公开记录良好
软件健康报告模式 0.27.0 · 指标 2.5.0 · 2026-07-31 16:16 UTC
secmon-lab / warren
AI-powered security alert management that reduces noise and accelerates response time
secmon-lab/warren 的健康指数为 100 分中的 78 分，处于「良好」区间。 其得分最高的类别是Vitality（92/100），最低的是Security（43/100）。 最近一次更新在 10 天前。 近期的大部分工作由 1 位贡献者完成。
78
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均，再依据公开记录的分布进行校准，使各等级具有百分位含义；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 34（存在风险）的上限。
78
卓越93-100公开记录中的最高层级（约前 5%）；基本满足所有检验标准
优秀80-92各方面均表现强劲；仅有少量不足
良好65-79健康；不足之处有限且可控
中等50-64可接受，但存在明显不足；建议进行审查
薄弱35-49多个领域存在实质性薄弱环节
存在风险20-34存在重大薄弱环节；采用时应保持审慎
危急1-19问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
加权总体分 67 经校准后在公布的指数量表上为 78（记录校准 2026-08-02）。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 |
|---|---|---|---|---|---|
| Go | github.com/secmon-lab/warren | v0.17.2 | - | 28 | 11 天前 |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
92
开发活跃度
87优秀
评分方式
| 28.8/36 | 推送新近度 — 最近一次推送于 10 天前 |
| 29.8/36 | 提交节奏 — 52 周中有 43 周有提交 |
| 18/18 | 提交量 — 最近一年 550 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 550 |
| human_commit_share | 1 |
| days_since_last_push | 10 |
| active_weeks_last_year | 43 |
发布纪律
100卓越
评分方式
| 27/27 | 有发布版本 — 已发布 27 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 10 天前 |
| 27/27 | 发布节奏 — 约每 15.8 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 27 |
| latest_release_tag | v0.17.2 |
| releases_from_tags | 否 |
| days_since_latest_release | 10 |
| mean_days_between_releases | 15.8 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
45
流行度与采用
40薄弱
评分方式
| 34.3/60 | 星标 — 131 个星标 |
| 5.8/25 | 复刻 — 6 个复刻 |
| 0/15 | 关注者 — 1 位关注者 |
所用输入
| forks | 6 |
| stars | 131 |
| watchers | 1 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
50中等
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（Apache-2.0） |
| 0/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| readme_badges | — |
| has_contributing | 否 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| readme_badge_services | — |
| has_pull_request_template | 否 |
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
58
维护者韧性（巴士系数）
16危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0/22.5 | 提交分布 — 头号贡献者编写了 100% 的提交 |
| 1.4/13.5 | 贡献者广度 — 1 位贡献者 |
| 6/10 | OpenSSF Scorecard：Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
议题与 PR 响应能力
82优秀
评分方式
| 42/42 | 议题解决 — 100% 的议题已关闭 |
| 29/30 | PR 接受 — 已裁定的 PR 中 203/210 已合并 |
| 0/13 | Newcomer PR acceptance — 30 天内没有首次贡献者的 PR 得到裁决 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/19 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 203 |
| open_issues | 0 |
| closed_issues | 15 |
| prs_merged_7d | — |
| prs_decided_7d | — |
| prs_merged_30d | — |
| prs_decided_30d | — |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 7 |
| first_time_authors_30d | — |
| first_time_prs_merged_30d | — |
| first_time_prs_decided_30d | — |
已排除计分（无数据或不适用）：newcomer_pr_acceptance。 其余权重已重新归一化。
所有权与托管责任
51中等
评分方式
| 30/30 | 所有权背书 — 组织持有 |
| 0/20 | 已验证域名 |
| 8.5/25 | 所有者影响力 — secmon-lab 有 14 位关注者 |
| 12.4/25 | 既往记录 — 14 个公开仓库，账户约 1 年 |
所用输入
| followers | 14 |
| owner_type | Organization |
| is_verified | — |
| owner_login | secmon-lab |
| public_repos | 14 |
| account_age_days | 708 |
软件包维护
100卓越
评分方式
| 25/25 | 已发布且可解析 — go 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 11 天前 |
| 20/20 | 版本历史 — 28 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | github.com/secmon-lab/warren |
| ecosystems | go |
| any_deprecated | 否 |
| min_days_since_publish | 11 |
工程质量
基础的工程与文档实践是否到位？
84
工程实践
84优秀
评分方式
| 24/24 | CI 工作流 — 9 个工作流 |
| 24/24 | 存在测试 |
| 16/16 | Linter 配置 — eslint.config.mjs |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard：CI-Tests — 18 out of 18 merged PRs checked by a CI test -- score normalized to 10 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 是 |
| has_precommit_config | 否 |
文档
85优秀
评分方式
| 30/30 | README |
| 25/25 | 文档目录 |
| 0/15 | 文档 / 主页站点 |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 3 个主题标签 |
| 10/10 | Wiki |
所用输入
| topics | ai, llm, security |
| has_wiki | 是 |
| homepage | — |
| has_readme | 是 |
| has_docs_dir | 是 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
43
安全态势
43薄弱
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 2.5/2.5 | CI-Tests — 18 out of 18 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/19 approved changesets -- score normalized to 0 |
| 1.5/2.5 | Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 2.5/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 5 |
| 3/5 | SAST — SAST tool is not run on all commits -- score normalized to 6 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 24 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 4.3 |
已排除计分（无数据或不适用）：signed_releases。 其余权重已重新归一化。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？权重刻意设小（4%）：代理工具链是一项真实的维护信号，但完全不具备的仓库仍可达到 100/100。
87
AI 代理上下文与指引
85优秀
评分方式
| 45/45 | 代理指令 — CLAUDE.md |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 100 次人类提交中有 97 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.97 |
| agent_instruction_files | CLAUDE.md |
| agent_instruction_max_bytes | 8,117 |
评分方式
| 18/18 | 一条命令的引导启动 — Taskfile.yml |
| 22/22 | 自动化测试 |
| 11/11 | Lint / 格式化配置 — eslint.config.mjs |
| 11/11 | 静态类型检查 — frontend/tsconfig.json |
| 10/10 | 可复现环境 — Dockerfile, lockfile |
| 10/10 | 已体现的代理实践 — 最近 100 次提交中有 47 次由代理编写或署名代理 |
| 0/8 | 自动化维护 — 未观察到自动依赖更新 |
| 5/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 5 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | go.sum, pnpm-lock.yaml |
| has_dockerfile | 是 |
| typed_language | 是 |
| bootstrap_files | Taskfile.yml |
| has_devcontainer | 否 |
| has_linter_config | 是 |
| typecheck_configs | frontend/tsconfig.json |
| agent_commit_share | 0.47 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0 |
面向模型的代码可读性
100卓越
评分方式
| 45/45 | 可类型检查的代码 — Go（静态类型） |
| 54.7/55 | 可控的文件大小 — 采样的 645 个源文件中有 3 个超过 60KB |
所用输入
| primary_language | Go |
| largest_source_bytes | 628,076 |
| source_files_sampled | 645 |
| oversized_source_files | 3 |
机器可读接口
80优秀
评分方式
| 40/40 | API 模式（OpenAPI/GraphQL/proto） — graphql/schema.graphql |
| 0/20 | MCP 服务器 |
| 40/40 | 可运行示例 — examples |
所用输入
| example_dirs | examples |
| has_mcp_signal | 否 |
| api_schema_files | graphql/schema.graphql |
关键数据
131GitHub 星标
1贡献者
550最近 12 个月提交数
10距最近推送天数
27发布版本数
1巴士系数（bus factor）
0开放议题
Go, npm软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
更多细节
Star 与 Fork 历史 0 ★ / 6 ⇿
0Star
6Fork
16发布
每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。
主版本 0次版本 9修订 7
OpenSSF Scorecard 4.3 / 10
4.3综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 10 | CI-Tests | 18 out of 18 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/19 approved changesets -- score normalized to 0 |
| 6 | Contributors | project has 2 contributing companies or organizations -- score normalized to 6 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 5 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 5 |
| 6 | SAST | SAST tool is not run on all commits -- score normalized to 6 |
| 0 | Security-Policy | security policy file not detected |
| 不适用 | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 24 existing vulnerabilities detected |
直接依赖 73
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| npm | @apollo/client | ^3.14.1 | frontend/package.json |
| npm | @radix-ui/react-alert-dialog | ^1.1.15 | frontend/package.json |
| npm | @radix-ui/react-avatar | ^1.1.11 | frontend/package.json |
| npm | @radix-ui/react-collapsible | ^1.1.12 | frontend/package.json |
| npm | @radix-ui/react-dialog | ^1.1.15 | frontend/package.json |
| npm | @radix-ui/react-dropdown-menu | ^2.1.16 | frontend/package.json |
| npm | @radix-ui/react-icons | ^1.3.2 | frontend/package.json |
| npm | @radix-ui/react-label | ^2.1.8 | frontend/package.json |
| npm | @radix-ui/react-navigation-menu | ^1.2.14 | frontend/package.json |
| npm | @radix-ui/react-popover | ^1.1.15 | frontend/package.json |
| npm | @radix-ui/react-select | ^2.2.6 | frontend/package.json |
| npm | @radix-ui/react-separator | ^1.1.8 | frontend/package.json |
| npm | @radix-ui/react-slider | ^1.3.6 | frontend/package.json |
| npm | @radix-ui/react-slot | ^1.2.4 | frontend/package.json |
| npm | @radix-ui/react-tabs | ^1.1.13 | frontend/package.json |
| npm | @radix-ui/react-toast | ^1.2.15 | frontend/package.json |
| npm | @radix-ui/react-tooltip | ^1.2.8 | frontend/package.json |
| npm | @tailwindcss/typography | ^0.5.19 | frontend/package.json |
| npm | class-variance-authority | ^0.7.1 | frontend/package.json |
| npm | clsx | ^2.1.1 | frontend/package.json |
| npm | date-fns | ^4.1.0 | frontend/package.json |
| npm | dompurify | ^3.4.11 | frontend/package.json |
| npm | graphql | ^16.13.2 | frontend/package.json |
| npm | lucide-react | ^0.511.0 | frontend/package.json |
| npm | react | ^19.2.4 | frontend/package.json |
| npm | react-dom | ^19.2.4 | frontend/package.json |
| npm | react-markdown | ^10.1.0 | frontend/package.json |
| npm | react-router-dom | ^7.15.0 | frontend/package.json |
| npm | remark-gfm | ^4.0.1 | frontend/package.json |
| npm | tailwind-merge | ^3.5.0 | frontend/package.json |
| Go | cloud.google.com/go/bigquery | v1.79.0 | go.mod |
| Go | cloud.google.com/go/firestore | v1.24.0 | go.mod |
| Go | cloud.google.com/go/storage | v1.63.1 | go.mod |
| Go | github.com/99designs/gqlgen | v0.17.94 | go.mod |
| Go | github.com/bradleyfalzon/ghinstallation/v2 | v2.19.0 | go.mod |
| Go | github.com/dustin/go-humanize | v1.0.1 | go.mod |
| Go | github.com/fatih/color | v1.19.0 | go.mod |
| Go | github.com/getsentry/sentry-go | v0.48.0 | go.mod |
| Go | github.com/go-chi/chi/v5 | v5.3.1 | go.mod |
| Go | github.com/gollem-dev/gollem | v0.28.0 | go.mod |
| Go | github.com/gollem-dev/tools/abusech | v0.2.0 | go.mod |
