK stays zero-dep and synchronous — the host (API\nlayer) sets two booleans on EnforcementContext before the engine runs:\n\n  identityVerified: true/false/undefined\n  identityCapabilityMatch: true/false/undefined\n\nTh\n[…]\nset builder in policy-presets.ts\n- Stage default mapping (process)\n- 9 tests covering all verification states\n- Bump 0.8.4 → 0.8.5\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add require_signed_identity condition + preset builder (0.8.5)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-10T08:51:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9f111247c3e7ae9a2aa9eeb996fe9f82b3a105f8",
          "body": null,
          "is_bot": false,
          "headline": "chore(sdk): expand keywords for npm discoverability, bump 0.8.4",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-08T01:36:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f6ab411bdee7499689dcd0c6335d2f200e14387a",
          "body": "Published 0.8.1 and 0.8.2 shipped a broken ESM import in\ndist/repo-patterns.js (`from \"./import-lexer\"` without .js).\nNode strict ESM resolution rejects the extensionless path,\ncrashing any consumer that imports repo-patterns at runtime.\nWebpack/Turbopack tolerated it on the host, masking the bug,\nb\n[…]\nAdd .js to the source so future builds (and any future drift\nin fix-esm-imports.mjs) stay correct.\n\nBumps governance-sdk to 0.8.3.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: add .js extension to import-lexer import in repo-patterns",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-08T00:14:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e599df8eea91e66250bb3ff36fc2f2396befe959",
          "body": "Adds an optional `id` field to AgentRegistration so callers can bind a\nnew dashboard record to a framework's canonical agent id (e.g. Lua's\n`agent.agentId` from `lua.skill.yaml`) instead of letting register()\ngenerate a UUID. Solves the \"first runtime enforce() call creates a\nduplicate agent\" proble\n[…]\ntadata.\n    Convention key `externalId` is what consumers map to the\n    register-time `id` field.\n\nBumps governance-sdk to 0.8.2.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(register): caller-supplied agent id for identity binding",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-07T22:57:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "04a0424156429fded9ccd4e9c0ff0805e9ce19dd",
          "body": "Adds an extensibility surface for repo scanning so frameworks with\nnon-trivial tool layouts (skill containers, factory packages, etc.)\ncan plug in their own detection logic without bloating the SDK core.\n\n  - New ScannerPlugin interface (scanner-plugins/types) with\n    ownsImport, expandTools, optio\n[…]\nDrop `zod` from AGENT_SIGNAL_DEPS — it's in every TS project and\n    was producing false positives\n\nBumps governance-sdk to 0.8.1.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(scanner): plugin architecture for framework-aware tool detection",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-07T17:12:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d9a404d28b4f88a26f6ad38914a10445c966be81",
          "body": "Agent lifecycle events (registered/updated/deleted) describe state\ntransitions, not runtime behavior. Counting them toward observability\nor governance enforcement scores inflates signals for agents that\nhave done nothing other than be registered.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(scoring): exclude lifecycle events from behavioral signals",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-07T17:11:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "35bead8d6ff2d318b1b895c6f75ca07d81ad6300",
          "body": "GovernanceProcessor now implements processInput and processOutputResult\nin addition to processOutputStep, so a single instance covers preprocess\n(injection scanning, input rules), tool-call enforcement, and postprocess\n(masking, content filtering) via Mastra's standard processor hooks.\n\nAll three li\n[…]\next (userId,\nchannel, threadId) read from Mastra's RequestContext. Existing consumers\nusing only processOutputStep are unaffected.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add Mastra processor lifecycle methods and bump to 0.8.0",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-06T21:56:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "704e1b60d1310b4eabe5794f88058f64ef91d9f2",
          "body": "Adds deleteAgent(id) to the storage interface, with implementations\nfor memory and PostgreSQL adapters. Audit events are preserved.\nTests cover successful delete, isolation between agents, audit\npreservation, and not-found errors.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add deleteAgent to GovernanceStorage and bump to 0.7.2",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-06T11:18:04Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5fc10963ba00f90e4784c83ee536ac7cc82ba08b",
          "body": "- Cloud mode section with connect() diagnostics example\n- Approval flow with waitForApproval() example\n- CLI subcommands (init, connect)\n- Adapter outcome callbacks (onWarn, onMask, onApprovalRequired)\n- Updated test count to 1196\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Update README with cloud mode, resilience, CLI, and approval flows",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-05T11:39:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "dad8d420450a025df8257b84116a3af044c79935",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Bump governance-sdk to 0.7.1",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-05T11:37:22Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "86d0caf2598390150c96840292015d18db8b623f",
          "body": "- connect() returns plan, features, agent quota from /api/v1/connect\n- npx governance-sdk connect — tests API connectivity with diagnostics\n- CLI routes: init (default), connect\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add connect diagnostics and CLI subcommand router",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-05T11:35:40Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9b8fe6a50af5b10556a1c0da5784db4e6ac8e30e",
          "body": "Breaking: GovernanceBlockedError moved from adapter modules to\nplugins/outcome-handler. New: retry/fallback, outcome callbacks,\nconnect(), waitForApproval().\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Bump governance-sdk to 0.7.0",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-05T02:51:03Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1b14de17568619062f8e501068f529a48b36d6ac",
          "body": "All adapters now handle all 5 enforcement outcomes (allow, block, warn,\nrequire_approval, mask) via a shared outcome-handler module. Previously\nonly block was handled; warn, mask, and require_approval were silently\nignored.\n\n- New GovernanceApprovalRequiredError for require_approval outcomes\n- onWarn, onMask, onApprovalRequired callbacks on all adapter configs\n- Removed 18 duplicate GovernanceBlockedError class definitions\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add shared outcome handler for all 20 framework adapters",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-05T02:50:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f20eccc110e74c05300dd98ee82a7df1397444d5",
          "body": "- Exponential backoff retry (3 attempts: 100ms, 500ms, 2s)\n- Configurable fallbackMode: \"allow\" (fail-open) or \"block\" (fail-closed)\n- connect() method for startup health check\n- status() for cached connection state\n- waitForApproval() polls approval endpoint until resolution\n- RemoteEnforcementError.retryable distinguishes transient from permanent\n- 4xx errors throw immediately, 5xx/network errors retry then fallback\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add resilience layer: retry, fallback, connect, waitForApproval",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-05T02:32:48Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9cf0b950b83528f7b96ca30ee423852984b75f7f",
