公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-30 03:35 UTC
stranxik / runward
After the spec: ship and run. A delivery framework for agentic systems — floor first, evolution on evidence, governance from day zero, handover with proof.
stranxik/runward 的健康指数为 100 分中的 63 分，处于「中等」区间。 其得分最高的类别是Engineering Quality（77/100），最低的是Community & Adoption（47/100）。 最近一次更新在今天。 近期的大部分工作由 1 位贡献者完成。
63
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
63
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 | 标签 |
|---|---|---|---|---|---|---|
| npm | runward | 0.22.0 | 3,163 | 27 | 8 天前 | agenticai-agentsspec-drivendeliverygovernancellmarchitecture |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
70
开发活跃度
57中等
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 0 天前 |
| 2.8/36 | 提交节奏 — 52 周中有 4 周有提交 |
| 18/18 | 提交量 — 最近一年 240 次提交 |
| 0/10 | OpenSSF Scorecard：Maintained — project was created within the last 90 days. Please review its contents carefully |
所用输入
| commits_last_year | 240 |
| human_commit_share | 1 |
| days_since_last_push | 0 |
| active_weeks_last_year | 4 |
发布纪律
90优秀
评分方式
| 27/27 | 有发布版本 — 已发布 26 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 8 天前 |
| 27/27 | 发布节奏 — 约每 0.6 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — Project has not signed or included provenance with any releases. |
所用输入
| releases_count | 26 |
| latest_release_tag | v0.22.0 |
| releases_from_tags | 否 |
| days_since_latest_release | 8 |
| mean_days_between_releases | 0.6 |
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
47
流行度与采用
1危急
评分方式
| 0/60 | 星标 — 1 个星标 |
| 0/25 | 复刻 — 0 个复刻 |
| 0/15 | 关注者 — 0 位关注者 |
所用输入
| forks | 0 |
| stars | 1 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
92优秀
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（MIT） |
| 18/18 | CONTRIBUTING 指南 |
| 13.5/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 6.3/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 是 |
| has_issue_template | 否 |
| has_code_of_conduct | 是 |
| has_pull_request_template | 是 |
生态采用（下载量）
58中等
评分方式
| 46.7/80 | 月度下载量 — npm 合计每月 3,163 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | runward |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 3,163 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
54
维护者韧性（巴士系数）
10危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0/22.5 | 提交分布 — 头号贡献者编写了 100% 的提交 |
| 1.4/13.5 | 贡献者广度 — 1 位贡献者 |
| 0/10 | OpenSSF Scorecard：Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
议题与 PR 响应能力
79良好
评分方式
| 46.8/46.8 | 议题解决 — 100% 的议题已关闭 |
| 32.4/38.3 | PR 接受 — 已裁定的 PR 中 33/39 已合并 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/13 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 33 |
| open_issues | 0 |
| closed_issues | 1 |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 6 |
所有权与托管责任
46存在风险
评分方式
| 10/30 | 所有权背书 — 个人（用户）账户 |
| 0/20 | 已验证域名 — 不适用于个人账户 |
| 6.1/25 | 所有者影响力 — stranxik 有 6 位关注者 |
| 20.8/25 | 既往记录 — 15 个公开仓库，账户约 9 年 |
所用输入
| followers | 6 |
| owner_type | User |
| is_verified | — |
| owner_login | stranxik |
| public_repos | 15 |
| account_age_days | 3,418 |
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — npm 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 8 天前 |
| 20/20 | 版本历史 — 27 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | runward |
| ecosystems | npm |
| any_deprecated | 否 |
| min_days_since_publish | 8 |
工程质量
基础的工程与文档实践是否到位？
77
工程实践
68中等
评分方式
| 24/24 | CI 工作流 — 4 个工作流 |
| 24/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard：CI-Tests — 8 out of 8 merged PRs checked by a CI test -- score normalized to 10 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
文档
90优秀
评分方式
| 30/30 | README |
| 25/25 | 文档目录 |
| 15/15 | 文档 / 主页站点 — https://runward.dev |
| 10/10 | 仓库描述 |
| 0/10 | 主题标签 |
| 10/10 | Wiki |
所用输入
| topics | — |
| has_wiki | 是 |
| homepage | https://runward.dev |
| has_readme | 是 |
| has_docs_dir | 是 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
67
安全态势
59中等
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — 无数据 |
| 2.5/2.5 | CI-Tests — 8 out of 8 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/13 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 4.5/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 9 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 7.5/7.5 | Token-Permissions — GitHub workflow tokens follow principle of least privilege |
| 6/7.5 | Vulnerabilities — 2 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 5.9 |
已排除计分（无数据或不适用）：branch_protection。 其余权重已重新归一化。
依赖安全公告
100优秀
评分方式
| 35/35 | 直接依赖不含已知公告 — 没有直接依赖携带已知公告 |
| 25/25 | 间接依赖不含已知公告 — 没有间接依赖携带已知公告 |
| 0/40 | 没有长期未处理的公告 — 没有公告带有发布日期 |
所用输入
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 27 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
已排除计分（无数据或不适用）：没有长期未处理的公告。 其余权重已重新归一化。 比对的是 npm:runward@0.22.0 的运行时依赖闭包——安装已发布的软件包时真正被拉取进来的内容——共 27 个软件包。 未对可达性进行分析。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
72
AI 代理上下文与指引
85优秀
评分方式
| 45/45 | 代理指令 — examples/request-triage/AGENTS.md, floor-ts/AGENTS.md, templates/targets/AGENTS.md |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 100 次人类提交中有 95 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.95 |
| agent_instruction_files | examples/request-triage/AGENTS.md, floor-ts/AGENTS.md, templates/targets/AGENTS.md |
| agent_instruction_max_bytes | 133,430 |
评分方式
| 0/18 | 一条命令的引导启动 |
| 22/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 11/11 | 静态类型检查 — examples/request-triage/code/tsconfig.json, floor-ts/tsconfig.json, tsconfig.json |
| 10/10 | 可复现环境 — lockfile |
| 0/10 | 已体现的代理实践 — 最近 100 次提交中没有代理编写的提交 |
| 5/8 | 自动化维护 — 已配置依赖自动化，但在抽样提交中未观察到 |
| 9/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 9 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | package-lock.json |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | examples/request-triage/code/tsconfig.json, floor-ts/tsconfig.json, tsconfig.json |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
面向模型的代码可读性
100优秀
评分方式
| 45/45 | 可类型检查的代码 — TypeScript（静态类型） |
| 55/55 | 可控的文件大小 — 采样的 90 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | TypeScript |
| largest_source_bytes | 41,069 |
| source_files_sampled | 90 |
| oversized_source_files | 0 |
机器可读接口
60中等
评分方式
| 0/40 | API 模式（OpenAPI/GraphQL/proto） |
| 20/20 | MCP 服务器 |
| 40/40 | 可运行示例 — examples |
所用输入
| example_dirs | examples |
| has_mcp_signal | 是 |
| api_schema_files | — |
关键数据
1GitHub 星标
1贡献者
240最近 12 个月提交数
0距最近推送天数
26发布版本数
1巴士系数（bus factor）
0开放议题
npm软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
更多细节
OpenSSF Scorecard 5.9 / 10