| Go | github.com/gollem-dev/tools/bigquery | v0.2.0 | go.mod |
| Go | github.com/gollem-dev/tools/github | v0.3.0 | go.mod |
| Go | github.com/gollem-dev/tools/intune | v0.2.0 | go.mod |
| Go | github.com/gollem-dev/tools/ipdb | v0.2.0 | go.mod |
| Go | github.com/gollem-dev/tools/otx | v0.2.0 | go.mod |
| Go | github.com/gollem-dev/tools/shodan | v0.2.0 | go.mod |
| Go | github.com/gollem-dev/tools/slack | v0.3.0 | go.mod |
| Go | github.com/gollem-dev/tools/urlscan | v0.2.0 | go.mod |
| Go | github.com/gollem-dev/tools/vt | v0.2.0 | go.mod |
| Go | github.com/gollem-dev/tools/webfetch | v0.3.0 | go.mod |
| Go | github.com/gollem-dev/tools/whois | v0.2.0 | go.mod |
| Go | github.com/google/go-github/v74 | v74.0.0 | go.mod |
| Go | github.com/google/uuid | v1.6.0 | go.mod |
| Go | github.com/gorilla/websocket | v1.5.3 | go.mod |
| Go | github.com/graph-gophers/dataloader/v7 | v7.2.0 | go.mod |
| Go | github.com/lestrrat-go/jwx/v2 | v2.1.7 | go.mod |
| Go | github.com/m-mizutani/clog | v0.2.1 | go.mod |
| Go | github.com/m-mizutani/fireconf | v0.3.0 | go.mod |
| Go | github.com/m-mizutani/goerr/v2 | v2.0.1 | go.mod |
| Go | github.com/m-mizutani/gt | v0.2.1 | go.mod |
| Go | github.com/m-mizutani/harlog | v0.0.3 | go.mod |
| Go | github.com/m-mizutani/masq | v0.2.2 | go.mod |
| Go | github.com/m-mizutani/opaq | v0.4.0 | go.mod |
| Go | github.com/newmo-oss/go-caller | v0.1.0 | go.mod |
| Go | github.com/slack-go/slack | v0.27.0 | go.mod |
| Go | github.com/stretchr/testify | v1.11.1 | go.mod |
| Go | github.com/urfave/cli/v3 | v3.10.1 | go.mod |
| Go | github.com/vektah/gqlparser/v2 | v2.5.36 | go.mod |
| Go | google.golang.org/api | v0.289.0 | go.mod |
| Go | google.golang.org/genai | v1.64.0 | go.mod |
| Go | google.golang.org/grpc | v1.82.1 | go.mod |
| Go | gopkg.in/yaml.v3 | v3.0.1 | go.mod |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"ai",
"llm",
"security"
],
"is_fork": false,
"size_kb": 13057,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 2857845,
"CSS": 1701,
"HTML": 715,
"Shell": 6829,
"Dockerfile": 1370,
"JavaScript": 3269,
"TypeScript": 775223
},
"pushed_at": "2026-07-20T22:52:29Z",
"created_at": "2025-07-07T22:36:59Z",
"owner_type": "Organization",
"updated_at": "2026-07-25T03:48:17Z",
"description": "AI-powered security alert management that reduces noise and accelerates response time",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go",
"TypeScript"
]
},
"owner": {
"blog": null,
"name": "Security Monitoring Lab",
"type": "Organization",
"login": "secmon-lab",
"company": null,
"location": null,
"followers": 14,
"avatar_url": "https://avatars.githubusercontent.com/u/179055316?v=4",
"created_at": "2024-08-21T22:05:33Z",
"is_verified": null,
"public_repos": 14,
"account_age_days": 708
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.17.2",
"kind": "patch",
"published_at": "2026-07-20T22:52:29Z"
},
{
"tag": "v0.17.1",
"kind": "patch",
"published_at": "2026-06-13T01:45:33Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2026-05-23T01:51:25Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2026-05-09T01:01:22Z"
},
{
"tag": "v0.15.1",
"kind": "patch",
"published_at": "2026-04-14T22:06:55Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2026-04-09T04:39:18Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2026-04-01T00:56:35Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2026-03-23T01:41:11Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2026-03-10T22:24:20Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2026-03-01T03:27:33Z"
},
{
"tag": "v0.10.1",
"kind": "patch",
"published_at": "2026-02-24T07:43:00Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2026-02-23T03:26:17Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-02-01T23:58:18Z"
},
{
"tag": "v0.8.3",
"kind": "patch",
"published_at": "2026-01-31T08:27:50Z"
},
{
"tag": "v0.8.2",
"kind": "patch",
"published_at": "2026-01-13T23:56:05Z"
},
{
"tag": "v0.8.1",
"kind": "patch",
"published_at": "2026-01-05T09:10:57Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-01-05T03:27:09Z"
},
{
"tag": "v0.7.1",
"kind": "patch",
"published_at": "2025-12-01T00:17:19Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2025-11-24T22:06:33Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2025-11-16T03:32:34Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2025-11-12T05:37:15Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2025-11-09T06:34:32Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2025-11-04T08:46:32Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2025-10-19T04:17:24Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2025-08-16T02:21:28Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2025-08-08T09:24:52Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2025-07-28T20:28:26Z"
}
],
"recent_commits": [
{
"oid": "e9c3607d0f54c040d60c9e65fb21d1b4981e05a2",
"body": "* chore(deps): update all modules incl. gollem v0.28.0 and enable Claude prompt cache\n\n* refactor(llm): apply prompt cache via client decorator so webfetch's Claude client is covered too",
"is_bot": false,
"headline": "chore(deps): update all modules and enable gollem prompt cache (#228)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-07-20T02:11:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "262912b6d631c4e610acd2d3982b2e8c3642579d",
"body": "* fix(agents): honor explicit before/after=0 in slack context tool and tidy bigquery config-tool constructor\n\n* chore(deps): upgrade gollem to v0.27.0\n\n* refactor(tool): drop unused tableDatasetID/tableTableID fields from bigquery config generator",
"is_bot": false,
"headline": "fix(agents): slack context explicit-zero + gollem v0.27.0 (#227)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-07-01T01:50:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d213e76f26161b79e79251c29909899dc9aa6cef",
"body": "…ols deps (#226)\n\n* refactor(tool): adopt gollem type-safe NewTool API and bump gollem/tools deps\n\n* refactor(tool): assert typed tool schemas at package init via MustToolSchema\n\n* fix(deps): upgrade dompurify to 3.4.11 to clear trivy GHSA-cmwh-pvxp-8882",
"is_bot": false,
"headline": "refactor(tool): adopt gollem type-safe NewTool API and bump gollem/to…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-07-01T01:19:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb05b8ac29878e874afd9fbddf34459525f91bc6",
"body": "* feat: persist conversation history for ticketless threads to continue conversations\n\n* fix(deps): upgrade dompurify to 3.4.10 to clear trivy CVEs",
"is_bot": false,
"headline": "feat: continue conversation history for ticketless Slack threads (#223)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-06-17T01:03:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5d96d3afc230510ee36df9f04dc27eec5671917",
"body": "* refactor(tool): delegate pkg/tool Specs/Run to github.com/gollem-dev/tools\n\n* ci: make gosec SARIF jq fix tolerate absent rules array\n\n* refactor(webfetch): drop redundant nil-check before WithHTTPClient\n\n* refactor(tool): build external options inside flag Action callbacks\n\n* test(tool): assert flag Action appends expected external options via reflection\n\n* test(tool): verify flag values reach mock requests; keep reflection only for bigquery",
"is_bot": false,
"headline": "refactor(tool): delegate pkg/tool to github.com/gollem-dev/tools (#222)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-06-14T01:53:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b82f1a58d06fef8da2bf2efc429b24089da0d526",
"body": "…de to v0.26.0 (#221)",
"is_bot": false,
"headline": "chore(deps): migrate gollem to github.com/gollem-dev/gollem and upgra…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-06-13T01:41:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82bc551d21a854ac9ed1bfb2da9fb61e65aa8281",
"body": null,
"is_bot": false,
"headline": "fix(deps): upgrade react-router-dom to 7.17.0 to clear trivy CVEs (#220)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-06-13T00:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df6846ab1b3be1c20c1d58fad4a85ed6d4179cf2",
"body": "…ground (#219)\n\n* fix(policy): serve stale cache while refreshing GitHub policy in background\n\n* test(policy): use client-side blocking transport to avoid handler data race\n\n* fix(policy): always release refresh single-flight guard even on panic\n\n* refactor(policy): make refresh single-flight guard atomic via CompareAndSwap",
"is_bot": false,
"headline": "fix(policy): serve stale cache while refreshing GitHub policy in back…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-29T12:34:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8b51e8119d1649e2c9d4c17eb9447bf7377b5d4",
"body": null,
"is_bot": false,
"headline": "ci: add cicd-sensor runtime security action to all workflows (#218)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-28T05:12:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0375818e5f9c1a27b2753bb4cff0e780dbde56d6",
"body": "* fix(deps): bump ws and drop go-git to clear trivy advisories\n\n* fix(docker): copy pnpm-workspace.yaml into frontend build stage",
"is_bot": false,
"headline": "fix(deps): clear trivy advisories for ws and go-git (#217)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-23T23:43:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2da43085c43e7f0b5aa978d97f87def5dcc0ba91",
"body": null,
"is_bot": false,
"headline": "chore(deps): upgrade gollem to v0.25.0",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-23T01:50:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "86e2287a1d049ad2fae17cb9bd72cc90a648c571",
"body": "…#215)\n\n* feat(webfetch): per-tool LLM flags with HITL fallback when disabled\n\n* fix(webfetch): validate temperature range [0.0, 2.0] at parse time",
