mirendev / runtime

每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。

本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "icon": {
      "bytes": 2678,
      "width": 64,
      "height": 64,
      "rejected": [],
      "collected": true,
      "media_type": "image/png",
      "source_url": "https://miren.dev/icon.png",
      "source_type": "homepage",
      "content_hash": "f20fff688aab879029f9c364a5a8f180c054c5188c5f251f093afdc36a920486",
      "candidates_considered": 1
    },
    "repo": {
      "topics": [
        "deployment"
      ],
      "is_fork": false,
      "size_kb": 14486,
      "has_wiki": false,
      "homepage": "https://miren.dev",
      "languages": {
        "C": 4095,
        "Go": 9193341,
        "Nix": 750,
        "Shell": 82672,
        "Python": 47336,
        "Makefile": 10347,
        "Dockerfile": 4635
      },
      "pushed_at": "2026-08-05T13:59:43Z",
      "created_at": "2024-12-06T19:16:11Z",
      "owner_type": "Organization",
      "updated_at": "2026-08-05T01:01:41Z",
      "description": "Runtime by Miren",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://miren.dev",
      "name": "Miren",
      "type": "Organization",
      "login": "mirendev",
      "company": null,
      "location": "United States of America",
      "followers": 48,
      "avatar_url": "https://avatars.githubusercontent.com/u/174767976?v=4",
      "created_at": "2024-07-05T04:53:33Z",
      "is_verified": null,
      "public_repos": 21,
      "account_age_days": 761
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "tip",
          "kind": "other",
          "published_at": "2025-05-20T23:40:22Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "0e37da35d1fe92da49c7db0d437a2aeb58a33a27",
          "body": "…-do-the-build\n\nstackbuild: detect Next.js and run its production build",
          "is_bot": false,
          "headline": "Merge pull request #980 from mirendev/evan/mir-1462-detect-nextjs-and…",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-08-05T01:01:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "84a510548ef3e12156438d13b768c0074073fc08",
          "body": "chown exits non-zero on a missing path, and .next is not guaranteed to\nexist — an app that sets distDir in next.config.js builds elsewhere, and a\nbare chown would fail a build that works on main. Guard on the directory\nexisting so such an app keeps the ownership it has today.\n\nExtend the explicit-script rule to serve and server, not just start. A Next\napp with no start script but a serve script used to get npm run serve; it\nshould not silently drop to a synthesized next start either.",
          "is_bot": false,
          "headline": "address review: guard the .next chown, let serve/server scripts win",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-08-05T00:44:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8f34a75ab588c2ed0efd071c264b114fdc0794b3",
          "body": "Upgrade the runtime toolchain to Go 1.26.5",
          "is_bot": false,
          "headline": "Merge pull request #1017 from mirendev/phinze/go-1-26-toolchain",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T22:58:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32e8b24f38e4b837a4e37e407132e5b1c1e82157",
          "body": "Go 1.26 is now the stable baseline, but the module, builders, dev\nshell, CI linter, and tracking fixtures all remained on Go 1.25.\nMove them together so local, containerized, and CI builds agree\nbefore we adopt the new language and library features.\n\nThe newer linter also surfaces ReverseProxy.Director's Go 1.26\ndeprecation. Migrate the small discovery forwarder to Rewrite while\npreserving its existing X-Forwarded-For behavior.",
          "is_bot": false,
          "headline": "Upgrade the runtime toolchain to Go 1.26.5",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T22:40:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e08f257dcff8047bfa6b68d2ab48a881453dd18",
          "body": "WebCommand no longer short-circuits on Next.js detection. An explicit start\nscript wins — it may launch a custom server, do setup work, or pass extra\nflags that a synthesized `next start` would silently drop. Next reads PORT\nfrom the environment, so routing through the script still binds the platfor\n[…]\nld step runs as root, leaving .next root-owned while the image runs as\nUID 2010. Next writes ISR, image, and prerender caches beneath .next at\nruntime, so chown the tree to the app user before export.",
          "is_bot": false,
          "headline": "address review: honor explicit start script, chown .next to app user",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-08-04T19:19:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1efa6216d4cf2cca90ad02e743a4676b68ddd395",
          "body": "Release v0.13.0",
          "is_bot": false,
          "headline": "Merge pull request #1016 from mirendev/release/v0.13.0",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T19:18:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b18cbff9c4f0d77ea0e42ef2b549715bb9e56087",
          "body": null,
          "is_bot": false,
          "headline": "Release v0.13.0",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T19:11:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db452e2809289e8ac5f220296b763492943d9b2d",
          "body": null,
          "is_bot": false,
          "headline": "Update changelog for v0.13.0",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T19:11:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b156354f6966685988a52b1d8e1b5532c4f26c76",
          "body": "…t-on-features\n\nStop telling readers to enable a labs feature that ships on",
          "is_bot": false,
          "headline": "Merge pull request #1013 from mirendev/phinze/gen-command-docs-defaul…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T18:24:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dc5dd2e9897a3753dc7b9c28737b82a5734569be",
          "body": null,
          "is_bot": false,
          "headline": "docs: stop advertising a labs opt-in for features that default on",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T18:17:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "141ba264a510380c61fe890cb2054501678989e8",
          "body": "…s-gaps\n\nFix the coordinator API port and cover runners in the surrounding docs",
          "is_bot": false,
          "headline": "Merge pull request #1014 from mirendev/phinze/distributed-runners-doc…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T18:15:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bfb291745533e4c8f38d6a22249b79db56729bb3",
          "body": "…r-panic\n\nFix nil-logger panic in the labs default-on test",
          "is_bot": false,
          "headline": "Merge pull request #1015 from mirendev/phinze/fix-labs-init-nil-logge…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T18:14:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d7abf534c84ef8907a9d0a35472c9553213f1dff",
          "body": "PR #1012 made labs.Init require a logger and updated every call site\nthat existed at the time. PR #971 was already in flight with a new\ntest passing nil, which was harmless on the code that branch was cut\nfrom because an empty flag list never touched the logger. Both were\ngreen alone; main panicked the moment the second one merged.",
          "is_bot": false,
          "headline": "Give the labs default-on test a real logger",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T18:07:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5d244a51bed62f0cd16cd6ef90eae29bfdabfb98",
          "body": "…ng guides",
          "is_bot": false,
          "headline": "docs: fix the coordinator API port and cover runners in the neighbori…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T17:57:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6f8aa61db72cc9672ac76286591dbc3aa84fbd99",
          "body": "…buted-runners-by-default-keep-labs-flag-as\n\nEnable distributed runners by default",
          "is_bot": false,
          "headline": "Merge pull request #971 from mirendev/phinze/mir-955-ga-enable-distri…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T17:40:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57e5ef6b2c53c44a2e03795466eb3b61e843e155",
          "body": "…namespace\n\nFetch the container spec through the sandbox ops adapter",
          "is_bot": false,
          "headline": "Merge pull request #1011 from mirendev/phinze/sandbox-container-spec-…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T17:32:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ee60e58e76fe79673a8add29faa724d21851bdb",
          "body": "…escape-hatch-docs\n\nReport where every labs feature landed, and document turning one off",
          "is_bot": false,
          "headline": "Merge pull request #1012 from mirendev/phinze/labs-feature-state-and-…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T17:31:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e1b2839c14ed9f6cdb93a732523d1fd8dda3d01c",
          "body": "Distributed runners graduate to on-by-default in #971, which makes\nMIREN_LABS=-distributedrunners the escape hatch for anyone the new\ndefault bites. Nothing in the docs mentions that lever exists. labs.md\nstill opens by telling you labs features are \"Disabled by default,\"\nwhich stops being true the \n[…]\ner process, not something that repeats identically forever.\n\nInit also requires a logger now instead of treating nil as \"be quiet\".\nThe one caller that wanted silence says so with slog.DiscardHandler.",
          "is_bot": false,
          "headline": "labs: report where every feature landed, and document turning one off",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T17:23:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1091b3a4aa08dcbce27d51413adaf1fc6b243a28",
          "body": "Distributed runners have baked long enough to graduate from the labs\nopt-in. Flip the distributedrunners feature default to on, so every\ncluster gets the distributed scheduler path (plus the runner command\ntree and etcd mTLS) without --labs distributedrunners.\n\nThe labs flag stays as an escape hatch\n[…]\n can\nforce the old path back with MIREN_LABS=-distributedrunners. The parser\nalready handles the \"-\" disable prefix, so this is just a default flip\nplus a regression guard so it can't silently revert.",
          "is_bot": false,
          "headline": "Enable distributed runners by default",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T17:03:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f4cea55653357d6c5f5cc55eaecde117eb6c1527",
          "body": "The saga's boot-task action called container.Spec on the raw action\ncontext. Every other containerd call in that path goes through\nsandboxOps, which wraps the context with the controller's namespace on\nthe way past, so this one call was the only one running without a\nnamespace.\n\nIt worked anyway, be\n[…]\nts siblings, and the\nsaga mock now refuses an un-namespaced context the way containerd does,\nso going around the adapter fails in a unit test instead of waiting for\nsomeone's client to lack a default.",
          "is_bot": false,
          "headline": "sandbox: fetch the container spec through the ops adapter",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T16:22:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ea267a6c08bf1bff0442bcd0d92caac9ba12f666",
          "body": "…ity-defaults-server-ships-at-debug-runner-at\n\nMake daemon logging deliberate, and stop the audit trail repeating itself",
          "is_bot": false,
          "headline": "Merge pull request #1009 from mirendev/phinze/mir-1503-logging-verbos…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T16:06:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d1efb8a1561d092a8cabc62263f646bcb5784725",