          "body": "The remote enforcer was stripping approvalId and approval from the API\nenvelope when unwrapping the decision. Callers now receive the full\napproval info needed to poll for async approval flows.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Pass approval fields through remote enforce response",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-05T01:02:41Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ec79e0f5014b142752164ea1851f1443a342f6aa",
          "body": "…eet consistency\n\n- Exclude kill switch blocks from block rate (admin action, not agent behavior)\n- Count injection guard policy blocks as injection hits in behavioral signals\n- Scale block penalties with severity (50% block rate → net negative, not +50)\n- Apply behavioral + eval adjustments in scoreFleet (matches scoreAgent path)\n- Recompute fleet summary after adjustments for consistent scores across views\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Fix behavioral scoring: kill switch exclusion, injection counting, fl…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-04T23:38:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8cdf1ead0107fe49aabeba5486d105e414cf1f1c",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Bump governance-sdk to 0.6.2",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-04T23:33:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "297795a538b46f1f30b0ef090158bee7833845fc",
          "body": "AuditEvent.outcome was typed as string with no enforcement.\nThe SDK wrote \"blocked\"/\"allowed\" while the API wrote \"block\"/\"allow\",\ncausing dashboard stats to silently show 0% block rate.\n\n- Add AuditOutcome type (PolicyOutcome | \"success\" | \"failure\" | \"kill_switch\")\n- Type AuditEvent.outcome as Aud\n[…]\n instead of string\n- Normalize SDK audit writes to use decision.outcome (PolicyOutcome)\n- Update all tests to use canonical values\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add AuditOutcome type, normalize audit outcome values",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-04T23:32:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cff7c2a20ce448a91955871d3ef8edb3610a1f49",
          "body": "…tyles\n\nExtends platform types with OracleSource and OracleContext for the upcoming\noracle system integration. Adds platform.test.ts for contract validation.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add oracle context types to governance-platform and update demo app s…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-04T18:02:12Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4cedbbb1f41f397f684e8da4cc876ed18c185258",
          "body": "Specific token patterns (sk-, ghp_, AKIA) now run before broad\npatterns (aws_secret) to prevent partial matches. System prompt\nleak patterns now redact from trigger phrase to end of sentence.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Fix mask pattern ordering and prompt leak redaction",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-03T12:21:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "20b37426e39fb2389516a9ba6a6f7e13a3727358",
          "body": "New PolicyOutcome \"mask\" that redacts sensitive data instead of\nblocking. Includes masking helpers, presets (maskSensitiveOutput,\nmaskOutputPattern), and maskedText field on EnforcementDecision.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add mask outcome for non-blocking data redaction",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-03T11:21:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "aa9ed20b0413cbcd60c6d0690a696f7a8f8b7556",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Bump SDK to 0.5.2, platform to 0.1.3 (homepage fix)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-03T10:13:28Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "67141dc1968c66df62dc31e51ceeebfe311837be",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Replace heylua.ai/governance URLs with heygovernance.ai",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-03T10:12:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6fb37c87d4966081b5cea472f4350ad0295841da",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add platform README, bump to 0.1.2",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-03T10:07:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5e5352187d03cac633a720449facc1ae065c71b9",
          "body": "npm OIDC trusted publishing requires public repos. Use NPM_TOKEN\nsecret until repo is made public, then switch back to --provenance.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Switch publish to npm token (private repo blocks OIDC provenance)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-03T08:21:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "307a524977ee6708114723bff415d7e841e0dbe7",
          "body": "npm install -g npm@latest fails on Node 22 (MODULE_NOT_FOUND\nfor promise-retry). Node 24 ships with npm 11 natively.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Use Node 24 in publish workflow for npm 11+ OIDC support",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-03T08:13:21Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9647116ec5c06398e1338bf37ffb35459d02520f",
          "body": "Upgrade npm in CI to get npm >= 11.5.1 required for trusted\npublishing (OIDC). Node 22 ships npm 10.9.4 which silently\nfails the OIDC token exchange, returning 404 on PUT.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Bump SDK to 0.5.1, platform to 0.1.1; fix OIDC publish",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-03T08:12:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ea8ff74bab7690215b9caa9ca6c8b5edcea547ed",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Exclude source maps from published package (1.2MB → 741KB)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T17:48:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1b83ae1874409f71284e2f807cffcda4ef9d3afe",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Switch npm publish to Trusted Publishing (OIDC provenance)",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T17:39:27Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "94446ea8a560d1017a43885bb483759d269f4df1",
          "body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Regenerate package-lock.json for governance-sdk rename",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T17:37:27Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a802841418c6ec2bbda2975b8afdc3dc52656220",
          "body": "- @lua-ai-global/governance → governance-sdk\n- @lua-ai-global/governance-platform → governance-sdk-platform\n- @lua-ai-global/governance-benchmark → governance-sdk-benchmark\n- CLI bin: lua-governance → governance-sdk\n- Bump all packages to 0.5.0\n- Switch CI and .npmrc from GitHub Packages to npmjs.org\n- Simplify Dockerfile (no scoped auth needed)\n- 1186 tests passing\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Rename to governance-sdk for OSS launch on npmjs.org",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T17:35:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e03e924b00a5185d6d575d387a3d6613181c1637",
          "body": "Storage:\n- organizationId field on StoredAgent and AuditEvent for multi-tenant isolation\n- listAgents() accepts optional organizationId filter\n- PostgreSQL schema adds organization_id columns + composite indexes\n\nPolicy:\n- Condition registry refactored (moved out of inline declaration)\n- Process con\n[…]\n for remote enforce calls\n\nInfrastructure:\n- CI: added lint step\n- Dockerfile: multi-stage build with runtime stage, non-root user\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add multi-tenant storage, pending trace cleanup, audit error hooks",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T16:39:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "09a9124344ab6ca72eea6a0fa3afa9574519d6fa",