"is_bot": false,
"headline": "feat(webfetch): per-tool LLM flags with HITL fallback when disabled (…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-16T00:24:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "455850c066bf70a0917e5cfe16c386db57e9b88d",
"body": "* feat(webfetch): LLM-based extraction + prompt-injection screening\n\n* refactor(webfetch): move system prompt to prompt/analyze.md via text/template\n\n* refactor(webfetch): drop 1MB response-body cap; rely on timeout+context\n\n* test(webfetch): add live extract tests against real security-info website\n[…]\nps): bump slack-go to v0.23.1 to fix GHSA-gxhx-2686-5h9g\n\n* fix(testutil): bound httptest form-parse body to satisfy gosec G108\n\n* docs(webfetch): reference #214 for immutable tool-injection follow-up",
"is_bot": false,
"headline": "feat(webfetch): LLM-based extraction + prompt-injection screening (#213)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-15T18:43:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "21ef09ae8ede6c1e1175f36a5c589daf68f054b8",
"body": "…token-usage\n\nOptimize knowledge tool token usage with two-phase retrieval",
"is_bot": false,
"headline": "Merge pull request #211 from secmon-lab/feat/optimize-knowledge-tool-…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-15T01:59:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1be43b9c7e4b08e16ea7a868b3a02aed69131e32",
"body": "- Add Repository.BatchGetKnowledges interface method\n- Implement batch get in Firestore (using GetAll) and Memory\n- Replace N+1 query pattern in Service.GetKnowledges with single batch call\n- Add ID deduplication in knowledge_get handler to prevent redundant DB lookups\n- Regenerate mocks to include new interface method",
"is_bot": false,
"headline": "fix: implement batch retrieval and ID deduplication for knowledge tool",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-15T01:54:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "62dcfa340b5278345edeb523e42372175d9b8b7b",
"body": null,
"is_bot": false,
"headline": "feat: optimize knowledge tool token usage with two-phase data retrieval",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-15T01:10:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3d918e1b6e233c0fa0de21e8d04a76fba22c708",
"body": "refactor(github): treat WARREN_GITHUB_APP_CONFIG as hints, not allowlist",
"is_bot": false,
"headline": "Merge pull request #210 from secmon-lab/worktree-dapper-questing-falcon",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-14T22:25:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1a971513b38b1043e8857605a58b22c0a833bdd",
"body": "…-2026-45022 / CVE-2026-44740",
"is_bot": false,
"headline": "chore(deps): bump go-git to v5.19.0 and go-billy to v5.9.0 to fix CVE…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-14T22:19:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "882092eb530df747b3cf4be7bd26077672e3b162",
"body": null,
"is_bot": false,
"headline": "refactor(github): treat WARREN_GITHUB_APP_CONFIG as hints, not allowlist",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-14T07:23:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a18a693ebf51cfad0f460fa4366143e8ffb74a2",
"body": "…brella\n\nfeat(policy): load Rego rules from a GitHub repository",
"is_bot": false,
"headline": "Merge pull request #209 from secmon-lab/worktree-stateful-spinning-um…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-10T04:03:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0959bb4602f22b87720bbac9473c5bae7b34536b",
"body": null,
"is_bot": false,
"headline": "refactor(policy): pass context to Configure and harden validation",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-10T03:53:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5c8261c9bf6cc07a62cc7b95f2ca07c3530040c3",
"body": "Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(policy): add GitHub source for loading Rego rules from a repository",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-10T03:22:26Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "637b641c556692d69d838b85fd864d4f3226fd9f",
"body": "fix(frontend): default tickets list to Open and make rows real anchor links",
"is_bot": false,
"headline": "Merge pull request #208 from secmon-lab/fix/improve-tickets-list-ux",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-09T06:05:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d33020180c19459a1cd348b30431941966d87e8b",
"body": "…before archive in test cleanup",
"is_bot": false,
"headline": "fix(frontend): query resolved ticket count independently and resolve …",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-09T05:15:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b617494dc2eaaf17c85104d763bb51938d54415c",
"body": "…s and use stable status filter testid\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(frontend): keep tickets list defaulted to Open across tab switche…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-09T01:49:04Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1af5fc4f795680b07e94fcbc4ee5812f425d07c7",
"body": "… links\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(frontend): default tickets list to Open and make rows real anchor…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-09T01:41:42Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "97ddac4dad4df2dd4e17f2213a6e0217a8056b7f",
"body": "…inbow\n\nfix(slack): use multi_static_select for resolve ticket modal tag picker",
"is_bot": false,
"headline": "Merge pull request #207 from secmon-lab/worktree-functional-riding-ra…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-08T01:52:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "68b62fbe41810487de752c6fb47ec8927c700869",
"body": null,
"is_bot": false,
"headline": "fix(slack): use multi_static_select for resolve ticket modal tag picker",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-07T10:32:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "411a8b6763776ff24fec557d7ec0c66f0aa8865d",
"body": "…ussell\n\nfix(firestore): avoid composite index requirement in session/turn queries",
"is_bot": false,
"headline": "Merge pull request #206 from secmon-lab/worktree-inherited-watching-r…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-04T01:41:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65c2a6f2c3b30e4ff47a8f2fb532476dc19d924a",
"body": "…inated queries",
"is_bot": false,
"headline": "fix(firestore): close iterators and drop redundant aggregation in pag…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-04T01:37:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b49aeee5f36e010b68a36931c5a3dabfbd19053a",
"body": "…ries",
"is_bot": false,
"headline": "fix(firestore): avoid composite index requirement in session/turn que…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-04T01:32:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab9e90dbb73bba22acb6fcb35fb7dfbc0546d6f9",
"body": null,
"is_bot": false,
"headline": "add .pnpm-store/",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T01:44:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74fdd9e73a3d22c9a79d65c6577ba947846409e7",
"body": "fix(e2e): harden local Playwright runner and avoid port collisions",
"is_bot": false,
"headline": "Merge pull request #204 from secmon-lab/worktree-crispy-snuggling-lark",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T01:35:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a5c67a62924e6958585d0cb6afe87c0bbcae48fa",
"body": "…odulo bias\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(e2e): address review — defer BASE_URL fail-loud and reduce port m…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T01:12:17Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "967c2f284e389a46cf4bea9f4b83faa00caa5be2",
"body": "Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(e2e): harden local Playwright runner and avoid port collisions",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T01:04:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "05bcf3d295bbf7af507366b07492fd417225156b",
"body": "refactor(chat): chat-session-redesign",
"is_bot": false,
"headline": "Merge pull request #201 from secmon-lab/refactor/chat-session-redesign",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T00:33:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81c52061dd1a1c2ec874b01615937e57aa30eddc",
"body": "…buntu mirror\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci(e2e): drop playwright --with-deps to avoid apt-get hang on Azure u…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T00:29:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "03065779d743168a0720a1a54070383e2ced04e8",
"body": "Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci(e2e): cache Playwright browsers and bump job timeout to 30 minutes",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T00:25:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "fecc9f55839f794dade1a369050efb9b07317ffe",
"body": "…isfy govet inline check\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(lint): replace deprecated reflect.Ptr with reflect.Pointer to sat…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T00:08:45Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "667f272e92631072b1ebde6f832a74277e485592",
"body": "…visories\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: bump go-git to v5.18.0 and postcss to 8.5.10+ to clear trivy ad…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-02T00:04:39Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ae50ab0a293439d1ec8562c6fb5e44c71b54e045",
"body": "Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(migration): add v0.16.0 migration guide and v0.16.0 bundle job",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-05-01T23:59:22Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "edc51946555cc18a67bf860c4251d0b2e18c3c06",