5.9综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 不适用 | Branch-Protection | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| 10 | CI-Tests | 8 out of 8 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/13 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 9 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 9 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 10 | Security-Policy | security policy file detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 10 | Token-Permissions | GitHub workflow tokens follow principle of least privilege |
| 8 | Vulnerabilities | 2 existing vulnerabilities detected |
直接依赖 4
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| npm | zod | ^4.4.3 | floor-ts/package.json |
| npm | @inquirer/prompts | ^8.5.2 | package.json |
| npm | chalk | ^5.6.0 | package.json |
| npm | commander | ^15.0.0 | package.json |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
依赖安全公告 0
安装 npm:runward@0.22.0 会引入 27 个包（直接与传递）：其中 0 个存在已知公告，0 个为直接依赖。
没有已知公告影响已评估的依赖。
公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 2181,
"has_wiki": true,
"homepage": "https://runward.dev",
"languages": {
"Shell": 633,
"Python": 1783,
"JavaScript": 142995,
"TypeScript": 309690
},
"pushed_at": "2026-07-29T09:54:02Z",
"created_at": "2026-07-05T21:40:41Z",
"owner_type": "User",
"updated_at": "2026-07-29T09:55:39Z",
"description": "After the spec: ship and run. A delivery framework for agentic systems — floor first, evolution on evidence, governance from day zero, handover with proof.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript",
"JavaScript"
]
},
"owner": {
"blog": "https://runward.dev",
"name": "Thibault",
"type": "User",
"login": "stranxik",
"company": null,
"location": "France",
"followers": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/26541747?v=4",
"created_at": "2017-03-20T10:42:16Z",
"is_verified": null,
"public_repos": 15,
"account_age_days": 3418
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.22.0",
"kind": "minor",
"published_at": "2026-07-21T15:17:35Z"
},
{
"tag": "v0.21.1",
"kind": "patch",
"published_at": "2026-07-21T13:15:11Z"
},
{
"tag": "v0.21.0",
"kind": "minor",
"published_at": "2026-07-19T19:25:59Z"
},
{
"tag": "v0.20.0",
"kind": "minor",
"published_at": "2026-07-19T13:02:17Z"
},
{
"tag": "v0.19.0",
"kind": "minor",
"published_at": "2026-07-17T12:46:00Z"
},
{
"tag": "v0.18.1",
"kind": "patch",
"published_at": "2026-07-16T10:30:19Z"
},
{
"tag": "v0.18.0",
"kind": "minor",
"published_at": "2026-07-16T08:23:23Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2026-07-16T02:51:13Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2026-07-16T02:02:49Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2026-07-16T00:59:50Z"
},
{
"tag": "v0.14.2",
"kind": "patch",
"published_at": "2026-07-13T15:35:19Z"
},
{
"tag": "v0.14.1",
"kind": "patch",
"published_at": "2026-07-13T10:57:52Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2026-07-13T10:26:06Z"
},
{
"tag": "v0.13.3",
"kind": "patch",
"published_at": "2026-07-12T20:40:53Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2026-07-12T11:10:38Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2026-07-12T10:38:32Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2026-07-12T09:44:00Z"
},
{
"tag": "v0.12.2",
"kind": "patch",
"published_at": "2026-07-11T18:45:46Z"
},
{
"tag": "v0.12.1",
"kind": "patch",
"published_at": "2026-07-11T10:53:17Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2026-07-11T08:58:40Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2026-07-10T11:48:58Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2026-07-10T07:50:45Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2026-07-09T12:18:06Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-07-09T12:08:57Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-07-07T15:05:47Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-07-07T12:06:36Z"
}
],
"recent_commits": [
{
"oid": "9c30a25dd438f14658afbdd5b47b1ec40c06ad63",
"body": "docs(adr): ratify the brownfield/characterize ADRs (0033–0038)",
"is_bot": false,
"headline": "Merge pull request #48 from stranxik/docs/ratify-brownfield-adrs",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-29T09:53:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32a64d13dff1beee9defd4c5a3ca64c9a80df990",
"body": "…en proof\n\nThe six ADRs from the 2026-07-20 resume-existing audit — ADR-0033 (status\nnames the iterate steady-state and the reopening watch) and ADR-0034..0038\n(characterize sees the whole tree, extracts pinned versions offline, reports\nchurn/bus-factor, detects infra & framework/DB signals, mines d\n[…]\ntion for\n ADR-0035) — the two ADRs that had unit coverage only.\n- CHANGELOG: a dated Ratification entry naming the drift; no version bump.\n\nSelf-gate green: 109 unit tests, smoke OK, oscal-schema OK.",
"is_bot": false,
"headline": "docs(adr): ratify the brownfield/characterize ADRs (0033-0038) + hard…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-29T09:50:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d23c4b05bcc32ad34287ce4f576ab8e4c09e4cb7",
"body": "chore(release): v0.22.0 — every gate names what it cannot verify",
"is_bot": false,
"headline": "Merge pull request #39 from stranxik/release/v0.22.0",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-21T15:17:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84e5bb88ec2c9a5d84fed94859136eeaaf857326",
"body": null,
"is_bot": false,
"headline": "chore(release): v0.22.0 — every gate names what it cannot verify",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T15:16:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc9dfb06d31ebc98809be196a015c9e083aaf2fb",
"body": "feat(rules): ADR-0040 ratified — per-rule non-scope declaration",
"is_bot": false,
"headline": "Merge pull request #38 from stranxik/feat/adr-0040-nonscope",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-21T15:04:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6212cf2948a26f6ed01460434af5060c64ef6c81",
"body": "…-wide default\n\nEvery gate names what it cannot verify. GATE_NON_SCOPE stated once\n(machine surface + explain + ISO readiness draft); per-rule nonScope\nwhere the blind zone is narrower (4 rules seeded). Gate path, manifest\nand ADR-0003 lint untouched — the rule-file carrier made the feared\nmigration unnecessary. 106 tests, self-gate green.",
"is_bot": false,
"headline": "feat(rules): ADR-0040 ratified — per-rule non-scope declaration, gate…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T15:03:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab0f835a1d6b718f08766ad3e1358da05bad4811",
"body": "docs: survey-grounded pass — third guardrail, change contract, ADR-0040 (proposed), distillation fence",
"is_bot": false,