          "body": "defaultOutcome is handled by org default policy rules — redundant.\nCompliancePosture should be auto-detected from governance usage, not\nmanual checkboxes. Org settings now has 3 tunables: scoringConfig,\nbehavioralConfig, detectionConfig.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Remove redundant settings: defaultOutcome + CompliancePosture",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T16:21:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "14073753c12c8155d07ae9f8ac42ce25c27ed397",
          "body": "Resource limits (namespaces, extraction tiers) are Honeycomb-specific,\nnot governance concepts. They belong in Honeycomb or HIVE integration,\nnot in the Propolis org settings.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Remove ResourceLimitsConfig from governance platform",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T16:10:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d25e8f937be6eba14ff8bdaf63e3e28045c2ada2",
          "body": "OrgPreferences now includes ScoringConfig (dimension weights, approval\nthreshold), DetectionConfig (injection threshold, max input length),\nResourceLimitsConfig (per-level namespace + extraction limits),\nCompliancePosture (5 self-assessment flags), and defaultOutcome.\n\nAll persisted in org_settings JSONB, read by loadOrgSettings and\nloadPolicyTiers.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add full config types: scoring, detection, resources, compliance",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T16:01:28Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "cfaef44e73a5838ff9d1ee389515f9636b617e53",
          "body": "OrgPreferences now includes optional behavioralConfig with\nblockRateThreshold, recencyBias, and windowSize. Persisted in\norg_settings JSONB. Read/written by loadOrgSettings, saveOrgSettings,\nand loadPolicyTiers.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add BehavioralScoringConfig to org settings",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T15:50:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b3216b351c63b139f8342b857a9664bf0821a7fb",
          "body": "Behavioral scoring was binary (one block = lose all positive adjustments).\nNow uses configurable org-level settings:\n\n- blockRateThreshold (default 0.05): block rate below this is \"clean\"\n- recencyBias (default 0.7): recent events weighted more than old ones\n- windowSize (default 200): only consider\n[…]\n.2 (permissive).\nMoving average via recency weighting means one bad day doesn't\npermanently tank the score — recovery is possible.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add configurable behavioral scoring: threshold, recency bias, window",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T15:45:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0e9012361041e86e21c310c6ddc034f0801cb250",
          "body": "Activity-based boosts (identity, observability, auditability, lifecycle)\nwere rewarding agents even when 100% of their activity was blocked.\nA rogue agent making 10 blocked calls got +5 on four dimensions just\nfor \"having activity.\"\n\nNow: positive adjustments only apply when blockRate === 0 (clean r\n[…]\nlock rate (>30%) actively penalizes all dimensions, not just\npermissions/guardrails/compliance. No dimension rewards bad behavior.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Fix behavioral scorer: block rate gates ALL positive adjustments",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T15:39:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "aa46b1618c95de6079dd182ce97b7b91b31290cb",
          "body": "The behavioral scorer was rewarding agents for being blocked by policies.\nA 20% block rate gave +10 to guardrails (\"guardrails working\") and +10\nto compliance (\"operating within policy\"). This is backwards — getting\nblocked means the agent tried to do something it shouldn't.\n\nFixed logic:\n- Zero blo\n[…]\nlso updated red team docs: results measure policy effectiveness,\nNOT agent behavior. Should not be submitted to gov.eval.submit().\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Fix behavioral scoring: blocks are bad behavior, not good guardrails",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T15:36:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "49f91e0da256b7175c19c5b8094bfc6e6c5f71cd",
          "body": "…g pipeline\n\n- Token types: HoneycombAgentToken JWT payload, RESOURCE_LIMITS_BY_LEVEL\n- Eval types: EvalTrace, EvalSpan, EvalMetric, EvalResult, TraceCollector\n- Eval trace: in-memory trace collector with per-agent storage\n- Eval scorer: maps eval metrics to governance dimension adjustments\n- Eval r\n[…]\now closes: agents get scored → JWT controls capabilities →\nagents do work → audit + eval signals feed back → score adjusts → loop.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add governance-honeycomb integration: JWT issuance, eval loop, scorin…",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T11:30:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5fe13d5ddc0939b37d3c9a543bca747d0002865c",
          "body": "Benchmark dataset (Lua Injection Benchmark v1.0.0):\n- 6,931 samples from 12 HuggingFace datasets (all MIT/Apache/CC-BY-SA)\n- Triple LLM-audited labels via Groq Llama 3.3 70B (210 corrections)\n- Train/validation/test splits (60/20/20)\n- 53 categories across attack and benign types\n\nBenchmark pipeline\n[…]\n Fine-tuned DeBERTa: 97.3% precision, 72.1% recall, 0.9% FP\n\nML training code and model weights are in governance-cloud (private).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add injection benchmark: 6.9K LLM-audited samples, multi-axis taxonomy",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T06:53:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dc4ac14ea99a561f2c98d929345e320abf903909",
          "body": "Sprint 1 — Competitive gap closure:\n- OWASP Agentic Top 10 compliance module\n- NIST AI RMF compliance module\n- OpenTelemetry hook points (zero-dep span data)\n- Agent identity (HMAC tokens via Web Crypto)\n- MCP tool annotation governance\n\nSprint 2 — Competitive moats:\n- Ed25519 cryptographic identity\n[…]\nondition\n- Built-in injection benchmark (73 curated samples)\n\n1,174 tests, 0 failures, 52 export paths, zero runtime dependencies.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add Sprints 1-3: 17 new modules, injection overhaul, 52 export paths",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T06:52:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c0baffb2d87504f241dd491c8ec64219c512687e",
          "body": "- Add root LICENSE (MIT) and governance-platform LICENSE\n- Add CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md\n- Add GitHub issue/PR templates and dependabot.yml\n- Switch publish target from GitHub Packages to npmjs.org\n- Update CI workflow with Node 18/20/22 matrix and caching\n- Backfill CHANGELOG\n[…]\n references\n- Add bugs/homepage fields to both package.json files\n- Simplify README install instructions (no registry flag needed)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add OSS launch readiness: license, community files, npmjs.org migration",
          "author_name": "scotty595",
          "author_login": "scotty595",
          "committed_at": "2026-04-02T06:52:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 18,
      "commits_last_year": 129,
      "latest_release_at": "2026-07-20T11:54:52Z",
      "latest_release_tag": "v0.19.0",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 9,
      "days_since_latest_release": 6,
      "mean_days_between_releases": 9.1
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "governance-sdk",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "ai-governance",
            "ai-agents",
            "agent-safety",
            "agent-security",
            "policy-engine",
            "prompt-injection",
            "injection-detection",
            "compliance",
            "eu-ai-act",
            "owasp",
            "nist",
            "audit-trail",
            "kill-switch",