"body": "…-redesign\n\n# Conflicts:\n#\tpkg/cli/migrate.go\n#\tpkg/cli/migrate_test.go",
"is_bot": false,
"headline": "Merge remote-tracking branch 'origin/main' into refactor/chat-session…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-20T00:56:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b91c69055156c108cf9c9d83fc6ef6b5b50b33ab",
"body": "… a GCS server-side copy\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(chat): drop destructive cleanup-legacy job and make history-scope…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-20T00:53:22Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9ac8d63f0530793f3989236de0a93c15876c5b70",
"body": "refactor: align Firestore migration indexes with actual queries",
"is_bot": false,
"headline": "Merge pull request #203 from secmon-lab/fix/refine-firestore-migration",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-20T00:38:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54391fcbca0430e48672d048784ba1bff5bd7c89",
"body": "v0.3.0 is the first released version containing the DiffConfigs fix\n(per-index comparison matching the Migrate path semantics). Replaces\nthe pseudo-version pin from the pre-release commit 50a6cfb.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: bump fireconf to v0.3.0",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-20T00:34:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "db1fbe1317bf4e5888eda82695145975736060f6",
"body": "fireconf v0.2.1's Client.DiffConfigs performed a count-only comparison\nthat reported all existing indexes as delete and all desired indexes as\nadd whenever the counts differed. The migrate --dry-run output from\nthis branch exposed the issue (identical indexes appearing in both ADD\nand DELETE). Upstr\n[…]\nmalized to COLLECTION,\nfield order preserved), so the plan output this branch prints now\naccurately reflects what Migrate will do.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "deps: bump fireconf to 50a6cfb to pick up DiffConfigs fix",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-20T00:19:20Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "959bf310a3898c31707e6b553a46ab12ea92cb54",
"body": "Removes the lists / memories / records entries that were left declared\nwith empty Indexes. The target Firestore databases carry no residual\nindexes under these collections (confirmed via dry-run), so keeping\nthem only produced noisy \"(no indexes declared, no existing indexes\nto remove)\" lines in the\n[…]\nis to either sweep them via the Firestore\nAdmin API or reintroduce the collection entry with Indexes: nil for\none migration cycle.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: drop empty deprecated collection declarations from migration",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T23:58:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cfaf5b5df3537f022a5a6bfb74ae7fa39cf0b7d8",
"body": "Backs out the speculative additions and removals applied in the previous\ncommits. The alerts and tickets index declarations now match main\nexactly — the only substantive change left in this PR is dropping the\nindex declarations under collections that have no corresponding query\nin pkg/repository/fir\n[…]\nn plan + completion output stays in place; only the\nunderlying index set is restored to the conservative \"remove dead only\"\nscope.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "revert: restrict index changes to removing lists/memories/records only",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T23:56:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d70fd3ce9f46d477606a329fa7080bd6b085d83a",
"body": "…ndexes\n\nAddresses review feedback from gemini-code-assist: the earlier change\nremoved lists/memories/records from the config entirely, which meant\nfireconf.Sync.Execute (which iterates only over config.Collections)\nwould never tear down their existing indexes. Re-declare these three\ncollections wit\n[…]\neclared collections that have nothing\npending, so the output stays readable once the deprecated collections\nhave been fully swept.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: keep deprecated collections declared and add missing composite i…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T23:47:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c51bbead63cd0481f08417251969e3bbbf0772cf",
"body": "Remove index declarations for collections that have no corresponding\nFindNearest or composite query in the firestore repository (lists\nvector indexes, memories/QueryEmbedding, records/Embedding). Keep only\nthe alerts and tickets indexes that match real query paths.\n\nAlso replace the structured-logge\n[…]\nLETE/\nKEEP plus a totals summary. Dry-run stops after printing; apply mode\nprints a completion line after all indexes reach READY.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: align Firestore migration indexes with actual query usage",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T23:35:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "72527702fba9a880a47aae095d7f35e51e7d9ed7",
"body": "…nd drop brittle cleanup",
"is_bot": false,
"headline": "fix(e2e): rename conversation spec to zzz_ to run after ticket.spec a…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T22:45:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "453a86fcb44bc092793739da929a146efedc8c7a",
"body": "… cleanup",
"is_bot": false,
"headline": "fix(e2e): resolve ticket before archiving in ticket-conversation.spec…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T22:08:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "efce16164070816efc83e9a68d0fcece4eaa7781",
"body": "…eep ticket.spec empty-list assertions green",
"is_bot": false,
"headline": "fix(e2e): archive the ticket created by ticket-conversation.spec to k…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:54:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4c13d6cc74b2c378f6b72bbdf71836859458b935",
"body": "…sessions from ticketSessions",
"is_bot": false,
"headline": "fix(chat): add session-consolidate migration and filter empty-Source …",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:51:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "90baf83b8ed8b1addb4a82321ec05444ff8bb3e4",
"body": "…ck, not web, since pre-redesign Warren only had Slack sessions",
"is_bot": false,
"headline": "fix(chat): session-source-backfill classifies every legacy row as sla…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:45:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8427dfa9266c3db9e0180c920b89e2d3226d007",
"body": "… to auto-heal legacy rows",
"is_bot": false,
"headline": "fix(chat): infer Session.Source at read time from SlackURL/ChannelRef…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:38:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "912233f4cb2bb6dbd3049f660451a488abfa6979",
"body": null,
"is_bot": false,
"headline": "fix(chat): add role=heading on Conversation card title for E2E + a11y",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:35:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d28d2fdd6a755ec01f7bcf69feaed0a3b1bdda41",
"body": "…tailPage",
"is_bot": false,
"headline": "fix(chat): remove redundant Chat Sessions sidebar panel from TicketDe…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:32:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f3766079d4ced50227c35e11d8e5f1615e53c764",
"body": null,
"is_bot": false,
"headline": "fix(chat): align avatar circle to fixed 32px to stop avatar overflow",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:30:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ba470c8cfe24bacc92f60acb10d82d0e98924682",
"body": "…ssage",
"is_bot": false,
"headline": "fix(chat): render Slack avatar + convert mrkdwn mentions in SessionMe…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:27:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd09ed9130cec67b7954335e4dd53acd6d2f286c",
"body": "…al stale Author.DisplayName rows",
"is_bot": false,
"headline": "fix(chat): resolve Slack display name at GraphQL read time to auto-he…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:24:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b39311848cc6c992530a15c50827098b22cc97c5",
"body": "The Slack Events API delivers both `message` and (when the text\ncontains a URL) `message_changed` events for the same logical user\nmessage, and also re-delivers on server retries. HandleSlackMessage\nwas persisting a new SessionMessage row each time, which is why the\nsame user input rendered twice in\n[…]\n\nThe user_message_saved golden fixture is updated to include the\n(expected, new) GetUserInfo call triggered by the profile lookup.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(chat): dedupe Slack user messages + resolve display name",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:20:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5681bcd33dd0781f786937e5f3889ecd4f930295",
"body": "Close the Web→Slack leak at the root by eliminating every direct\nc.slackService.NewThread(*target.SlackThread) call site in\naster/bluebell and routing them through chat.ResolveSink, which picks\nthe correct transport based on Session.Source. The Slack HITL wire\nformat is preserved byte-identical to p\n[…]\nbChatPane hosts HITLPanel and wires the\n pending state via useWebSocket.onHITLEvent.\n\nAll go vet / golangci-lint / go test clean.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): route aster/bluebell output through sinks + Web HITL UI",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T03:10:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d7b42d2c0acd20738ad9b678d487bb4934fdbd82",