          "body": "…ity-subject-encoding-is-ambiguous-different\n\nMake workload identity subjects unambiguous",
          "is_bot": false,
          "headline": "Merge pull request #1010 from mirendev/phinze/mir-1486-workload-ident…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T16:02:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "99f5d26fa3ca36a076e0aa769ee139c7f72aff4e",
          "body": "Subject claims were assembled as colon-delimited strings even though their\nvalues could contain colons, so distinct workloads could collapse to the\nsame federation identity. Give the grammar an owning type that validates\nevery segment and make token minting accept only that type.\n\nThe parser and round-trip tests pin the encoding property without changing\nany valid subject already in use.",
          "is_bot": false,
          "headline": "Make workload identity subjects unambiguous",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-04T15:45:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4a57ed4373b73e7698c460df2270bf54244b03d1",
          "body": "With daemons defaulting to Info, that tier is what an operator\nactually reads on a live cluster, so it has to stay worth reading. It\nwas not. The codebase has 1,315 Info call sites against 325 Debug,\nwhich is less a considered split than evidence that Info is the level\neveryone reaches for by defaul\n[…]\nidentifier.\n\nThe rubric in CLAUDE.md is the part meant to outlast this change.\nWithout a written rule for what each tier means, Info drifts back into\nbeing the junk drawer within a couple of quarters.",
          "is_bot": false,
          "headline": "Demote steady-state reconcile chatter out of Info",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T22:58:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fad8a3f594f6fc3d29b76acb65ad58e4b1d82454",
          "body": "Measuring before changing the verbosity default turned up something\nthe issue had not anticipated: a coordinator log is dominated by the\naudit trail, not by Debug. On a cluster with two distributed runners,\n`audit cert auth` alone accounted for roughly half of everything the\nprocess wrote. The audit\n[…]\nom the key, since a peer\nreconnecting on a fresh ephemeral port is the same peer and keying on\nit defeated deduplication entirely. The table is bounded so a churning\npeer cannot grow it without limit.",
          "is_bot": false,
          "headline": "Collapse repeated cert-auth audit records",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T22:58:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d2fa1bf56c5d64f3d377df6f1f77d5c5c48e0e42",
          "body": "`miren server install` defaulted --verbosity to -vv, so every\nsystemd-installed coordinator ran at Debug forever, while `runner\ninstall` had no verbosity option at all and inherited the bare CLI\ndefault of Warn. Neither value was chosen for the job it was doing.\n\nThe CLI ladder is right for a one-sh\n[…]\ntrypoint, or by hand)\ninstead of depending on every launch path remembering a flag. Not\nremembering is how we got here. The install paths and the container\nentrypoint no longer bake a level in at all.",
          "is_bot": false,
          "headline": "Give daemons their own log level default",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T22:58:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c36515e7d8cae804b0d602d01446143fea8e93cb",
          "body": "…tatus-always-reports-sandboxes-0-running\n\nFix `miren runner status` always reporting zero sandboxes",
          "is_bot": false,
          "headline": "Merge pull request #1008 from mirendev/phinze/mir-1502-miren-runner-s…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T22:31:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f6ad3e9a5449f719840c9dc35a065900258beaf",
          "body": "`miren runner status` reported \"Sandboxes: 0 running\" on every runner,\nincluding ones carrying a full workload. It counted entries in a\ncontainerd directory that does not exist, because the task tree lives\nunder containerd's state dir rather than its root, and every ReadDir\nfailure was swallowed int\n[…]\nn unreadable config no longer\nreports \"not configured\", an unparseable pidfile no longer prints no\nstatus line at all, and a pid we lack permission to signal is now\nreported running rather than stale.",
          "is_bot": false,
          "headline": "Source runner status sandbox count from the coordinator",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T22:24:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8eda257dfec2dd2ce492a553f39cb6e7f7e87be8",
          "body": "…onentintegration-port-collision\n\ntestutils: make GetFreePort return distinct ports per process",
          "is_bot": false,
          "headline": "Merge pull request #981 from mirendev/evan/mir-720-flaky-testetcdcomp…",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-08-03T22:17:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "481e2a5cc8feaf0f3dfd19c3900720159b3dd5dc",
          "body": "GetFreePort verified 127.0.0.1:P, but the callers that motivated this\nfix do not bind loopback. The etcd component runs with host networking\nand binds 0.0.0.0, so a port already held on a non-loopback address --\nan outbound connection's source port, say -- sails through the loopback\ncheck and then f\n[…]\nns apart in the failure message. Now\nthat duplicates and TCP/UDP contention share one attempt budget, a bare\n\"failed after 20 attempts\" would point the next person debugging this\nat the wrong culprit.",
          "is_bot": false,
          "headline": "testutils: check port availability on the wildcard address",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T22:07:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "accea33abfdee464c1ba881347aefe584639851e",
          "body": "Nag in Slack while code scanning alerts are open",
          "is_bot": false,
          "headline": "Merge pull request #1007 from mirendev/phinze/code-scanning-slack-watch",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T21:52:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d64a8ef0ed5f38333ff1391577194ceb9a58bd55",
          "body": "Five alerts sat open on main for months, two of them since May, and nothing\ntold anyone. The natural fix would be to react to the alert itself, but\nGitHub Actions has no code_scanning_alert trigger, so a scheduled poll is\nthe only option that does not mean standing up a webhook receiver.\n\nIt queries\n[…]\nth would\notherwise go untested until the first real alert, exactly when a silent\nfailure costs the most; the force_post dispatch input posts regardless of\ncount so the wiring can be checked on demand.",
          "is_bot": false,
          "headline": "Nag in Slack while code scanning alerts are open",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T21:45:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "40a4fcdbd6b3e1354b13a43220d94a6841adf202",
          "body": "…registrations-for-deleted-san\n\nRelease sandbox token state at teardown, not entity delete",
          "is_bot": false,
          "headline": "Merge pull request #1002 from mirendev/mir-1512-tokenrefresher-leaks-…",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-08-03T21:28:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9d50f1fd89dd964e839dcc2bcac8c2a9775ca550",
          "body": "Passing the sandbox into StopSandbox woke up an entity-IP fallback that\nhad been unreachable from Delete, where the entity lookup always missed.\nDelete events do carry the prior entity, so the fallback now fires on\nthe periodic sweep an hour after teardown, reading addresses the sandbox\nreleased lon\n[…]\n fallback.\n\nThe self-heal in refreshTokens now releases through ReleaseTokenState so\nit clears the token secret too, rather than dropping the refresher entry\nand leaving a departed sandbox authorized.",
          "is_bot": false,
          "headline": "address review: don't release a DEAD sandbox's recorded IPs",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-08-03T21:02:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9302785b2a0fdde6b4e4e6c6fe72e55e19bae7fc",
          "body": "tokenRefresher.snapshot() kept handing back entries for sandboxes that\nhad already exited, so every 45 minutes the refresh loop minted a fresh\nJWT and tried to write it to a file teardown had already deleted.\n\nThe unregister only ever ran from Delete, which is the entity-delete\ncallback, and nothing\n[…]\nfact.\n\nThe refresh loop now also drops an entry when the write comes back\nENOENT. Teardown should have unregistered it already, so a non-zero\ncount logs as a signal that some path skipped the cleanup.",
          "is_bot": false,
          "headline": "Release sandbox token state at teardown, not entity delete",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-08-03T21:02:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f8eeef0d42fa7b905a542fa5b0e829a25a045ea6",
          "body": "…ckslash\n\nReject backslash-prefixed return paths in password auth",
          "is_bot": false,
          "headline": "Merge pull request #1006 from mirendev/phinze/codeql-open-redirect-ba…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T21:01:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "43094f3f222d7cd597397fd5ad44dcd59860c848",
          "body": "Check archive entry names with filepath.IsLocal",
          "is_bot": false,
          "headline": "Merge pull request #1005 from mirendev/phinze/codeql-zipslip-islocal",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T21:00:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a16e1e699b656ce1d87404a3fdb1b9ddb05710c1",
          "body": "…ma-reindex-cannot-converge-after-exceeding-the\n\nMake automatic schema reindex actually converge",
          "is_bot": false,
          "headline": "Merge pull request #1004 from mirendev/phinze/mir-1496-automatic-sche…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T21:00:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3fedcc6d8cdf9fa2b7a436a9babec13c54841fc5",
          "body": "…e-test-output\n\ntestfmt: replay output from tests that never report a result",
          "is_bot": false,
          "headline": "Merge pull request #993 from mirendev/phinze/testfmt-replay-incomplet…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T21:00:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e22dd9f3bc88158914ca7080d9c6fad1f8a098d0",
          "body": "The automatic reindex ran inline during coordinator startup, inside\nthe two-minute maintenance deadline shared with the migration steps.\nIt was the heaviest thing in that budget and the most likely to blow\nit. When it did, the partial pass was thrown away and the next boot\nstarted over from the firs\n[…]\nh before the coordinator serves.\n\nA schema change landing mid-reindex resets the cursor rather than\nfinishing the stale scan, since completing it would record a hash the\nstore does not actually match.",
          "is_bot": false,
          "headline": "Run schema reindex in the background instead of at startup",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:51:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ee3280d49ef871875094c793bc7f5f76e4d976e1",
          "body": "Reindex listed every entity ID up front and always walked the slice\nfrom the beginning, so a store too large to finish in one run had no\nway to pick up where it stopped. Combined with the schema hash only\nbeing recorded after a complete run, that meant a reindex which ran\nout of time redid the same \n[…]\ninstead of one, since a cursor reached before a\ndeadline is still real progress.\n\nProgress persists next to the existing index-hash key, which keeps\nits name so existing clusters carry over untouched.",