"headline": "Merge pull request #37 from stranxik/docs/survey-actions",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:29:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "62dbf698840124eed3d207b0250e7b09a5e8fe9e",
"body": "…ot a trigger",
"is_bot": false,
"headline": "docs(roadmap): AHE loop as the satellite's citable frame — a frame, n…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:27:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "612f428d5a61aab91b3a34da7e00e5a4437642e6",
"body": "…v 2605.18747)",
"is_bot": false,
"headline": "merge survey/regulated-adoption (flotte worktrees, confrontation arXi…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:27:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b5d0a150ad3a9d465139f1ce67cf4c75a1793be3",
"body": "… 2605.18747)",
"is_bot": false,
"headline": "merge survey/adr-0040-nonscope (flotte worktrees, confrontation arXiv…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:27:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d14703c8a2d9973816e0420629e97010af15c729",
"body": "…v 2605.18747)",
"is_bot": false,
"headline": "merge survey/adr-0006-amendment (flotte worktrees, confrontation arXi…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:27:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3fef48ea40931fd643c6d9aa715092600939331a",
"body": "…18747)",
"is_bot": false,
"headline": "merge survey/positioning (flotte worktrees, confrontation arXiv 2605.…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:27:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a52b839deefe746ececf177a3389f830e9d7727",
"body": "…Xiv 2605.18747)\n\n- Compliance guardrails: add the academic pendant to FedRAMP RFC-0024 and\n Delve — the SWE-bench solved-correctly study (arXiv 2503.15223) cited by\n the Code-as-Agent-Harness survey for its oracle-adequacy crisis, plus the\n 14-53% step-level failure-attribution range, and the su\n[…]\nsions at delivery, never runtime actions) and 'change contract' in\n pillar 4 (dated reevaluation triggers + ADR-0006 tracked migrations).\n\nDrift gate: test/unit/positioning-drift.test.js green (5/5).",
"is_bot": false,
"headline": "docs(positioning): third guardrail talking point + survey lexicon (ar…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:27:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c9f3a843e32c1a6938cebdfc3083fee8988529b4",
"body": "…alising ADR-0005 (status: proposed)",
"is_bot": false,
"headline": "docs(adr): ADR-0040 candidate — per-rule non-scope declaration, gener…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:26:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c59a4bd23e401e947953d790ddaa570348c3afa8",
"body": "…y dated ADR, not promise (arXiv 2605.18747)",
"is_bot": false,
"headline": "docs(regulated): the distillation-surface fence — traces stay yours b…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:25:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ce5c1af7f89f32e4dcc1027a75ffdf04bae4b2ab",
"body": "…(invariants, falsifier, rollback)",
"is_bot": false,
"headline": "docs(adr): amend ADR-0006 — the migration entry as a change contract …",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T14:25:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "776f7a671c5853f19412b05cab4eed7eb59ca2d1",
"body": "chore(release-workflow): migrate deprecated actions/attest-sbom to actions/attest",
"is_bot": false,
"headline": "Merge pull request #36 from stranxik/chore/attest-migration",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-21T13:23:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2fd9935557547ade9f7becabacc1194237068c45",
"body": "…w action name\n\nThe posture guard pinned the literal 'attest-sbom@<sha>'; the migration to\nactions/attest tripped it (as designed). The guard now asserts the successor\naction SHA-pinned AND the sbom-path binding, preserving the guarded property:\nSBOM SLSA-attested against the published tarball.",
"is_bot": false,
"headline": "test(posture): guard follows the attest migration — same property, ne…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T13:23:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0415e904aaa224a2215de002cb5953a39f05574d",
"body": "…tions/attest\n\nSurfaced as a deprecation warning in the v0.21.1 publish log. actions/attest\nv4.2.0 accepts sbom-path directly (creates the same SBOM attestation); inputs\nunchanged, SHA-pinned. Real proof lands with the next release run.",
"is_bot": false,
"headline": "chore(release-workflow): migrate deprecated actions/attest-sbom to ac…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T13:20:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4410048ebdf94fd8935578d418974bb507c91f7",
"body": "chore(release): v0.21.1 — the three tiers, named",
"is_bot": false,
"headline": "Merge pull request #35 from stranxik/release/v0.21.1",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-21T13:14:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07bb8684b9c5ee3df4cdaf223d049d3d624fb7a5",
"body": "CHANGELOG block for the docs release (ADR-0039, two site pages, roadmap\ngroom), version stamped across the six distribution manifests, roadmap\nre-groomed at v0.21.1. No CLI change, no gate change.",
"is_bot": false,
"headline": "chore(release): v0.21.1 — the three tiers, named",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T13:13:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "59f859ab440e7eedd72e957a82d2244cb9a75c55",
"body": "docs(adr): ADR-0039 — the operator layer stays outside the CLI",
"is_bot": false,
"headline": "Merge pull request #34 from stranxik/docs/operator-layer",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-21T13:08:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f93267556a5880ff4c08d87c53a587503dd3ce1a",
"body": "… roadmap\n\nThree tiers named (docs to follow on the site), wiring guide planned,\ninert samples at most, operator tooling never in the MIT CLI, satellite\ndeferred behind the ADR-0028 channel-signal watch.",
"is_bot": false,
"headline": "docs(adr): ADR-0039 — the operator layer stays outside the CLI; groom…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-21T13:02:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be6567000a99766a938789f91d0e889f559b2632",
"body": "…tate\n\nfix(brownfield): close the resume-existing audit findings (ADR-0033–0038)",
"is_bot": false,
"headline": "Merge pull request #33 from stranxik/adr-0033-status-iterate-steady-s…",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-20T08:03:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b48670efe8b83d599b15f6307e8cbd29fe4c726",