"body": "Lay the foundation for routing non-HITL chat output through a single\ntransport-agnostic sink so that Web / CLI Sessions never touch the\nSlack API even when the underlying ticket happens to carry a\nSlackThread pointer. The direct aster/bluebell Slack call sites and\nHITL presenter wiring will be migra\n[…]\ng, MessageBubble timestamp cleanup,\nTurnCard deletion, Connected badge in header) that had been pending\nfrom the previous session.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): introduce ChatSink abstraction and Slack HITL golden guards",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T02:48:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a09101b5645754abe30d0ea74ca14842d496bc56",
"body": "Four user-reported regressions:\n\n1. Web messages leaking into Slack thread. setupMessageRouting built a\n slackThreadSvc whenever the ticket had a SlackThread attached,\n regardless of the chat's Session source. Now it only routes to\n Slack when chatCtx.Session.Source == SessionSourceSlack, so W\n[…]\nReact key tied\nto the selected session — double defense against cross-session\nleakage even if useWebSocket state somehow survives.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(chat): unified conversation timeline + Slack/Web routing isolation",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T01:38:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b962ae8410f42c69002b81a55c026c332b54a298",
"body": "WebUI refinements flagged by the user:\n- Fix \"over 2025 years\" in session list: formatRelativeTime now guards\n against empty / invalid / pre-1970 timestamps and returns \"\" so the\n caller renders nothing instead of a nonsensical label.\n- Kill the \"Trace · Trace\" / \"Response · Response\" duplication \n[…]\nt in-memory sort is noted in the\nmethod doc comment with a pointer to revisit when per-ticket message\ncounts cross a few thousand.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(web): conversation polish + review feedback",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T01:31:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "deaf1084666c001303c5a6032bdd45750003d660",
"body": null,
"is_bot": false,
"headline": "chore: exclude .claude/scheduled_tasks.lock from repo",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T01:21:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "659431a262ebe2ec6eadb020279abc86d0229945",
"body": "Merges the \"Chat\" card and the \"Conversation\" card into a single\nunified surface on the ticket detail page. The left sidebar now lists\nevery Slack / Web / CLI Session flat (no source tab switching); the\nright pane renders that Session's message timeline, with a send box\nappended for Web and CLI Sess\n[…]\nariants (conversation heading\n + New Chat button + empty-state copy); page-object updated to\n reflect the removed Source Toggle.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(web): unify TicketChat into TicketConversation",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T01:20:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c8a5d45da3f132d9f3446da4b19dce1ff4455ad2",
"body": "- Reuse chatCtx.Session in chat/usecase.go Execute so a redesign\n Session is not duplicated as a second legacy row per invocation.\n- Silence staticcheck deprecation on the legacy NewSession /\n NewMessage callers that are now only reachable from pre-redesign\n fallback paths or from tests asserting\n[…]\ning newline from schema.resolvers.go so check-codegen\n stops diffing.\n- Aster / Bluebell exec.go trace persist: use NewMessageV2.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(chat): CI fallout — lint + codegen drift",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T01:06:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "de1c2f52a99880cfab7da5c169977dd640ca0d49",
"body": "…onfinement\n\nPhase 3-6:\n- ChatFromWebSocket / ChatFromCLI now accept a Session and run one Turn\n per input, stamping user messages with TurnID and closing the Turn\n on completion. CLI main and WS handler create one Session per\n launch/connection via EnsureCLISession / EnsureWebSession.\n- WebSocke\n[…]\ndry-run order, rollback, confinement rationale).\n- CLAUDE.md multi-instance rule unchanged; spec updated to reflect\n final state.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor(chat): complete chat-session-redesign Phase 3-7 and legacy c…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-19T00:54:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3ca676994f548130fedc87c6087a3516dba435c9",
"body": "… wiring)\n\nMakes all five Phase 7 migration jobs invocable via\nwarren migrate --job <name>. The session-source-backfill job is fully\nfunctional; the remaining four (comment-to-message, turn-synthesis,\nhistory-scope, cleanup-legacy) surface their \"not yet implemented\"\nbusiness-logic errors so operato\n[…]\nestore client for listAll), and log the Result counters.\n\nNo existing functionality touched; task test:slack-golden remains green.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): wire chat-session-redesign migrate jobs into CLI (Phase 7…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T18:49:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "dfd42418b3e4601f57d2cede2b66343670ded466",
"body": "…e (Phase 5+6 infra)\n\nAdds the forward-facing scaffolding for Phase 5 (ChatContext migration)\nand Phase 6 (WebSocket event format) without touching the existing\naster/bluebell prompt templates or WebSocket wire format. Both changes\nare strictly additive so Phase 0 goldens stay green and downstream\nc\n[…]\n\n\nNo existing WebSocket code yet emits these envelopes; frontend\nmigration in a subsequent commit will switch the pipe end-to-end.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): add ChatContext redesign fields + WebSocket event envelop…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T18:16:25Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "49add60cee046f9fece7538b5cd9fe4234a1463e",
"body": "GraphQL side of the chat-session-redesign Phase 3.4 Comment API\nreplacement. The new query mirrors the just-added\nwarren_get_ticket_session_messages base tool and returns a strictly\nricher payload than the legacy ticketComments query it supersedes.\n\n- graphql/schema.graphql: SessionMessage gains tur\n[…]\nntend callers\nwill migrate to the new API in Phase 6 WebUI work. task\ntest:slack-golden stays green and full go test ./... passes.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): wire ticketSessionMessages GraphQL query (Phase 3.4)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T17:47:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e570db9d3c85772e6441821c4116e19b7c78c23e",
"body": "…-shell\n\nfeat: auto-infer alert tags during metadata generation",
"is_bot": false,
"headline": "Merge pull request #200 from secmon-lab/worktree-declarative-floating…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T14:06:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61123b761fbfdf88fd39fb92d796d168f1d4e475",
"body": "…emplate\n\nUse text/template actions inside alert_meta.md to decide whether to show the\nAvailable Tags section and the tags field guidance, instead of assembling\nmarkdown in Go. When no tags are registered, the whole Available Tags\nsection is omitted and the tags field rule is replaced with a plain\n\"output an empty array\" instruction, so the LLM never sees an empty list\nthat would invite hallucinations.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: move Available Tags conditional rendering into the prompt t…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T13:02:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "439c7fe8e88b965bd63d7c19c3b73666e2b49a75",
"body": "Introduces the chat-session-redesign replacement for the legacy\nwarren_get_ticket_comments base tool. The new tool returns messages\nacross every Session attached to the current ticket in a unified shape\n(user inputs + AI traces/plans/responses/warnings), with optional\nsource/type filters and the sam\n[…]\ntWarren_Specs expected-spec list\n updated to include the new tool.\n\ntask test:slack-golden remains green; full test suite passes.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): add warren_get_ticket_session_messages base tool (Phase 3.4)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T13:01:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4764a2fe8cd1da307c5fabce29aebca8a1991425",
"body": "…state\n\nPreviously the tag list was passed as []map[string]string and stringified\nto JSON by the prompt renderer, which produced noisy output and did not\ndegrade gracefully when no tags exist. Pre-render a markdown bullet list\nin Go, and emit an explicit notice telling the LLM to return an empty\narray when no tags are registered.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: render Available Tags as a bullet list with explicit empty …",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T12:57:58Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "be6a25885a23b969c5491f1277f7678a2214d648",
"body": "Adds the skeleton and first working job for the chat-session-redesign\nPhase 7 data migration pipeline. Each job is idempotent and lives in\npkg/usecase/migration/ per the DDD layering (business logic in usecase,\nnot the CLI layer). Jobs will be wired into pkg/cli/migrate.go's\nexisting migrationJobs s\n[…]\n\n- pkg/usecase/migration/migration_test.go: Result.MergeDetails coverage.\n\n`task test:slack-golden` green; full test suite passes.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): introduce migration package for Phase 7 data jobs",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T12:52:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d24c71377afdb4ef99d2fdad0a15413566e8bcd4",