            "mcp",
            "mcp-governance",
            "langchain",
            "openai",
            "anthropic",
            "vercel-ai",
            "mastra",
            "llamaindex",
            "human-in-the-loop",
            "approval-workflow",
            "tool-governance",
            "ai-safety",
            "guardrails",
            "typescript"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/governance-sdk",
          "is_deprecated": false,
          "latest_version": "0.19.0",
          "repository_url": "https://github.com/lua-ai-global/governance",
          "versions_count": 35,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 3488,
          "first_published_at": "2026-04-02T17:41:18.897000Z",
          "latest_published_at": "2026-07-20T11:54:50.841000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        },
        {
          "name": "governance-sdk-platform",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/governance-sdk-platform",
          "is_deprecated": false,
          "latest_version": "0.1.3",
          "repository_url": "https://github.com/lua-ai-global/governance",
          "versions_count": 4,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 57,
          "first_published_at": "2026-04-02T18:48:44.807000Z",
          "latest_published_at": "2026-04-03T10:14:17.947000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 114
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 25,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2026-04-20",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 7
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "examples/demo-app/tsconfig.json",
        "examples/tsconfig.json",
        "packages/governance-platform/tsconfig.json",
        "packages/governance/tsconfig.json",
        "research/governance-benchmark/tsconfig.json",
        "tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 59792,
      "source_files_sampled": 247,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "examples/package.json",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "1.1.16",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-mh99-v99m-4gvg"
            ],
            "fixed_version": "5.0.8",
            "advisory_count": 1,
            "oldest_advisory_days": 1
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "5.0.7",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-mh99-v99m-4gvg"
            ],
            "fixed_version": "5.0.8",
            "advisory_count": 1,
            "oldest_advisory_days": 1
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 2
        },
        "advisory_count": 2,
        "affected_count": 2,
        "assessed_count": 279,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 4,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "@babel/code-frame",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/compat-data",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/core",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/generator",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-compilation-targets",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-globals",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-module-imports",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-module-transforms",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-plugin-utils",
            "direct": false,
            "version": "7.28.6",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-string-parser",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-validator-identifier",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-validator-option",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helpers",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/parser",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/plugin-transform-react-jsx-self",
            "direct": false,
            "version": "7.27.1",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/plugin-transform-react-jsx-source",
            "direct": false,
            "version": "7.27.1",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/template",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/traverse",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/types",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/core",
            "direct": false,
            "version": "1.11.1",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/runtime",
            "direct": false,
            "version": "1.11.1",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/wasi-threads",
            "direct": false,
            "version": "1.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/aix-ppc64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-arm",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/darwin-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/darwin-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/freebsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/freebsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-arm",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-ia32",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-loong64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-mips64el",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-ppc64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-riscv64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-s390x",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/netbsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/netbsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openbsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openbsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openharmony-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/sunos-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-ia32",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint-community/eslint-utils",
            "direct": false,
            "version": "4.9.1",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint-community/regexpp",
            "direct": false,
            "version": "4.12.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/config-array",
            "direct": false,
            "version": "0.21.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/config-helpers",
            "direct": false,
            "version": "0.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/core",
            "direct": false,
            "version": "0.17.0",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/eslintrc",
            "direct": false,
            "version": "3.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/js",
            "direct": false,
            "version": "9.39.4",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/object-schema",
            "direct": false,
            "version": "2.1.7",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/plugin-kit",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "@humanfs/core",
            "direct": false,
            "version": "0.19.1",
            "ecosystem": "npm"
          },
          {
            "name": "@humanfs/node",
            "direct": false,
            "version": "0.16.7",
            "ecosystem": "npm"
          },
          {
            "name": "@humanwhocodes/module-importer",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@humanwhocodes/retry",
            "direct": false,
            "version": "0.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/gen-mapping",
            "direct": false,
            "version": "0.3.13",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/remapping",
            "direct": false,
            "version": "2.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/resolve-uri",
            "direct": false,
            "version": "3.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/sourcemap-codec",
            "direct": false,
            "version": "1.5.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/trace-mapping",