"body": "A multi-agent audit of the resume-existing lot (adversarially verified,\n47/48 findings confirmed) surfaced three blockers and a set of important\ndefects, all in the code that promises deterministic *facts*. Fixed at\nthe root — no workarounds, no debt — with the ADRs amended to match.\n\nDeterminism (w\n[…]\nckfile fixture per\nclaimed family; scoped-extraction fixtures; the cross-locale determinism\nprobe. Also aligned runward's own ADR-0001 to the mandated trigger\nheading so its dogfooded status is clean.",
"is_bot": false,
"headline": "fix(brownfield): close the resume-existing audit findings (0033-0038)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-20T07:55:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8bbef0c5e3f8b05460b9e8b6e03b37893652b0ed",
"body": "ROADMAP.md had not been touched since v0.14.2: the floor-ts English\npass and the documentation site were both long shipped and still listed\nas ahead. Groomed, and — same fix pattern as the manifest stamps — a\npackaging test now fails the build if the 'Last groomed' stamp lags the\npackage version, so the roadmap can no longer rot silently.",
"is_bot": false,
"headline": "chore(roadmap): groom (7 releases late) + stale-roadmap guard",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T20:05:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "504c83823507864146e633f21ad1048bf466bd9b",
"body": "README: the guiding principle now names its ancestry (information\nhiding, Parnas 1972; ports and adapters, Cockburn 2005) and states the\ndefault-not-requirement status inline, linking when-to-use. when-to-use:\nthe modularity paragraph gains the family map — onion, Clean,\nfunctional core, modular monolith all satisfy the hexa-* rules as\napplied (the rules check substance, never the label); vertical-slice or\ntransaction-script is the healthy deviated case.",
"is_bot": false,
"headline": "docs: place the hexagonal default in its fifty-year lineage",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T19:50:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9aaaf41e8a6014a69e9592db37c3ec79080eea04",
"body": "The structure-neutrality argument existed without its words: the default\nshape is a modular core behind ports and adapters (hexagonal), a sober\ndefault with evolution triggers, never a requirement — the gate checks\nthe decision was confronted, and deviating with a traced ADR passes\ngreen (runward's own mission deviates). Extends the 'One language in\nthe core' neutrality from language to structure.",
"is_bot": false,
"headline": "docs(when-to-use): name modularity and the hexagonal default explicitly",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T19:43:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67f924784b2e79915cfec87184ef28aa7b42c2a1",
"body": "Extend 'runward gates itself' with the supply-chain parallel: publishing\nis a deliberate human gesture, everything downstream is deterministic\nmachinery (OIDC trusted publishing, SLSA provenance, attested SBOM).\nThe deterministic executes; the human decides the crossing.",
"is_bot": false,
"headline": "docs(readme): the release runs the same stance as the gate",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T19:28:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed0ce84186282dcf9b8ba5b3ac58a52a2db81328",
"body": "One command, the whole chain green: init --example now chains check --strict\non the freshly scaffolded reference mission (deterministic, zero-network,\nskipped under --dry-run), and its next-steps point at the guard demo\n(npm run demo — req-005, fabricated account, refused fail-closed).\n\nREADME accur\n[…]\nced comparison (Spec Kitty), FDE expanded on first use,\nWhy section leads with what runward does, compare + case-study linked from\nthe Documentation list. Example README counts all five demo requests.",
"is_bot": false,
"headline": "feat(init): --example ends by running the strict gate itself (v0.21.0)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T19:10:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7860e9f8cab775e5d37ad8943a77d9db6903422a",
"body": "docs(readme): surface 'try it' up front + lighten Why",
"is_bot": false,
"headline": "Merge pull request #32 from stranxik/docs/readme-try-it-early",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-19T13:47:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9117417b74edceb8325a362ad876519f2a9e6d48",
"body": "Since the repo is the Show HN landing and the post's angle is 'go test it',\nmove the one-command trial up front (right after the entry, before the dense\nWhy section) instead of burying it ~50 lines down under Install. Show both:\n'npx runward init --example' (watch the chain go green + the guard catc\n[…]\nricated value) and 'npx runward init' (start your own project). Also\ncondense the densest Why paragraph (dropped the five-gestures enumeration;\nthe detail lives in the method/differentiator sections).",
"is_bot": false,
"headline": "docs(readme): surface 'try it' right after the entry + lighten Why",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T13:47:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c47997443e95d1d02ee35306b5a44125c8ce6ac7",
"body": "fix(readme): self-host the npm badge (no shields/camo flap)",
"is_bot": false,
"headline": "Merge pull request #31 from stranxik/fix/npm-badge-self-hosted",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-19T13:14:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d7949cf90a9d122863d7c54573a2d2eb1a0d0032",
"body": "The npm badge kept flapping (broken then delayed) — GitHub's camo proxy\nfetching img.shields.io at cold cache. It was the only dynamic badge; even\nmade static, it depends on the flaky camo<->shields path. Serve it from the\nrepo instead (raw.githubusercontent, GitHub's own domain, like the banner):\nrenders reliably, zero external dependency, no flap on launch day. Rendered\nat 2x, displayed at height 28 to match the shields for-the-badge row.",
"is_bot": false,
"headline": "fix(readme): self-host the npm badge (no more shields/camo flap)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T13:13:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "87724fdf605f9462f214bc0ea6051d9b4896a667",
"body": "fix(release): SBOM job must not attach to the release (contents:read)",
"is_bot": false,
"headline": "Merge pull request #30 from stranxik/fix/release-sbom-no-release-assets",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-19T13:01:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "094dc395dda2486581ccabf1c268eb3ad9648c46",