"body": "The chat-session-redesign requires gollem.History to follow Session\nboundaries rather than Ticket boundaries so Slack sessions (thread-long,\nmulti-turn) and Web/CLI sessions (per-invocation, fresh) keep independent\nAI working memory. This commit adds the Session-keyed storage path as a\npeer of the e\n[…]\ng and swallow\" semantics used by\n the existing SaveHistory path.\n\n`task test:slack-golden` remains green; full test suite passes.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): add Session-scoped gollem.History storage (Phase 4)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T12:48:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "41d7f45b6509bc80683a360383a605cbca3dd51a",
"body": "Add a pipeline-level test that seeds a memory repository with real tags,\nruns ProcessAlertPipeline with a mock LLM that returns a mix of known\nand unknown tag names, and asserts that only the known ones survive Tag\nConversion as TagIDs on the resulting alert. Also ensures unknown names\ndo not trigger tag auto-creation.\n\nUse tag.NewID() instead of hard-coded IDs in the FillMetadata unit test.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: verify LLM-inferred tag names are persisted as TagIDs",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T12:47:49Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "979aa71920142b07e1a0687ff7a6d6a9f3abd81f",
"body": "…se 3.1/3.2)\n\nEvery user-authored chat input now also lands in the new Session +\nMessage timeline as Type=user. The legacy ticket.Comment writes and\nthe in-Execute legacy Session creation are retained so existing readers\n(GraphQL Ticket.comments, the warren_get_ticket_comments base tool,\nrefine.go /\n[…]\ndling.\n\nNo Slack API calls change on any path — `task test:slack-golden`\nremains green. Full `go test ./...` (70 packages) passes.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): mirror Slack/Web/CLI user input into session.Message (Pha…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T12:43:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "573aad838e7db33e5677ebfb4817897efbfa2de2",
"body": "Extend Alert.FillMetadata so the LLM can classify alerts into the existing\ntag set alongside title/description generation. Inferred names that are not\nin the available tag set are filtered out; the alert pipeline converts the\nmerged list (policy-provided + LLM-inferred) to tag IDs, which Ticket\ncrea\n[…]\nn.\n- Tag list is fetched once per pipeline invocation; a lookup failure logs\n a warning and skips inference rather than aborting.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: infer alert tags from existing tag set during metadata generation",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T12:43:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "995230876fb73d2b53d976da017ac7b9779e2acc",
"body": "…(Phase 2)\n\nAdds the Slack Session lifecycle enforcement layer around the existing\nChatUseCase.Execute entry point. The internal legacy Session creation\ninside Execute is retained for Phase 3+ to unify; this commit focuses\non the behaviors that the redesign mandates at the outer boundary:\n\n- ChatFro\n[…]\n same way on the happy path. ChatFromSlack-level golden\nfixtures (LLM deterministic end-to-end) remain as future work for\nPhase 5.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): wrap ChatFromSlack with Session resolver + activity lock …",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T12:40:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b21ee3ec5a2b397ec6f947db939c9cd63c2fd3ab",
"body": "Introduces the regression protection scaffolding and non-breaking domain\nmodel additions that the .spec/chat-session-redesign plan depends on.\nNo existing user-visible behavior changes; all new types coexist with the\nlegacy Session / Message fields until subsequent phases migrate them.\n\nPhase 0 — Sl\n[…]\nsage(type=user), rebind gollem.History to Session scope, simplify\nChatContext, rework the Web UI, and run the data migration jobs.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat): lay groundwork for chat session redesign (Phase 0 + Phase 1)",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T12:34:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7a7a4bb475c534d4a3bb2a188ecca0604d855cd1",
"body": "fix: update dompurify to 3.4.0 (GHSA-39q2-94rc-95cp)",
"is_bot": false,
"headline": "Merge pull request #199 from secmon-lab/fix/trivy-dompurify-update",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-18T00:03:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5b7945b6e17233a0fccb712f24bbfec9d66c54fc",
"body": "Resolves trivy CI failure by bumping dompurify from 3.3.3 to 3.4.0,\nwhich addresses the FORBID_TAGS bypass vulnerability.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: update dompurify to 3.4.0 to fix GHSA-39q2-94rc-95cp",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-17T23:25:42Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ca0043a7d4f90b55f3655798043d745ae9745700",
"body": null,
"is_bot": false,
"headline": "remove cursor setting",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-17T23:19:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a7c738cf4c58b9f5834d9411e79206a963a396f",
"body": "fix: use resolved channel ID for notice file upload",
"is_bot": false,
"headline": "Merge pull request #198 from secmon-lab/fix/notice-alert-data-upload",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-16T00:35:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54454b67539031ff8b4857d4e687e7bb5644c099",
"body": "Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: add notice_id to error context in sendSimpleNotification",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-15T23:32:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "437f63c294edaf335ded2a8d7cee8a943f690837",
"body": "…ng errors\n\nPostNotice was discarding the resolved channel ID returned by\nPostMessageContext, causing PostNoticeThreadDetails to pass the\noriginal (potentially unresolved) channel to UploadFileContext.\nThe files.completeUploadExternal API requires a proper channel ID,\nso the upload could silently fa\n[…]\nrs were\nswallowed as warnings at three levels (PublishNotice, sendSimpleNotification,\nhandleNotice), making the failure invisible.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: use resolved channel ID for notice file upload and stop swallowi…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-15T23:01:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "25bb6722f1bb4c7c6bdf96eff71f0a2f96633993",
"body": "…select\n\nfix: unify Slack resolve modal tag selection to multi-select",
"is_bot": false,
"headline": "Merge pull request #197 from secmon-lab/feat/resolve-dialog-tag-multi…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-15T05:35:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8447cefd51722c88e06c7c43a671e1cc9ddb64f9",
"body": "…DE.md\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: enforce English for commit messages and PR descriptions in CLAU…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-15T02:20:50Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "766ae35f695db321106a5e36cd5e2ed2fd51afab",
"body": "Add initial_options to the multi-select tag element so that tags already\nassigned to the ticket are pre-selected when the resolve modal opens.\nThis prevents accidental removal of existing tags on submit.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: pre-select existing tags in Slack resolve modal",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-15T02:19:44Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f05bf80549d873cf817a27f6335c0786e3f3062a",
"body": "Previously, tags were displayed as checkboxes when ≤10 tags existed and\nas a multi-select dropdown when >10. This unifies to always use the\nmulti-select dropdown for a cleaner UI.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: unify Slack resolve modal tag selection to multi-select dropdown",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-14T22:03:26Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c52daaf761308e6dc55a4d46afe114b08bf3ad82",
"body": "fix(trace): prevent planner agent from overwriting root trace",
"is_bot": false,
"headline": "Merge pull request #196 from secmon-lab/fix/trace-planner-overwrite",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-14T21:55:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "153777c8502521c8031ef6cb4e0514ca56ab6ded",
"body": "executePlannerAgent passed the raw trace.Recorder to gollem via\ngollem.WithTrace(handler). When gollem's Agent.Execute called\nStartAgentExecute on it, the Recorder replaced r.trace entirely,\ndestroying all previously recorded spans (task executions, tool calls,\nearlier plan phases). Only the last ex\n[…]\ncorder.StartAgentExecute\nfall back to a child span when a trace already exists, providing\ndefense-in-depth against similar issues.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(trace): prevent planner agent from overwriting root trace",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-14T09:51:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "660eb96571f12ec1fba3a296f7e1053ef67e6b78",
"body": "fix: archive all resolved tickets server-side",
"is_bot": false,
"headline": "Merge pull request #195 from secmon-lab/fix/archive-all-resolved-tickets",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-14T08:25:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb05a4d703ae9e3db0caa3a9d822439537c7aeaa",