          "is_bot": false,
          "headline": "Make entity reindex resumable across bounded passes",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:51:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4fb0c60df6cda11bec29a33e0df4a68b65770267",
          "body": "sanitizeReturnPath rejected \"//evil.com\" but let \"/\\evil.com\" through intact.\nBrowsers normalize backslashes to forward slashes before parsing a URL, so\nChrome and Firefox read that Location header as \"//evil.com\" and follow it\noff-site. net/url disagrees, which is exactly why it slipped past: to Go\n[…]\nr host. Naming it\nisValidRedirect is deliberate: CodeQL's open-redirect query recognizes guards\nby that name as sanitizers, which closes go/unvalidated-url-redirection\nalongside go/bad-redirect-check.",
          "is_bot": false,
          "headline": "Reject backslash-prefixed return paths in password auth",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:49:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0498ba6c168a0978ac754708aac0481ed59b9ee3",
          "body": "#988 made tar extraction safe but CodeQL never agreed. The scan that closed\nthe old zip-slip alert opened three new ones in the same second, because the\ncontainment guard is written in a shape the query cannot read.\n\nCodeQL's zip-slip model recognizes exactly four sanitizer guards, and the\nrelevant \n[…]\nr\nchange rides along: a \"..\" entry now errors instead of being silently\nskipped, matching what the CLI extractor already did. Empty entry names error\ntoo, rather than resolving to the extraction root.",
          "is_bot": false,
          "headline": "Check archive entry names with filepath.IsLocal",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:49:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f6ca28e2199f903507da131e8c5075f6532b7dbd",
          "body": "…back\n\nBind VictoriaMetrics and VictoriaLogs to loopback",
          "is_bot": false,
          "headline": "Merge pull request #998 from mirendev/phinze/mir-1483-bind-vm-vl-loop…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:27:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ce9116a51a7f62e2235db9dc33e5dc80f12b1533",
          "body": "…uto-mount-leaks-onto-sibling-services\n\nStop shimming local disks onto services that never declared one",
          "is_bot": false,
          "headline": "Merge pull request #997 from mirendev/phinze/mir-1504-local-storage-a…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:26:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8fd6d6a9b6461bffbaff76c0c2775d8ede992e4",
          "body": "…ox-ips-keep-a-stale-dns-mapping-so-the-new\n\nMake the sandbox IP ownership map authoritative",
          "is_bot": false,
          "headline": "Merge pull request #1003 from mirendev/phinze/mir-1511-recycled-sandb…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:18:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "38833c69030d86f629831347c12d7e75ab7e9d90",
          "body": "A sandbox that landed on a recently-recycled address could never obtain\na workload identity token. The token server resolves a caller's identity\nby looking its source address up in the DNS server's map, and nothing\never corrected an entry once it named the wrong sandbox: deletes bailed\nout when anot\n[…]\niming. The token server\ntreats a failed verification as evidence the mapping may be wrong and\nre-derives it once before rejecting, so a bad entry costs one request\nrather than the life of the sandbox.",
          "is_bot": false,
          "headline": "Make the sandbox IP ownership map authoritative",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:10:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "59fdb49aab971de59dc4fd1eb8e2c3aebf008f3d",
          "body": "…-lost-after-miren-restart-for-recovered\n\nRe-register sandbox metrics for containers that survive a restart",
          "is_bot": false,
          "headline": "Merge pull request #999 from mirendev/phinze/mir-1013-sandbox-metrics…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:06:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8532f702d2d4b416af719bd8982ce02377e51a49",
          "body": "…lusters-advertise-unreachable-addresses\n\nMake tailnet-only clusters reachable",
          "is_bot": false,
          "headline": "Merge pull request #1001 from mirendev/phinze/mir-1509-tailnet-only-c…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T20:01:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a4c25be29cece78b2aa0147687d44bbd7e339ca1",
          "body": "…-lifecycle\n\nMove deployment lifecycle server-side",
          "is_bot": false,
          "headline": "Merge pull request #975 from mirendev/mir-681-server-owned-deployment…",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-08-03T19:19:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b457b787cbfcea04383dbe3a4dc838586fbf1e2",
          "body": "Nothing tied together the pieces you need for a host with no public\naddress, so the answers lived in a support thread. This walks through\nsetup, why app certificates have to use a DNS-01 challenge, and how\napp traffic reaches you.\n\nAlso documents additional_ips as an advertisement control. It has\nalways forced an address into the advertised list, but both\nserver-config and tls described it purely as a certificate setting,\nso nobody would have found it for the thing it's most useful for.",
          "is_bot": false,
          "headline": "Add a guide for running Miren on a tailnet",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T18:49:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b4e734a853cce50c73552b7f4cc4be96cd24353a",
          "body": "A tailnet-only cluster advertised the half of its tailnet that rarely\nworks and dropped the half that does. CGNAT was filtered by name\nwhile the matching IPv6 ULA sailed through as \"private\", so clients\ngot an address family many of them can't route and never saw the one\nthat would have worked.\n\nThe\n[…]\nrt0, flannel and docker0 only\never route to workloads on this host, so they were pure noise in\nevery cluster's list, tailnet or not. Discovery already knew the\ninterface name and was throwing it away.",
          "is_bot": false,
          "headline": "Advertise every address a client might reach us on",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T18:49:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "36e747f721df247bb3e31c8d223854b60f52d57c",
          "body": "…als-omit-initialpacketsize-breaking-every\n\nPin QUIC InitialPacketSize at every client dial site",
          "is_bot": false,
          "headline": "Merge pull request #1000 from mirendev/phinze/mir-1510-client-quic-di…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T17:49:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "148c0acb1835901f1f91f7b93cfb3c8006417121",
          "body": "We pinned the Initial at 1200 bytes in DefaultQUICConfig back in June\nso handshakes would survive 1280-MTU tunnels, but four call sites\nbuild their own quic.Config and never got the memo: cluster add's cert\nextraction, the clientconfig connectivity probe, doctor's reachability\nprobe, and both anywhe\n[…]\nand added a test that\nwalks the tree and fails on any quic.Config literal missing the field.\nThe failure is invisible on any ordinary network, so a convention\nnobody can check was never going to hold.",
          "is_bot": false,
          "headline": "Pin QUIC InitialPacketSize at every client dial site",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-08-03T17:16:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1717b7fde9a6da96feb33b7d06a1eec40bc034d0",
          "body": "When miren restarts, reconcileSandboxesOnBoot adopts the containers\nthat outlived the process: it reattaches log consumers, re-reserves\nIPs, and re-registers workload identity tokens. It never re-registered\ncgroup metrics, so CPU and memory for every recovered sandbox stopped\nat the restart and neve\n[…]\ndboxController.Init delegates to the inner controller's Init.\nThe adoption half needed mirroring and got it in saga_controller.go's\nown same branch. create_saga.go picks up the shared identity helper.",
          "is_bot": false,
          "headline": "Re-register sandbox metrics for containers that survive a restart",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T23:30:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ff4d251a5f9f2c4802ddb00a4bb0274532c12956",
          "body": "…e-subject-claims\n\nBind GitHub CI auth to the repository claims",
          "is_bot": false,
          "headline": "Merge pull request #995 from mirendev/phinze/mir-1491-github-immutabl…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T23:15:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "94fbfa1cb6d961c26be84413d97aebff02de7229",
          "body": "The troubleshooting section promised the CLI reports the rejected subject\nand repository, but that only holds for a binding mismatch. Every other\nauthentication failure stays deliberately generic, which is the point of\nthe disclosure gate, so the docs were offering diagnostics most failures\nwon't show.",
          "is_bot": false,
          "headline": "Scope the subject diagnostics claim to binding mismatches",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T23:00:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "caece6e1d922bcd0ef9388699cba92b038840907",
          "body": "TestConcurrentDeployBlockedByLock backgrounds the first deploy so it can\nrace a second one against it, and the harness only supports\nRunCmdBackground in dev mode. Under the distributed peers topology it hit\nthe harness's t.Fatal instead of skipping.\n\nThat job skipped on every previous run of this br\n[…]\nebasing onto main brought that in.\n\nThe lock is not topology-specific, so covering it in dev mode is enough.\nGuarding on Cluster.IsPeers matches how distributed_runner_test.go\nhandles the mirror case.",
          "is_bot": false,
          "headline": "Skip the concurrent-deploy lock test outside dev mode",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T22:57:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a5fa48b7f45783879917e322b44b314df24c554a",
          "body": "The claim that a binding with a subject pattern predates the immutable\nsubject change and cannot match a post-cutover repo is wrong twice over: a\npattern written today against the new format matches fine (that is the\ndocumented workaround), and so does a wildcard. Point at comparing the\npattern to the subject in the error instead, and name the case that\nactually breaks.",
          "is_bot": false,
          "headline": "Qualify the subject-pattern troubleshooting advice",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T21:52:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f966833586d6237707ed1a57f6438507f48968c",
          "body": "Review caught that the new guard only skipped event_name, so a binding\nbuilt from --issuer and --allowed-refs alone passed it while accepting a\ntoken from any repository pushing to that branch name. A branch name says\nnothing about who is pushing, and neither do ref_type, ref_protected,\nrunner_envir\n[…]\nlaiming a default binding matches all events,\ndocuments that servers want upgrading before a newer CLI creates a\nbinding, and moves the glob-pattern gotcha into an admonition per the\ndocs style guide.",
          "is_bot": false,
          "headline": "Exclude run-scoped claims from the caller-identification check",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T21:52:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "12290f7c63f82f0a0cbd69605763d33e4d0def24",