"body": "The v0.20.0 release failed: anchore/sbom-action defaults to\nupload-release-assets:true, which needs contents:write — but the unprivileged\nSBOM job is contents:read (the whole point of the split). Set it false; the\nSBOM travels as a workflow artifact and the privileged publish job attaches it\nto the release (it has contents:write). Fail-closed worked: nothing published.",
"is_bot": false,
"headline": "fix(release): SBOM job must not attach to the release (contents:read)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T13:00:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e6328ac160d1865b64855faaa8505f2806031dc",
"body": "chore(release): v0.20.0",
"is_bot": false,
"headline": "Merge pull request #29 from stranxik/release/v0.20.0",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-19T12:56:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0cf26286ff6676291262988cb37888552be83182",
"body": "Bumps the version across package.json, the six distribution manifests (the\npackaging guard requires them in lockstep), CITATION.cff, the repo's own\nmission stamp and the distribution examples; adds the v0.20.0 CHANGELOG entry.\n\nShips: regulated-adoption evidence + SBOM/provenance (ADR-0031), OSCAL 1\n[…]\nven by a third-party tool (ADR-0032), the security-audit hardening, the\nTypeScript 7 forward-compat, and the docs/README work. Publish happens when\nthe GitHub Release is cut (OIDC trusted publishing).",
"is_bot": false,
"headline": "chore(release): v0.20.0",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T12:55:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f45dc122d5229dea4407179f9c1d2fc61fe3ec76",
"body": "fix(readme): static npm badge (shields live endpoint failing)",
"is_bot": false,
"headline": "Merge pull request #28 from stranxik/fix/readme-npm-badge-static",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-19T12:52:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dbb84304fc28a6b3c57eabe004d9a1334bfa58c4",
"body": "GitHub's camo returned 'Error Fetching Resource' fetching the dynamic\nimg.shields.io/npm/v/runward badge — shields' live npm-registry lookup was\ndown (the static shields badges rendered fine). Swap to a static npm badge\n(same for-the-badge style + npm logo) that never does a live lookup, so it\nrenders reliably. The version lives on the npm page, Releases and package.json.",
"is_bot": false,
"headline": "fix(readme): static npm badge (shields' live npm/v endpoint was failing)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T12:51:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "823e468c94d7ce7b84ae985e1f4da0db911eb225",
"body": "fix(readme): broken images (absolute banner URL + npm badge refresh)",
"is_bot": false,
"headline": "Merge pull request #27 from stranxik/fix/readme-broken-images",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-19T12:43:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9032348d794df029225a08090c259ce4aa5d948",
"body": "…images)\n\n- Banner used a relative path (assets/og-image-en.jpg) that npmjs.com can't\n resolve (it isn't in the published tarball), so the header image was broken\n on the npm package page. Point it at the raw GitHub URL — renders everywhere.\n- npm shields badge showed a broken-image icon on GitHub (camo cached a failed\n shields fetch). Drop the redundant &label=npm (the npm/v badge already labels\n itself 'npm'), which also changes the URL so GitHub re-fetches it.",
"is_bot": false,
"headline": "fix(readme): absolute banner URL + refresh the npm badge URL (broken …",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T12:42:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec43c7088ce411b39632ab18e838a9f260accfd7",
"body": "docs(readme): plainer HN-facing entry + version-less OG banner",
"is_bot": false,
"headline": "Merge pull request #26 from stranxik/docs/readme-entry-and-og",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-19T12:33:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa42216dc9fc59491403f98d6d8cfe85392884d3",
"body": "Since a Show HN links to the repo, the README is the landing. Rewrite the top\n(tagline + intro) in plain, direct language matching the launch post: lead with\n'AI writes the code — who verifies the engineering decisions behind it?', drop\nthe insider tagline ('the floor / run-grade engineering') and the dense\nthree-doors paragraph from the entry (that depth still lives in the sections\nbelow). Also swap in the evergreen, version-less OG banner.",
"is_bot": false,
"headline": "docs(readme): plainer HN-facing entry + version-less OG banner",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-19T12:32:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bfa702c73388f439a8d9610c874729c9667be398",
"body": "chore(deps): ignore TypeScript major bumps in Dependabot",
"is_bot": false,
"headline": "Merge pull request #23 from stranxik/chore/dependabot-ignore-ts-major",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-18T19:45:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f69dd26541c49750b78fcd2a9333ff5a121bf67",
"body": "Adopting the TS 7 native-compiler preview on a published package is a\ndeliberate, hand-made call, not an automated bump — so Dependabot now\nignores typescript's major-version updates (minor/patch still flow). The\ntsconfig is already TS-7-ready (PR #22, types:[node]); this just stops the\nnoise until TS 7 is GA-stable. Documented in the dependabot.yml comment and\na CHANGELOG Unreleased entry.",
"is_bot": false,
"headline": "chore(deps): ignore TypeScript major bumps in Dependabot",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-18T19:44:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2b7f83f5f3efaa04dfc57108ffb0d99050386e54",
"body": "chore(build): declare types:[node] in tsconfig (TypeScript 7 forward-compat)",
"is_bot": false,
"headline": "Merge pull request #22 from stranxik/chore/tsconfig-explicit-node-types",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-18T19:41:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96822356398eff923f45c6d4a6c634b38638a825",
"body": "…compat)\n\nThe tsconfig relied on TypeScript's implicit auto-inclusion of every\n@types/* package. TypeScript 7's native compiler drops that behaviour, so\nthe build failed with 102 errors (TS2591 'Cannot find name node:fs/…',\nplus cascading TS7006 implicit-any once @types/node no longer resolved).\nDec\n[…]\nexplicitly fixes it and is fully backward-compatible\n(TS 5.9.3 still builds with zero errors). Better hygiene regardless; makes\nthe eventual TypeScript 7 bump a clean pass. typescript stays at ^5.9.3.",
"is_bot": false,
"headline": "chore(build): declare types:[node] in tsconfig (TypeScript 7 forward-…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-18T19:40:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "19d87513ddbeedba2797ae1fbc834b5fce54e70c",