"body": "Use unique ticket names with timestamps to avoid cross-test data conflicts.\nUse regex for confirmation dialog text matching. Navigate after archive to\nensure refetched state.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: stabilize E2E tests for archive all resolved feature",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-14T07:10:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "8e60a2b9ecdba370d7626069a9f80a15ac986fe1",
"body": "feat: add commit history and file blame to GitHub tool",
"is_bot": false,
"headline": "Merge pull request #194 from secmon-lab/feat/github-tool-commits-blame",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-14T07:04:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb8b24f30583996b9a29951a3f315c5f70c66720",
"body": "… only\n\nThe \"Archive All Resolved\" button previously only archived resolved tickets\nvisible on the current page due to pagination. Now uses a server-side\nmutation that fetches and archives all resolved tickets, with a confirmation\ndialog showing the accurate total count.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: archive all resolved tickets server-side instead of visible page…",
"author_name": "Masayoshi Mizutani",
"author_login": "m-mizutani",
"committed_at": "2026-04-14T06:27:13Z",
"body_truncated": false,
"is_coding_agent": true
}
],
"releases_count": 27,
"commits_last_year": 550,
"latest_release_at": "2026-07-20T22:52:29Z",
"latest_release_tag": "v0.17.2",
"releases_from_tags": false,
"days_since_last_push": 10,
"active_weeks_last_year": 43,
"days_since_latest_release": 10,
"mean_days_between_releases": 15.8
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/secmon-lab/warren",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/secmon-lab/warren",
"is_deprecated": false,
"latest_version": "v0.17.2",
"repository_url": "https://github.com/secmon-lab/warren",
"versions_count": 28,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-20T02:11:44Z",
"latest_version_yanked": null,
"days_since_latest_publish": 11
}
]
},
"popularity": {
"forks": 6,
"stars": 131,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2025-08-01",
"count": 2
},
{
"date": "2025-09-12",
"count": 1
},
{
"date": "2025-09-14",
"count": 2
},
{
"date": "2026-03-01",
"count": 1
}
],
"complete": true,
"collected": 6,
"total_forks": 6
},
"star_history": null,
"open_issues_and_prs": 2
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Taskfile.yml"
],
"api_schema_files": [
"graphql/schema.graphql"
],
"has_devcontainer": false,
"typecheck_configs": [
"frontend/tsconfig.json"
],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 628076,
"source_files_sampled": 645,
"oversized_source_files": 3,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 8117
},
"dependencies": {
"manifests": [
"frontend/package.json",
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go",
"npm"
],
"dependencies": [
{
"name": "@apollo/client",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^3.14.1"
},
{
"name": "@radix-ui/react-alert-dialog",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.1.15"
},
{
"name": "@radix-ui/react-avatar",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.1.11"
},
{
"name": "@radix-ui/react-collapsible",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.1.12"
},
{
"name": "@radix-ui/react-dialog",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.1.15"
},
{
"name": "@radix-ui/react-dropdown-menu",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^2.1.16"
},
{
"name": "@radix-ui/react-icons",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.3.2"
},
{
"name": "@radix-ui/react-label",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^2.1.8"
},
{
"name": "@radix-ui/react-navigation-menu",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.2.14"
},
{
"name": "@radix-ui/react-popover",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.1.15"
},
{
"name": "@radix-ui/react-select",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^2.2.6"
},
{
"name": "@radix-ui/react-separator",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.1.8"
},
{
"name": "@radix-ui/react-slider",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.3.6"
},
{
"name": "@radix-ui/react-slot",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.2.4"
},
{
"name": "@radix-ui/react-tabs",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.1.13"
},
{
"name": "@radix-ui/react-toast",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.2.15"
},
{
"name": "@radix-ui/react-tooltip",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.2.8"
},
{
"name": "@tailwindcss/typography",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^0.5.19"
},
{
"name": "class-variance-authority",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^0.7.1"
},
{
"name": "clsx",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^2.1.1"
},
{
"name": "date-fns",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^4.1.0"
},
{
"name": "dompurify",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^3.4.11"
},
{
"name": "graphql",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^16.13.2"
},
{
"name": "lucide-react",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^0.511.0"
},
{
"name": "react",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^19.2.4"
},
{
"name": "react-dom",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^19.2.4"
},
{
"name": "react-markdown",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^10.1.0"
},
{
"name": "react-router-dom",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^7.15.0"
},
{
"name": "remark-gfm",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^4.0.1"
},
{
"name": "tailwind-merge",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^3.5.0"
},
{
"name": "cloud.google.com/go/bigquery",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.79.0"
},
{
"name": "cloud.google.com/go/firestore",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.24.0"
},
{
"name": "cloud.google.com/go/storage",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.63.1"
},
{
"name": "github.com/99designs/gqlgen",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.17.94"
},
{
"name": "github.com/bradleyfalzon/ghinstallation/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.19.0"
},
{
"name": "github.com/dustin/go-humanize",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.1"
},
{
"name": "github.com/fatih/color",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.19.0"
},
{
"name": "github.com/getsentry/sentry-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.48.0"
},
{
"name": "github.com/go-chi/chi/v5",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v5.3.1"
},
{
"name": "github.com/gollem-dev/gollem",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.28.0"
},
{
"name": "github.com/gollem-dev/tools/abusech",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/gollem-dev/tools/bigquery",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/gollem-dev/tools/github",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.3.0"
},
{
"name": "github.com/gollem-dev/tools/intune",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/gollem-dev/tools/ipdb",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/gollem-dev/tools/otx",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/gollem-dev/tools/shodan",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/gollem-dev/tools/slack",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.3.0"
},
{
"name": "github.com/gollem-dev/tools/urlscan",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/gollem-dev/tools/vt",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/gollem-dev/tools/webfetch",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.3.0"
},
{
"name": "github.com/gollem-dev/tools/whois",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/google/go-github/v74",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v74.0.0"
},
{
"name": "github.com/google/uuid",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.0"
},
{
"name": "github.com/gorilla/websocket",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.5.3"
},
{
"name": "github.com/graph-gophers/dataloader/v7",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v7.2.0"
},
{
"name": "github.com/lestrrat-go/jwx/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.1.7"
},
{
"name": "github.com/m-mizutani/clog",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.1"
},
{
"name": "github.com/m-mizutani/fireconf",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.3.0"
},
{
"name": "github.com/m-mizutani/goerr/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.1"
},
{
"name": "github.com/m-mizutani/gt",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.1"
},
{
"name": "github.com/m-mizutani/harlog",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.3"
},
{
"name": "github.com/m-mizutani/masq",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.2"
},
{
"name": "github.com/m-mizutani/opaq",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.4.0"
},
{
"name": "github.com/newmo-oss/go-caller",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.1.0"
},
{
"name": "github.com/slack-go/slack",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.27.0"
},
{
"name": "github.com/stretchr/testify",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.11.1"
},
{
"name": "github.com/urfave/cli/v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.10.1"
},
{
"name": "github.com/vektah/gqlparser/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.5.36"
},
{
"name": "google.golang.org/api",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.289.0"
},
{
"name": "google.golang.org/genai",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.64.0"
},
{