          "body": "GitHub's immutable subject claims change means any repo created, renamed, or\ntransferred after 2026-07-15 sends a subject like\nrepo:acme@277133432/app@1316584243:ref:refs/heads/main. `miren auth ci add\n--github` built its pattern by concatenating owner/repo, so the binding was\naccepted, stored, and \n[…]\ne come from the caller's own\nverified token, so nothing leaks that they didn't already hold, and the binding\nconfiguration is never included. Every other auth failure stays a bare 401.\n\nFixes MIR-1491",
          "is_bot": false,
          "headline": "Bind GitHub CI auth to the repository claims",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T21:52:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1fe9528f6785c28eea68bc371a3fcfa3a9f51ac5",
          "body": "A grab bag from reviewing the package, none of it behavioural except the\nlast one. All separable from the two commits before it.\n\nCancelDeployment hand-rolled the write that Tracker.Cancel already does,\nsetting cancelled straight on the entity and releasing the lock itself.\nTracker.Cancel had no pro\n[…]\n's deploy history forever, while the active\nindex holds roughly one row per app. A live status now wins. Settled\nstatuses keep preferring the app index, since those really do accumulate\nwithout bound.",
          "is_bot": false,
          "headline": "Clean up the deployment lifecycle package's loose ends",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T21:35:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "02fd51e07f792f9e2ae236dde98c3c41bb5e3a78",
          "body": "The saga actions reimplemented what deployTracking already does for the\nplain path, and the two had already drifted: the saga never advanced the\nrecord's phase, and its settles used the request context and returned\ntheir errors. Those were fixed in the previous commit, but fixed twice,\nin two places\n[…]\n pushing, set-active-version marks\nactivating. Both consume deployment_id as an optional input, which also\nanchors them after begin-deployment, so buildkit cannot start before the\ndeploy lock is held.",
          "is_bot": false,
          "headline": "Share one deployment-tracking implementation across both build paths",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T21:35:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d92fc9c9ae30686c110928fcac96ca1ad84fdbb",
          "body": "The three deployment actions on the saga build path could each fail the\nsaga, and the saga's compensation reverts the app to its previous\nversion. That made the deployment record able to undo the deploy it was\nonly supposed to describe: a settle that lost a race, or a client that\ndisconnected betwee\n[…]\nr deploy and\nyou could not deploy that app again until it expired. The saga entry\npoint now settles the record itself when Execute fails, which is what the\nplain path gets from a deferred failOnError.",
          "is_bot": false,
          "headline": "Keep saga deployment settles from undoing live deploys",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T21:35:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "507f5bb3ef34c3bf38923390e39e844c48aded6f",
          "body": "- Detach the failure-path settles (DeployVersion's Fail, the saga's\n  undoBeginDeployment) so a client disconnect during failure cannot\n  strand the record in_progress with the lock held until its TTL. The\n  success paths already did this; the failure paths were the gap.\n- On the CLI, only show \"dep\n[…]\ney now single-part, rewriting\n  slashes to underscores was the only thing that let two distinct app\n  names collide on one lock.\n- Reword a test comment that described a race the test doesn't perform.",
          "is_bot": false,
          "headline": "Address review feedback",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-07-31T21:35:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ea1c222560c2cd3cb551c713bc45c88f03016a13",
          "body": "With the deploylifecycle package in place, this hands ownership of the\ndeployment record to the servers that actually do the work.\n\nThe build server now owns the record for a build. A new DeployRequest\nparameter on buildFromTar/buildFromPrepared is the ownership signal: when\npresent, the server crea\n[…]\neady live\n(most often a client disconnect at activation) still releases the lock,\nrather than stranding the record in_progress and blocking the app's next\ndeploy for the full lock TTL.\n\nCloses MIR-681",
          "is_bot": false,
          "headline": "Move deployment lifecycle server-side",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-07-31T21:35:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "75a22ed4355bef92963c78c9e966d7586ea3c5ff",
          "body": "Deployment tracking used to be babysat entirely by the CLI: the client\ncreated the record with a \"pending-build\" placeholder, drove it through\nphases, patched in the real version after the build, and marked it active.\nThe server was a dumb CRUD store behind that, so a client crash could\nstrand a rec\n[…]\nit would let those two deploys of the\nsame app run concurrently. This carries forward the reasoning MIR-1465\nestablished for the read path.\n\nIt has no callers yet; the wiring lands in the next commit.",
          "is_bot": false,
          "headline": "Add deploylifecycle package for server-owned deployments",
          "author_name": "Evan Phoenix",
          "author_login": "evanphx",
          "committed_at": "2026-07-31T21:34:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c4399451c9e485f2f76f3f69ece20ba406f19815",
          "body": "A test that dies without a terminal event, whether from a panic, an\nos.Exit, or the process being killed, produces no pass/fail action from\n`go test -json`. It never lands in FailedTests, so every line it had\nbuffered was discarded. The package-level fail event carries only the\ntrailing summary line\n[…]\nh test reached a terminal action and replay the\nbuffers of any that didn't. The package result still owns the exit\ncode, so this is purely additive reporting and can't turn a green run\nred on its own.",
          "is_bot": false,
          "headline": "testfmt: replay output from tests that never report a result",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T21:26:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5fcff54eafae078221a064f2a88e1cfcaded6ee4",
          "body": "Routing runner telemetry through the coordinator made a loopback bind\nsafe, but nothing actually changed the bind. Both backends still came\nup on the wildcard, so the only thing in front of them stayed a\nfirewall rule. On the GCP clusters that rule is the auto-created\ndefault-allow-internal, which p\n[…]\nd address. On a dual-stack host \"localhost\" resolves to ::1 first,\nwhich against a v4-only listener spends a failed dial on every new\nconnection, and the readiness probe would pay that during startup.",
          "is_bot": false,
          "headline": "Bind VictoriaMetrics and VictoriaLogs to loopback",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T21:07:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6216702e7256bf9fdc3181032286e687e08eb679",
          "body": "…lookup-failures-all-collapse-into-timeout-no\n\nMake connection failures and doctor say what actually went wrong",
          "is_bot": false,
          "headline": "Merge pull request #996 from mirendev/phinze/mir-1495-rpc-capability-…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T19:24:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52a3cf882e6d0a7beaa93bf787518f85a2604084",
          "body": "The transitional local-storage auto-mount probes for existing data with\nan app-scoped check, then injects a disk into every service in the app.\nOne service declaring a local disk is enough to make that probe true,\nso its diskless siblings got a disk they never asked for.\n\nThe stray mount was the sma\n[…]\ndisk anywhere in the\napp already accounts for the shared directory, so it shouldn't fire.\nMIR-1423 made this same suppression per-service; the probe is\napp-scoped, so the suppression needed to be too.",
          "is_bot": false,
          "headline": "Stop shimming local disks onto services that never declared one",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T19:10:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "41aaa6c8b3f48f1b5e0120626968520b03ff7902",
          "body": "miren -C some-cluster route list would quietly answer with the *active*\ncluster's routes whenever the named cluster couldn't be loaded. Found it\nwhile building test fixtures: three deliberately broken cluster entries\nall returned a real production cluster's routes, which is the kind of\nthing you onl\n[…]\n\", hiding the actual reason. It now\ndistinguishes the two and shows the cause.\n\nFalling back is still fine when no cluster was named at all, which is\nwhat keeps the bare localhost dev default working.",
          "is_bot": false,
          "headline": "Fail loudly when a selected cluster is unusable",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T19:04:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5b40f2f887667aff682f6c0d098550f9505c7445",
          "body": "miren doctor printed a three-line summary and then told you to go read\nthree other commands, which made it a menu rather than a diagnosis. The\nsubcommands behind it were separate implementations of overlapping work,\nand the conclusions they drew were frequently wrong.\n\nThe clearest example: a stoppe\n[…]\nything else is a fact, and facts belong in the one-line summary.\nThere were no tests for any of this before, so the verdict table now has\none per row, including the original bug as a named regression.",
          "is_bot": false,
          "headline": "Rebuild doctor as a single sweep with real verdicts",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T19:04:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "34f2e3f948ab10c717d829eff5bddcddb61389cd",
          "body": "Every capability lookup failure collapsed into \"error performing http\nrequest: timeout: no recent network activity\", quic-go's idle-timeout\nstring surfaced raw. It named neither the capability being looked up nor\nthe cluster, though both were in scope at the call site.\n\nReproducing the failures agai\n[…]\ness line after 700ms. It goes to stderr\nso it cannot corrupt piped JSON, and rewrites a single line rather than\ntaking over the terminal, so an interrupted connect can never leave\nsomeone in raw mode.",
          "is_bot": false,
          "headline": "Say what actually went wrong when an RPC connection fails",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T19:04:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f1181e0e9ee875d936e37d5cda04a9b6ed462cbf",
          "body": "…y-via-coordinator\n\nRoute runner telemetry through the coordinator",
          "is_bot": false,
          "headline": "Merge pull request #992 from mirendev/phinze/mir-1483-runner-telemetr…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T14:21:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "88c24db2c820fa59679b45b540893e06ae188899",
          "body": "…orkload-issuer\n\nGive every cluster a workload identity issuer",
          "is_bot": false,
          "headline": "Merge pull request #994 from mirendev/phinze/mir-1483-unconditional-w…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-31T14:21:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1196e2d203b373d04d879826abd04055fe10919e",