"body": "chore(security): move SBOM generation out of the OIDC-privileged publish job",
"is_bot": false,
"headline": "Merge pull request #21 from stranxik/chore/release-sbom-least-privilege",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-18T11:13:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "90e8dc48170e75b7fca6a6993891f35e707383e4",
"body": "…ish job\n\nAudit finding #1 (low): the third-party anchore/sbom-action ran inside the\nsingle publish job that holds id-token:write + contents:write. Split it into\na separate 'sbom' job with contents:read only; the privileged 'publish' job\nnow downloads that SBOM artifact and attests it. Workflow-leve\n[…]\n-closed: if SBOM\ngeneration or download fails, publish does not run.\n\nPins actions/download-artifact@d3f86a1 (v4). Needs validation on the next\nreal release (the OIDC publish path cannot run on a PR).",
"is_bot": false,
"headline": "chore(security): move SBOM generation out of the OIDC-privileged publ…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-18T11:12:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9a9608f450b065a8f09c8fc9060a872728a5c74e",
"body": "chore(security): hardening from the security audit (CI, engines, ReDoS screen)",
"is_bot": false,
"headline": "Merge pull request #20 from stranxik/chore/security-hardening-audit",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-18T11:09:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1747efc1f694d7a8892b8b37107cd18c967c26ed",
"body": "…S screen)\n\n- CI: set persist-credentials:false on every checkout in ci.yml and\n watch-external-facts.yml, matching release.yml/scorecard.yml (OSSF\n Scorecard consistency; no token left in the working tree).\n- engines: raise the Node floor to >=22.12.0 (was >=20). Node 20 is EOL\n since 2026-04 an\n[…]\nscreen missed. Deterministic, zero-dep, in the spirit\n of ADR-0020; a hostile rule signature can no longer hang check --strict.\n Adds tests; existing safe signatures stay accepted (self-gate green).",
"is_bot": false,
"headline": "chore(security): hardening from the security audit (CI, engines, ReDo…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-18T11:03:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "231f18c2e14480eb356c7fde5c229e7e4c4466a9",
"body": "docs(readme): use language-neutral /docs links",
"is_bot": false,
"headline": "Merge pull request #19 from stranxik/docs/readme-neutral-docs-links",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-18T10:27:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3aa8ce8ee3f6a64b99c6f91b1ccb3593f7d5b560",
"body": "The docs site now auto-routes /docs to the visitor's language (French\nbrowser -> French, otherwise English), so the README no longer needs to\npin /docs/en. Neutral links serve each reader their own language.",
"is_bot": false,
"headline": "docs(readme): use language-neutral /docs links",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-18T10:27:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8d2ef0750f0f9bd870ab3b94e266064f219893f",
"body": "docs(readme): point doc-site links to the English docs (/docs/en)",
"is_bot": false,
"headline": "Merge pull request #18 from stranxik/docs/readme-en-links",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-18T09:57:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96d6d646b55407ebab866f2862244063b9934886",
"body": "The repo is English-only; the hosted /docs root is the French default and\n/docs/en is the English tree. Point the Docs badge and the Documentation\nsection links at /docs/en so they match the repo language. Visible label\nleft as runward.dev/docs.",
"is_bot": false,
"headline": "docs(readme): point doc-site links to the English docs (/docs/en)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-18T09:57:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34f6b520b4a5f493655ccf8417c8d47103bf79f1",
"body": "docs(readme): surface the hosted documentation site",
"is_bot": false,
"headline": "Merge pull request #17 from stranxik/docs/readme-site-links",
"author_name": "Thibault",
"author_login": "stranxik",
"committed_at": "2026-07-18T09:44:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "efec03eae34a791cce3e1258c5fe36b3f128dc57",
"body": "The README only linked to in-repo markdown. Add a Docs badge and a\nDocumentation section pointing to runward.dev/docs with the key entry\npoints (quickstart, the deterministic gate, six phases, from-an-agent,\ncompliance evidence). In-repo doc links are kept as-is.",
"is_bot": false,
"headline": "docs(readme): surface the hosted documentation site",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-18T09:40:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2bdc619645b302729e9a979698eef7a7c6011c1",
"body": "A multi-agent documentation audit flagged small repo-to-world drifts:\n- src/lib/tools.ts: JSDoc said 'four phase skills' but PHASE_SKILLS has\n five (architect, topology, floor, govern, handover).\n- runward/architecture.md: stamped v0.18.1 and cited 24 / 28 ADRs while\n the journal holds 32; bumped to v0.19.0 (2026-07-17), counts -> 32.\n- runward/contracts/port-contract.md: the check signature omitted the\n --json flag the CLI ships.\n\nSelf-gate strict green, 77/77 tests.",
"is_bot": false,
"headline": "docs: correct stale factual drifts surfaced by the docs audit",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T19:51:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ea3b8b37f087f3ddadf842712edafd45277e700",
"body": "The watch (issue #16) flagged runward two OSCAL generations behind NIST.\nA close-look investigation proved the bump trivial and risk-free:\n\n- our exact output validates against the NIST 1.2.2 component-definition\n schema (runward's own ajv harness), version literal aside;\n- compliance-trestle 4.2.0\n[…]\nthe\n self-hosting mission deliverables). CHANGELOG left historical.\n- ADR-0032 rewritten + renamed; watch OSCAL message reworded.\n- 77/77 tests green; trestle ingests the fresh 1.2.2 pack end-to-end.",
"is_bot": false,
"headline": "feat(oscal): track current OSCAL — bump 1.1.2 -> 1.2.2 (ADR-0032)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T18:18:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0fdbc43b7133acfa2ef72f98b0c41d22e52a58b6",
"body": "runward had silently fallen two OSCAL generations behind NIST (pinned\n1.1.2; NIST is at 1.2.2) with no test reddening — internal drift guards\ncompare repo-to-doc, never repo-to-world.\n\n- ADR-0032: staying on OSCAL 1.1.2 is a deliberate, recorded choice\n (1.2.x is additive/backward-compatible; a bum\n[…]\n; others annual). It never\n enters the OSCAL, so the golden is unchanged.\n- regulated-posture drift guard asserts the watch exists and tracks both\n OSCAL and reviewBy, so silent deletion reddens CI.",