            "direct": false,
            "version": "0.3.31",
            "ecosystem": "npm"
          },
          {
            "name": "@napi-rs/wasm-runtime",
            "direct": false,
            "version": "1.1.6",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-project/types",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-android-arm-eabi",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-android-arm64",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-darwin-arm64",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-darwin-x64",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-linux-arm-gnueabihf",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-linux-arm64-gnu",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-linux-arm64-musl",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-linux-x64-gnu",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-linux-x64-musl",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-win32-arm64-msvc",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-win32-ia32-msvc",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@resvg/resvg-js-win32-x64-msvc",
            "direct": false,
            "version": "2.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-android-arm64",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-darwin-arm64",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-darwin-x64",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-freebsd-x64",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-arm-gnueabihf",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-arm64-gnu",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-arm64-musl",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-ppc64-gnu",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-s390x-gnu",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-x64-gnu",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-linux-x64-musl",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-openharmony-arm64",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-wasm32-wasi",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-win32-arm64-msvc",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/binding-win32-x64-msvc",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/pluginutils",
            "direct": false,
            "version": "1.0.0-rc.3",
            "ecosystem": "npm"
          },
          {
            "name": "@rolldown/pluginutils",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@shuding/opentype.js",
            "direct": false,
            "version": "1.4.0-beta.0",
            "ecosystem": "npm"
          },
          {
            "name": "@tybys/wasm-util",
            "direct": false,
            "version": "0.10.3",
            "ecosystem": "npm"
          },
          {
            "name": "@types/babel__core",
            "direct": false,
            "version": "7.20.5",
            "ecosystem": "npm"
          },
          {
            "name": "@types/babel__generator",
            "direct": false,
            "version": "7.27.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/babel__template",
            "direct": false,
            "version": "7.4.4",
            "ecosystem": "npm"
          },
          {
            "name": "@types/babel__traverse",
            "direct": false,
            "version": "7.28.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/estree",
            "direct": false,
            "version": "1.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "@types/json-schema",
            "direct": false,
            "version": "7.0.15",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "24.12.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "25.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "^25.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/react",
            "direct": false,
            "version": "19.2.14",
            "ecosystem": "npm"
          },
          {
            "name": "@types/react-dom",
            "direct": false,
            "version": "19.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/eslint-plugin",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/parser",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/project-service",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/scope-manager",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/tsconfig-utils",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/type-utils",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/types",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/typescript-estree",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/utils",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript-eslint/visitor-keys",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "@vitejs/plugin-react",
            "direct": false,
            "version": "5.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "acorn",
            "direct": false,
            "version": "8.16.0",
            "ecosystem": "npm"
          },
          {
            "name": "acorn-jsx",
            "direct": false,
            "version": "5.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "ajv",
            "direct": false,
            "version": "6.14.0",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-styles",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "argparse",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "balanced-match",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "balanced-match",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "base64-js",
            "direct": false,
            "version": "0.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "baseline-browser-mapping",
            "direct": false,
            "version": "2.11.1",
            "ecosystem": "npm"
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "1.1.16",
            "ecosystem": "npm"
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "5.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "browserslist",
            "direct": false,
            "version": "4.28.7",
            "ecosystem": "npm"
          },
          {
            "name": "callsites",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "camelize",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "caniuse-lite",
            "direct": false,
            "version": "1.0.30001806",
            "ecosystem": "npm"
          },
          {
            "name": "chalk",
            "direct": false,
            "version": "4.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "color-convert",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "color-name",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "concat-map",
            "direct": false,
            "version": "0.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "convert-source-map",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "cross-spawn",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "css-background-parser",
            "direct": false,
            "version": "0.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "css-box-shadow",
            "direct": false,
            "version": "1.0.0-3",
            "ecosystem": "npm"
          },
          {
            "name": "css-color-keywords",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "css-gradient-parser",
            "direct": false,
            "version": "0.0.17",
            "ecosystem": "npm"
          },
          {
            "name": "css-to-react-native",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "csstype",
            "direct": false,
            "version": "3.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "debug",
            "direct": false,
            "version": "4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "deep-is",
            "direct": false,
            "version": "0.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "detect-libc",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "electron-to-chromium",