          "body": "Whether a cluster had a workload identity issuer depended on whether it\nhad a hostname to anchor one to: a Miren Cloud registration, or a\n--dns-names value. A cluster installed with --without-cloud and neither\ngot no issuer at all.\n\nThat made internal authentication conditional on external\naddressab\n[…]\ney just won't federate to AWS or GCP, which is no worse than\nthe nothing they replaced. The docs used to say a bare cluster issues no\ntokens, so they're corrected to separate federation from identity.",
          "is_bot": false,
          "headline": "Give every cluster a workload identity issuer",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T21:42:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1e2068c901f2bd49b21329db9404f7996d3e7274",
          "body": "…orts\n\nThe distributed runners page told operators to open 8428 and 9428\nbetween their machines and warned that both were unauthenticated,\nwhich was honest advice for the old arrangement. Neither port needs to\nbe reachable from a runner now, so the rows come out and the warning\nnarrows to the overlay, which is still unauthenticated and still worth\nsaying so about.",
          "is_bot": false,
          "headline": "docs: runner telemetry no longer needs VictoriaMetrics/VictoriaLogs p…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T18:58:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b8080001a1c563e83539840b2f0ec81d70525ec",
          "body": "With somewhere authenticated to send it, a runner no longer has to dial\nVictoriaMetrics and VictoriaLogs directly. The addresses the\ncoordinator sends at Join are no longer dialed at all; their presence\nis now only the signal that this cluster records telemetry, which keeps\nthe change off the wire f\n[…]\nndler is wired up here too, which is safe precisely because\na runner's own log goes to the journal rather than through this writer,\nso reporting a failure cannot feed back into the buffer that failed.",
          "is_bot": false,
          "headline": "runner: ship telemetry through the coordinator",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T18:57:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8227ff804e8bdcf968454f97c156408ba20f1285",
          "body": "VictoriaMetrics and VictoriaLogs have no authentication of their own,\nand there is no flag that gives them any. Until now the only thing\nbetween a runner network and unauthenticated write access to both was a\nfirewall rule, which is a fine control right up until you run a runner\nsomewhere that has n\n[…]\na runner the rest of both APIs, reads and\ndelete-series included, and a credential that says \"may write\ntelemetry\" sitting in front of a route that means \"may do anything\" is\nnot much of a credential.",
          "is_bot": false,
          "headline": "telemetry: authenticated ingest endpoints on the coordinator",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T18:57:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bad1e37886b684a165a47cfd54a8510452ede7c0",
          "body": "…ener\n\nThe RPC listener already authenticates every caller, and already serves\na couple of plain HTTP routes beside the RPC surface. But the mux was\nbuilt in place with no seam, so a cluster-internal service that wanted\nan authenticated endpoint had no option but to open a port of its own\nand invent\n[…]\ns on method dispatch. A\nhandler has to decide for itself what its caller may do, and must not\nread the ambient identity and assume the answer, since a cluster\ncertificate authenticates as a superuser.",
          "is_bot": false,
          "headline": "rpc: let a server mount extra HTTP handlers on its authenticated list…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T18:57:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e7be369153a74717da777ce45b818a0c16969e21",
          "body": "flush checked for a transport error and then threw the response away\nwithout looking at it, so a batch the backend rejected vanished with no\nsignal at all. A 401 and a success were indistinguishable.\n\nThat is survivable while these logs are a second copy of something also\ngoing to stderr. It stops b\n[…]\nough the ambient logger would feed every failure\nback into the buffer it was complaining about and re-amplify it on each\nflush. The doc comment says so, since the trap is invisible from the\ncall site.",
          "is_bot": false,
          "headline": "observability: stop losing batched logs silently",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T18:57:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9d4ebc56746122129f8005a3a738689f8dafa24c",
          "body": "The writer just learned to honor an address that names its own scheme.\nThe reader still hardcoded http://, so half the package followed one\nrule and half followed another.\n\nNothing depends on the difference today, since the reader only ever\ntalks to a backend on loopback. It is the inconsistency that is worth\nremoving, not a bug.",
          "is_bot": false,
          "headline": "metrics: normalize reader URLs the same way as the writer",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T18:57:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2b9156e221b146f2f802e2ab9ab137745b2875f",
          "body": "The VictoriaMetrics and VictoriaLogs writers each built their own\nhttp.Client and hardcoded a plain-HTTP scheme, which is fine while the\nonly caller is on the same host as the backend. A distributed runner\nisn't: it has to reach telemetry through an authenticated path, which\nmeans a transport this p\n[…]\n// and a base\npath, which is what lets a runner point at a coordinator-mounted\nendpoint instead of at VictoriaMetrics directly.\n\nNo behavior change for existing callers; nothing supplies a client yet.",
          "is_bot": false,
          "headline": "telemetry: let callers supply the writers' HTTP client",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T18:57:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "49ca5d52fd9296ba2e115ffc1ab06c63d47fd9a1",
          "body": "Authenticate the cluster-local OCI registry",
          "is_bot": false,
          "headline": "Merge pull request #991 from mirendev/phinze/mir-1477-registry-auth",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T16:12:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b5bc9c6f9d2c400fd188068befb98265fefbfa19",
          "body": "…-identities\n\nAdd system workload identities",
          "is_bot": false,
          "headline": "Merge pull request #990 from mirendev/phinze/mir-1477-system-workload…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T15:54:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bfd0af7f3de4fc1ed2dc39a716529bb60d02d630",
          "body": "…tarfs-has-no-traversal-check-download_release\n\nKeep tar extraction inside its destination",
          "is_bot": false,
          "headline": "Merge pull request #988 from mirendev/phinze/mir-1475-tar-extraction-…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T15:26:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "557abf4f3b2ac484e495f1c7da410d954fdad249",
          "body": "The registry listens beyond the local node for distributed runners, which left app images and upload storage reachable without credentials.\n\nRequire registry-scoped system workload tokens whenever workload identity is configured. Sandbox controllers get pull-only access while coordinator-side BuildKit gets push access, and distributed runners mint their pull token over the existing mTLS coordinator channel.",
          "is_bot": false,
          "headline": "Authenticate the cluster-local registry",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T04:29:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "132728fc10aa9d2972aa88fdde36ddad945694b9",
          "body": "…ner-overlay-runs-unencrypted-vxlan-not-the\n\nMake WireGuard the only overlay backend",
          "is_bot": false,
          "headline": "Merge pull request #989 from mirendev/phinze/mir-1482-distributed-run…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-30T00:01:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1cf76e45f57ba1b78156ed1ca58e3284d70cecf6",
          "body": "Miren's workload identity system mints tokens for sandboxes, but the\ninternal services we need to protect are reached by Miren's own system\nworkloads. The cluster-local OCI registry is the first: a runner's\nsandbox controller pulls images from the coordinator over the network,\nand today nothing auth\n[…]\nwn audience, and must not inherit the RPC authorizer's permissive\nfallback.\n\nNo caller mints or verifies these yet. The registry and telemetry work\nwill build independently on these shared primitives.",
          "is_bot": false,
          "headline": "Add system workload identities",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-29T22:59:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "12e2b530212aef4ac65a668dfde51e26807c791e",
          "body": "Forced downloads extracted directly over the active release and removed\nthe whole directory after any failure. A malformed archive or transient\ndownload error could therefore destroy the last working installation.\n\nExtract and verify in a sibling staging directory, then swap it into\nplace only after the candidate is complete. Keep the previous directory\navailable for rollback until the replacement succeeds.",
          "is_bot": false,
          "headline": "Preserve the current release until replacement is ready",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-29T22:49:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f150173b6854921e4340167cce11726ae31d31b1",
          "body": "Build contexts reach TarFS before BuildKit can isolate them, but the\nextractor trusted archive entry names. The release downloader checked\nentry paths lexically, but archive symlinks could still point outside\nthe destination.\n\nRoute both extractors through shared containment checks and reject\nwrites through existing symlink components. Release artifacts contain\nonly copied binaries, so reject symlink entries instead of trying to\nsafely reproduce links the format does not need.",
          "is_bot": false,
          "headline": "Keep tar extraction inside its destination",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-29T22:15:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63fa3983bc025398b5888e174356271fbcf1d3a9",
          "body": "The distributed runner overlay is part of our security boundary, but\nits backend was still an operator choice and one option sent sandbox\ntraffic in plaintext. With WireGuard available throughout our supported\nkernel range, keeping VXLAN only preserved an easy way to turn\nencryption off.\n\nRemove the\n[…]\ntup so\nupgrades cannot leave a more-specific plaintext route behind.\n\nThe encryption probe now gives each run unique remote scratch files so\nconcurrent blackbox runs cannot interfere with one another.",
          "is_bot": false,
          "headline": "Make WireGuard the only overlay backend",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-29T22:02:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6442dd4ea084ac17417fa2d3c8105453df11f2c9",
          "body": "…nt-port-bypasses-the-mtls-that\n\nOnly expose etcd off-host when mTLS is protecting it",
          "is_bot": false,
          "headline": "Merge pull request #985 from mirendev/phinze/mir-1481-etcds-http-clie…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-29T21:48:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c01fc497f47fa759df9b581eaacfb5eee05c8c71",
          "body": "Fix dev-distributed rebuild failing on Text file busy",
          "is_bot": false,