"is_bot": false,
"headline": "feat(governance): watch dated external facts out-of-band (ADR-0032)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T18:00:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fc60a2ad72a4a042f54e8cb6aa9d9daa0edf0d73",
"body": "The note describing the guard quoted the forbidden term \"audit-grade\"\nliterally, in a line the negation scanner does not count as negated.\nReword to \"a forbidden overclaim\" so the guard stops biting itself.",
"is_bot": false,
"headline": "fix(ci): positioning drift guard tripped on its own meta-note",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T17:53:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1999a78c8671078c1c8bf4e0837fd55948ad1f91",
"body": "…ompliance-trestle)\n\nCloses the gap flagged as the most visible in regulated review: the OSCAL pack was validated\nonly against our vendored NIST JSON schema. Now every CI run also loads it in a real, independent\nOSCAL tool.\n\n- ci.yml job 'oscal-ingest': emit a pack from the reference mission, then i\n[…]\nRC SaaS ingestion stays the operator's step.\n- Drift guard extended: the oscal-ingest job + script are now enforced, so this proof can't be\n silently dropped. Self-gate strict green; drift guard 6/6.",
"is_bot": false,
"headline": "feat(regulated): prove OSCAL ingestion by a third-party tool in CI (c…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T17:45:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "53b8c6f5178efa94640f8639744b2234892db926",
"body": "…of truth cannot lie\n\nSame principle as the regulated-adoption guard: pin the verifiable claims of the marketing\nsource of truth so they cannot silently drift or overclaim.\n\ntest/unit/positioning-drift.test.js enforces:\n- the MANDATORY compliance guardrails are present and intact (audit-ready, NOT a\n[…]\nry cited ADR-NNNN exists.\nProven to bite: a stale date or a diluted guardrail fails it. Runs in npm test → in the self-gate.\nSubjective wording stays free. Self-gate strict green; 81 unit checks pass.",
"is_bot": false,
"headline": "feat(positioning): drift guard over positioning.md — the copy source …",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T17:37:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "db130e7410b5d0a8d3520bb98bd622ee55e4b1c7",
"body": "…n sheet\n\nTwo things, both the runward principle turned on runward's own governance — the agent\nproduces, a deterministic gate guarantees, the operator decides.\n\n- SBOM on every push/PR (ci.yml, Syft SHA-pinned), not only at release: surfaces a\n dependency drift between releases as an artifact.\n- t\n[…]\n stale. Proven to bite:\n un-pinning an action fails the guard. Runs in npm test, so it's in the self-gate.\n- The sheet now states it is enforced by this guard. Self-gate strict green; npm test green.",
"is_bot": false,
"headline": "feat(regulated): SBOM in CI + a drift guard that enforces the adoptio…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T17:31:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bc2ed95920e42a3bcf07811b751baaa9cc521a43",
"body": "…ne, factual corrections\n\nThree-agent adversarial audit of the regulated wedge; all confirmed findings fixed.\n\nSecurity (release workflow):\n- Publish the packed tarball itself (npm publish $TARBALL) so the SBOM attestation binds\n to the exact artifact downloaded (attested == published) — the integr\n[…]\nis no secret scanner — the true claim is\n no long-lived Actions secrets at all (OIDC trusted publishing).\n- SECURITY.md now links the regulated-adoption sheet. Self-gate strict green; npm test green.",
"is_bot": false,
"headline": "fix(regulated): audit follow-ups — SBOM integrity, supply-chain hygie…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T17:23:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "37bce033360fa15c5e66e357e89c8c89e5c21600",
"body": "…icence framing (ADR-0031)\n\nA four-agent investigation confirmed runward is usable in regulated environments as a\nwedge (sovereign engineering evidence that feeds a compliance programme), not a validator,\nand that its local/no-data-flow nature makes most vendor due-diligence moot. This closes\nthe *r\n[…]\n, and the honest limits\n (no runtime logs for art.12, point-in-time, single-maintainer/no-SLA, forkability).\n- Linked from the compliance index and the README. Self-gate strict green; npm test green.",
"is_bot": false,
"headline": "feat(regulated): narrow the wedge — SBOM, regulated-adoption sheet, l…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T17:11:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "228f1f18b1e01a285fbcd8adc385e1009de34a42",
"body": null,
"is_bot": false,
"headline": "docs(changelog): date v0.19.0 to its release day (2026-07-17)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-17T12:45:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4941980f5359b2f75452c359637a4d129da30129",
"body": "Version bump across package.json, CITATION.cff, and the six distribution manifests\n(packaging.test guard green), plus the CHANGELOG entry and the distribution.md pin\nexamples. ADR-0030 ships: neutral init default, runward wire (read-only harness\ndetection), check --json, hardened non-interactivity.",
"is_bot": false,
"headline": "chore(release): bump to 0.19.0 — agent-operable baseline + runward wire",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T14:39:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab4472b3892c930064dc86c5b58bdea25c39a343",
"body": "…e null-channel path, ADR + doc coherence\n\n- check --json --hooks no longer corrupts the JSON contract: a hook's stdout is\n routed to stderr (fd 2) under --json, since log() cannot suppress a subprocess\n (audit finding, machine-contract blocker).\n- wire: when a config-detected harness ships no cha\n[…]\ndsurf → recommendedChannel null, bare-mission → undetermined, and check --json\n --strict exposes conformance / --json alone omits it. Unit 65, smoke green.\n- README: add the runward wire command row.",
"is_bot": false,
"headline": "fix(check,wire): audit follow-ups — no JSON pollution from hooks, wir…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T14:16:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f71b0fb3d97b17c077feee968c56153bd8170140",