            "direct": false,
            "version": "1.5.396",
            "ecosystem": "npm"
          },
          {
            "name": "emoji-regex-xs",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "esbuild",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "escalade",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "escape-html",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "escape-string-regexp",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "eslint",
            "direct": false,
            "version": "9.39.4",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-plugin-react-hooks",
            "direct": false,
            "version": "7.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-plugin-react-refresh",
            "direct": false,
            "version": "0.4.26",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-scope",
            "direct": false,
            "version": "8.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-visitor-keys",
            "direct": false,
            "version": "3.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-visitor-keys",
            "direct": false,
            "version": "4.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-visitor-keys",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "espree",
            "direct": false,
            "version": "10.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "esquery",
            "direct": false,
            "version": "1.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "esrecurse",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "estraverse",
            "direct": false,
            "version": "5.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "esutils",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "fast-deep-equal",
            "direct": false,
            "version": "3.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "fast-json-stable-stringify",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "fast-levenshtein",
            "direct": false,
            "version": "2.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "fdir",
            "direct": false,
            "version": "6.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "fflate",
            "direct": false,
            "version": "0.7.4",
            "ecosystem": "npm"
          },
          {
            "name": "file-entry-cache",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "find-up",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "flat-cache",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "flatted",
            "direct": false,
            "version": "3.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "fsevents",
            "direct": false,
            "version": "2.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "gensync",
            "direct": false,
            "version": "1.0.0-beta.2",
            "ecosystem": "npm"
          },
          {
            "name": "glob-parent",
            "direct": false,
            "version": "6.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "globals",
            "direct": false,
            "version": "14.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "globals",
            "direct": false,
            "version": "16.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "governance-sdk",
            "direct": false,
            "version": "0.17.0",
            "ecosystem": "npm"
          },
          {
            "name": "governance-sdk",
            "direct": false,
            "version": "0.19.0",
            "ecosystem": "npm"
          },
          {
            "name": "governance-sdk",
            "direct": false,
            "version": "0.9.0",
            "ecosystem": "npm"
          },
          {
            "name": "governance-sdk-platform",
            "direct": false,
            "version": "0.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "has-flag",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "hermes-estree",
            "direct": false,
            "version": "0.25.1",
            "ecosystem": "npm"
          },
          {
            "name": "hermes-parser",
            "direct": false,
            "version": "0.25.1",
            "ecosystem": "npm"
          },
          {
            "name": "hex-rgb",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "ignore",
            "direct": false,
            "version": "5.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "ignore",
            "direct": false,
            "version": "7.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "import-fresh",
            "direct": false,
            "version": "3.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "imurmurhash",
            "direct": false,
            "version": "0.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "is-extglob",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-glob",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "js-tokens",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "js-yaml",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "jsesc",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "json-buffer",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "json-schema-traverse",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "json-stable-stringify-without-jsonify",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "json5",
            "direct": false,
            "version": "2.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "keyv",
            "direct": false,
            "version": "4.5.4",
            "ecosystem": "npm"
          },
          {
            "name": "levn",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-android-arm64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-darwin-arm64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-darwin-x64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-freebsd-x64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm-gnueabihf",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm64-gnu",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm64-musl",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-x64-gnu",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-x64-musl",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-win32-arm64-msvc",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-win32-x64-msvc",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "linebreak",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "locate-path",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.merge",
            "direct": false,
            "version": "4.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "lru-cache",
            "direct": false,
            "version": "5.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "minimatch",
            "direct": false,
            "version": "10.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "minimatch",
            "direct": false,
            "version": "3.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "ms",
            "direct": false,
            "version": "2.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.16",
            "ecosystem": "npm"
          },
          {
            "name": "natural-compare",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "node-releases",
            "direct": false,
            "version": "2.0.51",
            "ecosystem": "npm"
          },
          {
            "name": "optionator",
            "direct": false,
            "version": "0.9.4",
            "ecosystem": "npm"
          },
          {
            "name": "p-limit",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-locate",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "pako",
            "direct": false,
            "version": "0.2.9",
            "ecosystem": "npm"
          },
          {
            "name": "parent-module",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "parse-css-color",