          "headline": "Merge pull request #984 from mirendev/phinze/fix-dev-distributed-rebuild",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-29T21:01:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "821f2f2d33a08e888b2b8a22009ffe2b82046439",
          "body": "The distributed runners guide told you to make sure the new machine can\nreach the coordinator on 8443 and stopped there. A runner also dials\netcd directly for Flannel subnet coordination, ships metrics to\nVictoriaMetrics and logs to VictoriaLogs, and carries sandbox traffic\nover a VXLAN overlay, so \n[…]\nches for.\n\nCalled out that the observability and overlay ports carry no\nauthentication of their own, since anyone acting on this is deciding\nwhat to expose and should know which of them are protected.",
          "is_bot": false,
          "headline": "Document the ports a distributed runner needs to reach",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-29T15:21:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3fcb196fbe2afc2b863c6e85592907d9f6a5c07d",
          "body": "…path-filter\n\nRun the distributed CI job when disk or runner code changes",
          "is_bot": false,
          "headline": "Merge pull request #986 from mirendev/phinze/mir-1480-distributed-ci-…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-28T21:40:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "59e0aca5337222bfad63b287542638677ccea38a",
          "body": "…ner-overlay-runs-unencrypted-vxlan-not-the\n\nRemove the stale VXLAN device when the overlay moves to WireGuard",
          "is_bot": false,
          "headline": "Merge pull request #987 from mirendev/phinze/mir-1482-distributed-run…",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-28T21:35:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8c9da855d6ba262c78b7d0fd1788638b7dedbda5",
          "body": "RFD-51 specified WireGuard for the distributed runner overlay and\nrejected VXLAN by name. Migrating the clusters is its own dance and\nisn't here; the shipped default is unchanged. This is the\ngroundwork.\n\nFlannel's VXLAN backend creates flannel.1 and its WireGuard backend\ncreates flannel-wg, and swi\n[…]\ning to assert against.\n\nAlso drop grunge's two silent fallbacks to vxlan, so a setting that\ndecides whether traffic is encrypted can no longer be guessed at,\nand AllLeases(), which never had a caller.",
          "is_bot": false,
          "headline": "Remove the stale VXLAN device when the overlay moves to WireGuard",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-28T20:42:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b979993830b4adf99a79f037b48d38fa812a579",
          "body": "Enabling distributedrunners mints etcd certs for the host's real IPs\nand sets --client-cert-auth, but that only ever covered the gRPC client\nport. --listen-client-http-urls was hardcoded to 0.0.0.0 and etcd does\nnot apply client cert auth to it, so anyone who could reach the box\ncould read and write\n[…]\n an upgrade, so the version is the\nonly thing that forces recreation. Without the bump every existing\ncluster would keep its old container and stay bound to 0.0.0.0 while\nreporting the fix as shipped.",
          "is_bot": false,
          "headline": "Only expose etcd off-host when mTLS is protecting it",
          "author_name": "Paul Hinze",
          "author_login": "phinze",
          "committed_at": "2026-07-28T18:12:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 1,
      "commits_last_year": 2862,
      "latest_release_at": "2025-05-20T23:40:22Z",
      "latest_release_tag": "tip",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 52,
      "days_since_latest_release": 441,
      "mean_days_between_releases": null
    },
    "artifacts": {
      "collected": true,
      "structure": [
        "tree.compose",
        "tree.dockerfile",
        "tree.go_importable",
        "tree.go_main"
      ],
      "declarations": []
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "readme_badges": {
        "hosts": [
          "github.com",
          "shields.io"
        ],
        "total": 4,
        "header": 4,
        "collected": true,
        "has_inspect_badge": false
      },
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "miren.dev/runtime",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "categories": [],
          "matches_repo": null,
          "registry_url": "https://pkg.go.dev/miren.dev/runtime",
          "declared_type": null,
          "is_deprecated": false,
          "latest_version": "v0.13.0",
          "repository_url": null,
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-08-04T19:18:07Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 0
        }
      ]
    },
    "popularity": {
      "forks": 4,
      "stars": 50,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2025-12-10",
            "count": 1
          },
          {
            "date": "2026-03-29",
            "count": 1
          },
          {
            "date": "2026-05-06",
            "count": 1
          },
          {
            "date": "2026-06-02",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 4,
        "total_forks": 4
      },
      "star_history": null,
      "open_issues_and_prs": 7
    },
    "ai_readiness": {
      "has_nix": true,
      "example_dirs": [
        "example",
        "recipes"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "docs/tsconfig.json",
        "testdata/bun/jsconfig.json"
      ],
      "toolchain_manifests": [
        "controllers/sandbox/testdata/heavy-logger/go.mod",
        "controllers/sandbox/testdata/sort/go.mod",
        "controllers/sandbox/testdata/testhttp/go.mod",
        "go.mod",
        "observability/profile/busy_sort/go.mod",
        "pkg/stackbuild/testdata/go-cgo/go.mod",
        "pkg/stackbuild/testdata/go/go.mod",
        "pkg/stackbuild/testdata/rust/Cargo.toml",
        "testdata/bad-command/go.mod",
        "testdata/build-error/go.mod",
        "testdata/crash-loop/go.mod",
        "testdata/crash-on-startup/go.mod",
        "testdata/db-app/go.mod",
        "testdata/dns-test/go.mod",
        "testdata/go-server/go.mod",
        "testdata/local-disk-app/go.mod",
        "testdata/long-shutdown/go.mod",
        "testdata/tcp-echo/go.mod",
        "testdata/websocket-echo/go.mod"
      ],
      "largest_source_bytes": 140510,
      "source_files_sampled": 1118,
      "oversized_source_files": 14,
      "agent_instruction_files": [
        "CLAUDE.md",
        "docs/CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 14465
    },
    "dependencies": {
      "manifests": [
        "docs/package.json",
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "github.com/NimbleMarkets/ntcharts",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.1"
        },
        {
          "name": "github.com/charmbracelet/bubbles",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.20.0"
        },
        {
          "name": "github.com/charmbracelet/bubbletea",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.4"
        },
        {
          "name": "github.com/charmbracelet/lipgloss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/cilium/ebpf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.16.0"
        },
        {
          "name": "github.com/coder/websocket",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.14"
        },
        {
          "name": "github.com/containerd/cgroups/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.5"
        },
        {
          "name": "github.com/containerd/console",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.4"
        },
        {
          "name": "github.com/containerd/containerd",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.23"
        },
        {
          "name": "github.com/containerd/containerd/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.0"
        },
        {
          "name": "github.com/containerd/containerd/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.2"
        },
        {
          "name": "github.com/containerd/errdefs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/containerd/log",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/containerd/platforms",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0-rc.1"
        },
        {
          "name": "github.com/containerd/typeurl/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.2.3"
        },
        {
          "name": "github.com/containernetworking/cni",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.3"
        },
        {
          "name": "github.com/containernetworking/plugins",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.2"
        },
        {
          "name": "github.com/corazawaf/coraza-coreruleset/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.25.0"
        },
        {
          "name": "github.com/corazawaf/coraza/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.7.0"
        },
        {
          "name": "github.com/coreos/go-iptables",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.8.0"
        },
        {
          "name": "github.com/dave/jennifer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.1"
        },
        {
          "name": "github.com/davecgh/go-spew",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.2-0.20180830191138-d8f796af33cc"
        },
        {
          "name": "github.com/dexidp/dex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260520212858-e703bc3d29c4"
        },
        {
          "name": "github.com/docker/cli",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v27.5.0+incompatible"
        },
        {
          "name": "github.com/docker/docker",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v27.5.1+incompatible"
        },
        {
          "name": "github.com/docker/go-connections",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.0"
        },
        {
          "name": "github.com/elastic/go-perf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20241029065020-30bec95324b8"
        },
        {
          "name": "github.com/flannel-io/flannel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.26.7"
        },
        {
          "name": "github.com/fxamacker/cbor/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.9.2"
        },
        {
          "name": "github.com/go-acme/lego/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.28.1"
        },
        {
          "name": "github.com/go-git/go-git/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.18.0"
        },
        {
          "name": "github.com/go-jose/go-jose/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.1.4"
        },
        {
          "name": "github.com/go-logr/logr",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.3"
        },
        {
          "name": "github.com/go-sql-driver/mysql",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.0"
        },
        {
          "name": "github.com/golang-jwt/jwt/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.3.1"
        },
        {
          "name": "github.com/google/cel-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.28.1"
        },
        {
          "name": "github.com/google/gofuzz",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/google/pprof",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20241210010833-40e02aabc2ad"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/hashicorp/golang-lru/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.7"
        },
        {
          "name": "github.com/ironpark/skiplist",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230103051251-d63941a7d606"
        },
        {
          "name": "github.com/jackc/pgx/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.8.0"
        },