"name": "google.golang.org/grpc",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.82.1"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 203,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 15,
"closed_unmerged_prs": 7
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "m-mizutani",
"commits": 599,
"avatar_url": "https://avatars.githubusercontent.com/u/605953?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"cache-cleanup.yml",
"codegen.yml",
"e2e.yml",
"gosec.yml",
"lint.yml",
"publish.yml",
"release.yml",
"test.yml",
"trivy.yml"
],
"has_docs_dir": true,
"linter_configs": [
"eslint.config.mjs"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum",
"pnpm-lock.yaml"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "18 out of 18 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/19 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 6,
"reason": "project has 2 contributing companies or organizations -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 5,
"reason": "dependency not pinned by hash detected -- score normalized to 5",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 6,
"reason": "SAST tool is not run on all commits -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "24 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "e9c3607d0f54c040d60c9e65fb21d1b4981e05a2",
"ran_at": "2026-07-31T16:16:34Z",
"aggregate_score": 4.3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-31T05:26:05Z",
"oldest_open_prs": [
{
"number": 216,
"created_at": "2026-05-23T00:01:16Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 225,
"created_at": "2026-06-22T07:25:16Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-20T02:11:44Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/secmon-lab/warren",
"host": "github.com",
"name": "warren",
"owner": "secmon-lab"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": "The weighted overall 67 is calibrated to 78 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 67,
"calibrated": 78,
"calibration": "2026-08-02"
}
}
],
"value": 78,
"inputs": {
"security": 43,
"vitality": 92,
"community": 45,
"governance": 58,
"calibration": "2026-08-02",
"engineering": 84,
"ai_readiness": 87,
"weighted_overall_raw": 67
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 92,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 87,
"inputs": {
"commits_last_year": 550,
"human_commit_share": 1,
"days_since_last_push": 10,
"active_weeks_last_year": 43
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 10 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "43/52 weeks with commits",
"points": 29.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 43
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "550 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 550
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "exceptional",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 27,
"latest_release_tag": "v0.17.2",
"releases_from_tags": false,
"days_since_latest_release": 10,
"mean_days_between_releases": 15.8
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "27 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 27
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 10 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~15.8 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 15.8
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 15,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 15 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 15
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "weak",
"name": "Community & Adoption",
"value": 45,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "weak",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"forks": 6,
"stars": 131,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "131 stars",
"points": 34.3,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 131
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "6 forks",
"points": 5.8,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 6
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": null,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 58,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 16,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 6,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 82,
"inputs": {
"merged_prs": 203,
"open_issues": 0,
"closed_issues": 15,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 7,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 42,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "203/210 decided PRs merged",
"points": 29,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 203,
"decided": 210
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/19 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"followers": 14,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "secmon-lab",
"public_repos": 14,
"account_age_days": 708
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "14 followers of secmon-lab",
"points": 8.5,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 14,
"login": "secmon-lab"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "14 public repos, account ~1 yr old",
"points": 12.4,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 14
}
},
{
"code": "account_age_years",
"params": {
"years": 1
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/secmon-lab/warren"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 11
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 11 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 11
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "28 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 28
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "excellent",
"name": "Engineering Quality",
"value": 84,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "excellent",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "9 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 9
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "eslint.config.mjs",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.mjs"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "18 out of 18 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"topics": [
"ai",
"llm",
"security"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "3 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 3
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "weak",
"name": "Security",
"value": 43,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "weak",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 43,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 4.3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "18 out of 18 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/19 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 5",
"points": 2.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 6",
"points": 3,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "24 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 1
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "excellent",
"name": "AI Readiness",
"value": 87,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.97,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 8117
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "97 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 97,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 87,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum",
"pnpm-lock.yaml"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Taskfile.yml"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"frontend/tsconfig.json"
],
"agent_commit_share": 0.47,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Taskfile.yml",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Taskfile.yml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "eslint.config.mjs",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.mjs"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "frontend/tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "frontend/tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "47 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 47,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 5",
"points": 5,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "exceptional",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 628076,
"source_files_sampled": 645,
"oversized_source_files": 3
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "3/645 source files over 60KB",
"points": 54.7,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 645,
"oversized": 3
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "excellent",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 80,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": [
"graphql/schema.graphql"
]
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": "graphql/schema.graphql",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "graphql/schema.graphql"
}
}
],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"top": [
"application"
],
"labels": [
"web-ui"
],
"scores": {
"web-ui": 4,
"library": 3,
"network-service": 3
},
"primary": "web-ui",
"evidence": [
{
"tier": "dependencies",
"label": "web-ui",
"source": "dep:react-dom",
"weight": 4
},
{
"tier": "distribution",
"label": "library",
"source": "registry:go",
"weight": 3
},
{
"tier": "structure",
"label": "network-service",
"source": "api_schema",
"weight": 3
}
],
"artifacts": [],
"confidence": "low",
"host_extension": false,
"runs_as_process": true,
"consumed_by_code": false
},
"metrics_version": "2.5.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-31T16:16:52.852573Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/secmon-lab/warren.svg",
"full_name": "secmon-lab/warren",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}