            "direct": false,
            "version": "0.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "path-exists",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picocolors",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "postcss",
            "direct": false,
            "version": "8.5.23",
            "ecosystem": "npm"
          },
          {
            "name": "postcss-value-parser",
            "direct": false,
            "version": "4.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "prelude-ls",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "punycode",
            "direct": false,
            "version": "2.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "react",
            "direct": false,
            "version": "19.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "react-dom",
            "direct": false,
            "version": "19.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "react-refresh",
            "direct": false,
            "version": "0.18.0",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-from",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "rolldown",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "satori",
            "direct": false,
            "version": "0.26.0",
            "ecosystem": "npm"
          },
          {
            "name": "scheduler",
            "direct": false,
            "version": "0.27.0",
            "ecosystem": "npm"
          },
          {
            "name": "semver",
            "direct": false,
            "version": "6.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "semver",
            "direct": false,
            "version": "7.7.4",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-command",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-regex",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "source-map-js",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "string.prototype.codepointat",
            "direct": false,
            "version": "0.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "strip-json-comments",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "supports-color",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "tiny-inflate",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "tinyglobby",
            "direct": false,
            "version": "0.2.17",
            "ecosystem": "npm"
          },
          {
            "name": "ts-api-utils",
            "direct": false,
            "version": "2.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "tslib",
            "direct": false,
            "version": "2.8.1",
            "ecosystem": "npm"
          },
          {
            "name": "tsx",
            "direct": false,
            "version": "4.22.4",
            "ecosystem": "npm"
          },
          {
            "name": "tsx",
            "direct": false,
            "version": "^4.19.0",
            "ecosystem": "npm"
          },
          {
            "name": "tsx",
            "direct": false,
            "version": "^4.22.4",
            "ecosystem": "npm"
          },
          {
            "name": "type-check",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "5.9.3",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "^5.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "typescript-eslint",
            "direct": false,
            "version": "8.57.0",
            "ecosystem": "npm"
          },
          {
            "name": "undici-types",
            "direct": false,
            "version": "7.16.0",
            "ecosystem": "npm"
          },
          {
            "name": "undici-types",
            "direct": false,
            "version": "7.18.2",
            "ecosystem": "npm"
          },
          {
            "name": "unicode-trie",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "update-browserslist-db",
            "direct": false,
            "version": "1.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "uri-js",
            "direct": false,
            "version": "4.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "vite",
            "direct": false,
            "version": "8.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "word-wrap",
            "direct": false,
            "version": "1.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "yallist",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "yocto-queue",
            "direct": false,
            "version": "0.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "yoga-layout",
            "direct": false,
            "version": "3.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "zod",
            "direct": false,
            "version": "4.3.6",
            "ecosystem": "npm"
          },
          {
            "name": "zod-validation-error",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 283,
        "direct_count": 0,
        "indirect_count": 283
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 6,
        "merged_prs": 14,
        "open_issues": 1,
        "closed_ratio": 0.5,
        "closed_issues": 1,
        "closed_unmerged_prs": 26
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "scotty595",
          "commits": 122,
          "avatar_url": "https://avatars.githubusercontent.com/u/19480825?v=4"
        },
        {
          "type": "User",
          "login": "lua-stefan-kruger",
          "commits": 3,
          "avatar_url": "https://avatars.githubusercontent.com/u/19640343?v=4"
        },
        {
          "type": "User",
          "login": "rares04",
          "commits": 2,
          "avatar_url": "https://avatars.githubusercontent.com/u/61703243?v=4"
        }
      ],
      "contributors_sampled": 3,
      "top_contributor_share": 0.961
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "publish.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        "eslint.config.js"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 4,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 1,
            "reason": "Found 3/18 approved changesets -- score normalized to 1",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 4 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 2,
            "reason": "dependency not pinned by hash detected -- score normalized to 2",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 9,
            "reason": "1 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "0a1e18f4dc506a7020d5136579afb8d4279f21f8",
        "ran_at": "2026-07-26T17:59:15Z",
        "aggregate_score": 6.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-26T11:30:56Z",
      "oldest_open_prs": [
        {
          "number": 23,
          "created_at": "2026-06-18T17:43:51Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 31,
          "created_at": "2026-07-09T17:44:10Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 32,
          "created_at": "2026-07-09T17:44:18Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 36,
          "created_at": "2026-07-16T17:44:03Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 37,
          "created_at": "2026-07-16T17:44:20Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 44,
          "created_at": "2026-07-23T17:43:57Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-26T11:28:54Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 42,
          "created_at": "2026-07-21T19:38:48Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/lua-ai-global/governance",
    "host": "github.com",
    "name": "governance",
    "owner": "lua-ai-global"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 67,
      "inputs": {
        "security": 70,
        "vitality": 82,
        "community": 56,
        "governance": 49,
        "engineering": 80
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 82,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "commits_last_year": 129,
              "human_commit_share": 0.97,
              "days_since_last_push": 0,