        {
          "name": "github.com/lucasb-eyer/go-colorful",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/mattn/go-colorable",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.14"
        },
        {
          "name": "github.com/mattn/go-isatty",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.20"
        },
        {
          "name": "github.com/mattn/go-runewidth",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.19"
        },
        {
          "name": "github.com/mattn/go-sqlite3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.14.44"
        },
        {
          "name": "github.com/miekg/dns",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.68"
        },
        {
          "name": "github.com/mitchellh/go-testing-interface",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.14.1"
        },
        {
          "name": "github.com/mitchellh/mapstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.0"
        },
        {
          "name": "github.com/moby/buildkit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.19.0"
        },
        {
          "name": "github.com/morikuni/aec",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/mr-tron/base58",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/muesli/termenv",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.15.2"
        },
        {
          "name": "github.com/oklog/ulid/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.1.0"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/opencontainers/image-spec",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/opencontainers/runtime-spec",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/pelletier/go-toml/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.2.4"
        },
        {
          "name": "github.com/pkg/errors",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.9.1"
        },
        {
          "name": "github.com/quic-go/quic-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.57.1"
        },
        {
          "name": "github.com/quic-go/webtransport-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.9.0"
        },
        {
          "name": "github.com/sirupsen/logrus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.3"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.9"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/tidwall/gjson",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.18.0"
        },
        {
          "name": "github.com/tonistiigi/fsutil",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250113203817-b14e27f4135a"
        },
        {
          "name": "github.com/tonistiigi/go-csvvalue",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20240710180619-ddb21b71c0b4"
        },
        {
          "name": "github.com/tonistiigi/units",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180711220420-6950e57a87ea"
        },
        {
          "name": "github.com/tonistiigi/vt100",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20240514184818-90bafcd6abab"
        },
        {
          "name": "github.com/vishvananda/netlink",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.1-0.20240922070040-084abd93d350"
        },
        {
          "name": "go.etcd.io/etcd/api/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.6.11"
        },
        {
          "name": "go.etcd.io/etcd/client/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.6.11"
        },
        {
          "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.67.0"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.38.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.38.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/stdout/stdoutlog",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.14.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/stdout/stdoutmetric",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.33.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.33.0"
        },
        {
          "name": "go.opentelemetry.io/otel/log",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.14.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk/log",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.14.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk/metric",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.0"
        },
        {
          "name": "go.opentelemetry.io/proto/otlp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.1"
        },
        {
          "name": "go4.org/netipx",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20231129151722-fdeea329fbba"
        },
        {
          "name": "golang.org/x/crypto",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.51.0"
        },
        {
          "name": "golang.org/x/net",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.54.0"
        },
        {
          "name": "golang.org/x/oauth2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.36.0"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.20.0"
        },
        {
          "name": "golang.org/x/sys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.44.0"
        },
        {
          "name": "golang.org/x/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.43.0"
        },
        {
          "name": "golang.org/x/text",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.37.0"
        },
        {
          "name": "golang.org/x/time",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.15.0"
        },
        {
          "name": "golang.org/x/tools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.44.0"
        },
        {
          "name": "google.golang.org/genproto/googleapis/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260319201613-d00831a3d3e7"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.81.1"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.11"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "k8s.io/klog/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.130.1"
        },
        {
          "name": "miren.dev/jsonrpc3/go/jsonrpc3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260106052505-c98e2702b093"
        },
        {
          "name": "miren.dev/lbd",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260224020427-8914d8db2233"
        },
        {
          "name": "miren.dev/mflags",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260709231109-a397dcbc98df"
        },
        {
          "name": "sigs.k8s.io/knftables",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.21"
        },
        {
          "name": "github.com/gofrs/flock",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.13.0"
        },
        {
          "name": "github.com/klauspost/compress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.18.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 6,
        "merged_prs": 941,
        "open_issues": 1,
        "closed_ratio": 0.857,
        "closed_issues": 6,
        "closed_unmerged_prs": 54
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "phinze",
          "commits": 1850,
          "avatar_url": "https://avatars.githubusercontent.com/u/37534?v=4"
        },
        {
          "type": "User",
          "login": "evanphx",
          "commits": 1404,
          "avatar_url": "https://avatars.githubusercontent.com/u/7?v=4"
        },
        {
          "type": "User",
          "login": "teresamychu",
          "commits": 31,
          "avatar_url": "https://avatars.githubusercontent.com/u/1695478?v=4"
        },
        {
          "type": "User",
          "login": "maryelizbeth",
          "commits": 15,
          "avatar_url": "https://avatars.githubusercontent.com/u/1280061?v=4"
        },
        {
          "type": "User",
          "login": "jcasimir",
          "commits": 11,
          "avatar_url": "https://avatars.githubusercontent.com/u/43102?v=4"
        },
        {
          "type": "User",
          "login": "bnferguson",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/47749?v=4"
        },
        {
          "type": "User",
          "login": "demophoon",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/1445303?v=4"
        },
        {
          "type": "User",
          "login": "claude",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/81847?v=4"
        }
      ],
      "contributors_sampled": 8,
      "top_contributor_share": 0.558
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "code-scanning-watch.yml",
        "docs.yml",
        "release.yml",
        "test.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "Gemfile.lock",
        "go.sum",
        "uv.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 8,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 4,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 10,
            "reason": "all changesets reviewed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 13 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 5,
            "reason": "dependency not pinned by hash detected -- score normalized to 5",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool is run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "236 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "0e37da35d1fe92da49c7db0d437a2aeb58a33a27",
        "ran_at": "2026-08-05T14:41:57Z",
        "aggregate_score": 5.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "recent_prs": {
        "merged_7d": 36,
        "decided_7d": 36,
        "merged_30d": 60,
        "authors_30d": 3,
        "decided_30d": 60,
        "sample_size": 60,
        "window_days": 30,
        "sample_exhausted": true,
        "authors_probed_30d": 3,
        "newcomer_merged_30d": 0,
        "bot_prs_excluded_30d": 0,
        "newcomer_authors_30d": 0,
        "newcomer_decided_30d": 0
      },
      "ci_last_run_at": "2026-08-05T01:19:13Z",
      "oldest_open_prs": [
        {
          "number": 972,
          "created_at": "2026-07-24T21:02:24Z",
          "last_comment_at": "2026-08-05T13:33:43Z",
          "last_comment_author": "coderabbitai"
        },
        {
          "number": 978,
          "created_at": "2026-07-25T02:48:39Z",
          "last_comment_at": "2026-08-05T00:29:12Z",
          "last_comment_author": "coderabbitai"
        },
        {
          "number": 979,
          "created_at": "2026-07-25T02:52:39Z",
          "last_comment_at": "2026-08-04T22:28:26Z",
          "last_comment_author": "coderabbitai"
        },
        {
          "number": 1018,
          "created_at": "2026-08-04T22:58:58Z",
          "last_comment_at": "2026-08-04T22:59:19Z",
          "last_comment_author": "coderabbitai"
        },
        {
          "number": 1019,
          "created_at": "2026-08-05T02:31:29Z",
          "last_comment_at": "2026-08-05T02:31:49Z",
          "last_comment_author": "coderabbitai"
        },
        {
          "number": 1020,
          "created_at": "2026-08-05T13:47:29Z",
          "last_comment_at": "2026-08-05T13:59:56Z",
          "last_comment_author": "coderabbitai"
        }
      ],
      "last_merged_pr_at": "2026-08-05T01:01:18Z",
      "ci_last_conclusion": "FAILURE",
      "oldest_open_issues": [
        {
          "number": 793,
          "created_at": "2026-05-07T20:13:59Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/mirendev/runtime",
    "host": "github.com",
    "name": "runtime",
    "owner": "mirendev"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "excellent",
      "name": "Overall health",
      "note": "The weighted overall 68 is calibrated to 80 on the published index scale (record calibration 2026-08-02).",
      "notes": [
        {
          "code": "overall_calibration",
          "params": {
            "raw": 68,