              "active_weeks_last_year": 9
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "9/52 weeks with commits",
                "points": 6.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "129 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 129
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 18,
              "latest_release_tag": "v0.19.0",
              "releases_from_tags": false,
              "days_since_latest_release": 6,
              "mean_days_between_releases": 9.1
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "18 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 18
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 6 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~9.1 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 9.1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 56,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 22,
            "inputs": {
              "forks": 1,
              "stars": 25,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "25 stars",
                "points": 22.4,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 25
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 59,
            "inputs": {
              "packages": [
                "governance-sdk",
                "governance-sdk-platform"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 3545
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "3,545 downloads/month across npm",
                "points": 47.3,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 3545,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 49,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 24,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 3,
              "top_contributor_share": 0.961
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 96% of commits",
                "points": 0.9,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 96
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "3 contributors",
                "points": 4.1,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 38,
            "inputs": {
              "merged_prs": 14,
              "open_issues": 1,
              "closed_issues": 1,
              "issue_closed_ratio": 0.5,
              "closed_unmerged_prs": 26
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "50% of issues closed",
                "points": 23.4,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 50
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "14/40 decided PRs merged",
                "points": 13.4,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 14,
                      "decided": 40
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 3/18 approved changesets -- score normalized to 1",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 48,
            "inputs": {
              "followers": 10,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "lua-ai-global",
              "public_repos": 9,
              "account_age_days": 633
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "10 followers of lua-ai-global",
                "points": 7.5,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 10,
                      "login": "lua-ai-global"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "9 public repos, account ~1 yr old",
                "points": 10.7,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 9
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 1
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "governance-sdk",
                "governance-sdk-platform"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 6
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "2 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 2,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 6 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "35 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 35
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": "eslint.config.js",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [
                "agent-framework",
                "agent-security",
                "ai-agents",
                "ai-governance",
                "ai-safety",
                "audit-trail",
                "compliance",
                "eu-ai-act",
                "guardrails",
                "injection-detection",
                "iso-42001",
                "kill-switch",
                "llm-security",
                "mcp",
                "nist-ai-rmf",
                "owasp",
                "policy-engine",
                "prompt-injection",
                "typescript",
                "zero-dependencies"
              ],
              "has_wiki": true,
              "homepage": "https://heygovernance.ai",
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://heygovernance.ai",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "20 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 20
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 70,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 63,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 6.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 3/18 approved changesets -- score normalized to 1",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 2",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "1 existing vulnerabilities detected",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 279 resolved dependencies against OSV; 4 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 279
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 4
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 2,
              "affected_packages": 2,
              "assessed_packages": 279,
              "unassessed_packages": 4,
              "affected_by_severity": "high 2",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 279,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 3
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 63,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.918,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "89 of 97 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 89,
                      "sampled": 97
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 74,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "examples/demo-app/tsconfig.json",
                "examples/tsconfig.json",
                "packages/governance-platform/tsconfig.json",
                "packages/governance/tsconfig.json",
                "research/governance-benchmark/tsconfig.json",
                "tsconfig.json"
              ],
              "agent_commit_share": 0.71,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0.03
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": "eslint.config.js",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "examples/demo-app/tsconfig.json, examples/tsconfig.json, packages/governance-platform/tsconfig.json, packages/governance/tsconfig.json, research/governance-benchmark/tsconfig.json, tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples/demo-app/tsconfig.json, examples/tsconfig.json, packages/governance-platform/tsconfig.json, packages/governance/tsconfig.json, research/governance-benchmark/tsconfig.json, tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "71 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 71,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "3 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 3,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 2",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 59792,
              "source_files_sampled": 247,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/247 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 247,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-26T17:59:31.710667Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/l/lua-ai-global/governance.svg",
  "full_name": "lua-ai-global/governance",
  "license_state": "standard",
  "license_spdx": "MIT"
}