            "calibrated": 80,
            "calibration": "2026-08-02"
          }
        }
      ],
      "value": 80,
      "inputs": {
        "security": 51,
        "vitality": 79,
        "community": 47,
        "governance": 69,
        "calibration": "2026-08-02",
        "engineering": 86,
        "ai_readiness": 77,
        "weighted_overall_raw": 68
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 79,
        "weight": 0.21,
        "metrics": [
          {
            "key": "development_activity",
            "band": "exceptional",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "commits_last_year": 2862,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 52
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "52/52 weeks with commits",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 52
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "2862 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 2862
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "weak",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "releases_count": 1,
              "latest_release_tag": "tip",
              "releases_from_tags": false,
              "days_since_latest_release": 441,
              "mean_days_between_releases": null
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "1 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 441 days ago",
                "points": 7.2,
                "status": "partial",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 441
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "cadence unknown (single release)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence_unknown",
                    "params": {}
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "exceptional",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 0,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 0 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "weak",
        "name": "Community & Adoption",
        "value": 47,
        "weight": 0.17,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 31,
            "inputs": {
              "forks": 4,
              "stars": 50,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "50 stars",
                "points": 27.4,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 50
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "4 forks",
                "points": 4,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "readme_badges": 4,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "readme_badge_services": [
                "github.com",
                "shields.io"
              ],
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "good",
        "name": "Sustainability & Governance",
        "value": 69,
        "weight": 0.23,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "weak",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 8,
              "top_contributor_share": 0.558
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 56% of commits",
                "points": 9.9,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 56
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "8 contributors",
                "points": 10.8,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 8
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 13 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "excellent",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "newcomer_pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 91,
            "inputs": {
              "merged_prs": 941,
              "open_issues": 1,
              "closed_issues": 6,
              "prs_merged_7d": 36,
              "prs_decided_7d": 36,
              "prs_merged_30d": 60,
              "prs_decided_30d": 60,
              "issue_closed_ratio": 0.857,
              "closed_unmerged_prs": 54,
              "first_time_authors_30d": 0,
              "first_time_prs_merged_30d": 0,
              "first_time_prs_decided_30d": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "86% of issues closed",
                "points": 36,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 86
                    }
                  }
                ],
                "max_points": 42
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "941/995 decided PRs merged",
                "points": 28.4,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 941,
                      "decided": 995
                    }
                  }
                ],
                "max_points": 30
              },
              {
                "key": "newcomer_pr_acceptance",
                "name": "Newcomer PR acceptance",
                "detail": "no first-time contributor's PR decided in 30d",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_newcomer_prs",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 13
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "all changesets reviewed",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "followers": 48,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "mirendev",
              "public_repos": 21,
              "account_age_days": 761
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "48 followers of mirendev",
                "points": 12.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 48,
                      "login": "mirendev"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "21 public repos, account ~2 yr old",
                "points": 13.9,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 21
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 2
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "exceptional",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "miren.dev/runtime"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 0
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 0 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "26 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 86,
        "weight": 0.19,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [
                "deployment"
              ],
              "has_wiki": false,
              "homepage": "https://miren.dev",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://miren.dev",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "1 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 51,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 5.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "all changesets reviewed",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 13 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 5",
                "points": 2.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is run on all commits",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "236 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "exceptional",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "commit_weight_rule": {
                "min_commits": 50,
                "min_commit_share": 0.1
              },
              "review_only_matches": 0,
              "below_threshold_exposures": [],
              "assessed_self_published_locations": 16
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 77,
        "weight": 0.04,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.98,
              "agent_instruction_files": [
                "CLAUDE.md",
                "docs/CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 14465
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md, docs/CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md, docs/CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "98 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 98,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 77,
            "inputs": {
              "has_nix": true,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "Gemfile.lock",
                "go.sum",
                "uv.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "docs/tsconfig.json",
                "testdata/bun/jsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "controllers/sandbox/testdata/heavy-logger/go.mod",
                "controllers/sandbox/testdata/sort/go.mod",
                "controllers/sandbox/testdata/testhttp/go.mod",
                "go.mod",
                "observability/profile/busy_sort/go.mod",
                "pkg/stackbuild/testdata/go-cgo/go.mod",
                "pkg/stackbuild/testdata/go/go.mod",
                "pkg/stackbuild/testdata/rust/Cargo.toml",
                "testdata/bad-command/go.mod",
                "testdata/build-error/go.mod",
                "testdata/crash-loop/go.mod",
                "testdata/crash-on-startup/go.mod",
                "testdata/db-app/go.mod",
                "testdata/dns-test/go.mod",
                "testdata/go-server/go.mod",
                "testdata/local-disk-app/go.mod",
                "testdata/long-shutdown/go.mod",
                "testdata/tcp-echo/go.mod",
                "testdata/websocket-echo/go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "docs/tsconfig.json, testdata/bun/jsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "docs/tsconfig.json, testdata/bun/jsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, Nix, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, Nix, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 5",
                "points": 5,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "exceptional",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 99,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 140510,
              "source_files_sampled": 1118,
              "oversized_source_files": 14
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "14/1118 source files over 60KB",
                "points": 54.3,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 1118,
                      "oversized": 14
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "weak",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "example",
                "recipes"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example, recipes",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example, recipes"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
      }
    ],
    "classification": {
      "top": [
        "library",
        "application"
      ],
      "labels": [
        "tui",
        "library"
      ],
      "scores": {
        "tui": 4,
        "library": 6,
        "application": 5,
        "network-service": 3
      },
      "primary": "tui",
      "evidence": [
        {
          "tier": "structure",
          "label": "application",
          "source": "tree.go_main",
          "weight": 5
        },
        {
          "tier": "dependencies",
          "label": "tui",
          "source": "dep:github.com/charmbracelet/bubbletea",
          "weight": 4
        },
        {
          "tier": "distribution",
          "label": "library",
          "source": "registry:go",
          "weight": 3
        },
        {
          "tier": "structure",
          "label": "library",
          "source": "tree.go_importable",
          "weight": 3
        },
        {
          "tier": "structure",
          "label": "network-service",
          "source": "tree.compose",
          "weight": 3
        }
      ],
      "artifacts": [],
      "confidence": "medium",
      "host_extension": false,
      "runs_as_process": true,
      "consumed_by_code": true
    },
    "metrics_version": "2.5.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-08-05T14:42:22.858969Z",
  "schema_version": "0.31.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/m/mirendev/runtime.svg",
  "full_name": "mirendev/runtime",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}