"body": "…ead-only (ADR-0030)\n\n- runward wire: detects the AI harness running the command via verified runtime\n signals (CLAUDECODE for Claude Code + Cowork, GEMINI_CLI, CURSOR_AGENT), falling\n back to config-file markers (weaker), then 'undetermined'. Recommends the matching\n auto-trigger channel and poi\n[…]\n(runtime signal > config file > undetermined).\n- Tests: 6 unit cases (signal precedence, Cursor marker, undetermined, config override,\n wires:false invariant) + a smoke contract check on wire --json.",
"is_bot": false,
"headline": "feat(wire): best-effort harness detection → channel recommendation, r…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T14:09:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "88ac7018eacd5cbfdce3f9a443656abd8c95e442",
"body": "…on, hardened non-interactivity (ADR-0030)\n\n- init with no explicit --tools now writes only the vendor-neutral baseline\n (AGENTS.md + .agents/skills); --yes no longer defaults to the claude profile\n and the wizard pre-checks nothing. Closes a standing vendor-neutrality breach.\n- check --json: a st\n[…]\ne operating model: neutral baseline, best-effort harness\n detection (never a prerequisite, never self-wiring), machine-readable surface.\n- Tests: neutral-default and check --json assertions in smoke.",
"is_bot": false,
"headline": "feat(cli): agent-operable baseline — neutral init default, check --js…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T13:58:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "06d9ed68da09f86ca36f9831a2acd4e21813bdcb",
"body": "…-telemetry (verified)",
"is_bot": false,
"headline": "docs(positioning): quote RFC-0024 verbatim on GenAI-not-deterministic…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T12:55:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "191d80c3498fc316872710652cda86b4374d6030",
"body": "…oundary)\n\nDistribution-comms pass, from a 3-agent investigation.\n- README: the distribution story was told 3× (lines 56/63/88, with a double\n enumeration of the same siblings). Consolidated into one tier-structured\n block in Install (hard-CI / hard-turn-end / soft-per-tool / discovery-only),\n di\n[…]\nunded (MCP tools are model-controlled; the registry needs a\n runnable package). packaging/mcp/README and distribution.md cite it.\nNo badge added (a Claude-specific one would break vendor-neutrality).",
"is_bot": false,
"headline": "docs(dist): consolidate the README install story, add ADR-0029 (MCP b…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T12:52:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "324a08b5e1a6140e6ba835090a58f2124ef27e7e",
"body": "- Copilot: drop-in install path documented (.github/hooks/ or ~/.copilot/hooks/), no submission.\n- Cursor: consumable via the hooks.json drop-in (advisory stop, soft per-tool).\n- Kiro: published from a thin dedicated repo (stranxik/runward-kiro) because Kiro requires\n POWER.md at the repo root, wit\n[…]\n: not published, by design — the registry needs a real MCP server package, and an MCP\n tool is model-controlled (discovery, never a gate). The descriptor documents that stance;\n no MCP server ships.",
"is_bot": false,
"headline": "docs(dist): finalize the last four channels (Copilot, Cursor, Kiro, MCP)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T12:07:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3027840709fabe5d542fa5aa5d21bee1e245f934",
"body": "Codex: document the git-backed --sparse install (packaging/codex reads\ndirectly, no copy) and note the marketplace.json now matches the documented\nschema; the curated Codex directory is partners-only, the --sparse add is open.\nGemini: gemini extensions install requires the manifest at the repo root,\n[…]\n\nthe extension is published from a thin dedicated repo (stranxik/runward-gemini);\npackaging/gemini/ is the mirrored source, with gemini extensions link for local\ndev. distribution.md updated for both.",
"is_bot": false,
"headline": "docs(dist): Codex --sparse install + Gemini dedicated-repo pointer",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T11:56:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f889102d30e0bd1efcb80af08e12bea374425810",
"body": "…in) to the Install section",
"is_bot": false,
"headline": "docs(readme): add wire-the-gate install (CI Action + Claude Code plug…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T11:13:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "46ff53108e3c417dfc14df10a4496e3c7c9a3870",
"body": null,
"is_bot": false,
"headline": "docs(readme): add GitHub Marketplace badge for the runward gate Action",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T11:09:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f07b59c7189e64cfdb78fa9827ac85d9aff39033",
"body": null,
"is_bot": false,
"headline": "docs(dist): align the CI pin example to 0.18.1",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T10:29:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af3fd86c1bfbfad91987e6ee7032d83a0ce48bb9",
"body": "…elog, bumps, stamps",
"is_bot": false,
"headline": "chore(release): v0.18.1 — security + pre-marketplace hardening; chang…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T10:29:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bcb2c331e94b2c52685d5343e375eb16d61783dd",
"body": "A 5-agent adversarial audit (security, compliance, code coherence, packagings,\narchitecture) before public marketplace submission. Two real security holes,\nplus polish. Fixed:\n\n- SECURITY — seal traversal (evidence.ts verifyEvidenceLock): the seal writer\n confined paths (v0.17) but the verifier did\n[…]\nount harmonized to 28 (was 24/26 in four places).\n- Guards: unit tests for the seal-traversal rejection, the ReDoS screen, and a\n packaging version/hook check that would have caught the 0.17.0 drift.",
"is_bot": false,
"headline": "fix(security+dist): close the pre-marketplace audit findings",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T10:26:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3d6aaf3ef88736ed6067d861a4f1dd74c34d6267",
"body": null,
"is_bot": false,
"headline": "docs: refresh README OG banner to v0.18.0",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T08:25:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cca5f0e6a5680a7542692bd1d4830044715bfc44",
"body": "… stamps",
"is_bot": false,
"headline": "chore(release): v0.18.0 — distributable packagings; changelog, bumps,…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T08:22:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9231a86969a45db778fedfd0b4344cf091e39830",
"body": "…nization, link the honest map)\n\nMerged the packaging/ family (Gemini, Codex, Copilot, Cursor, Kiro, MCP)\nbuilt per ADR-0028, and reconciled it with the core done in parallel:\n- every hook command is npx --yes runward check --strict (robust after a\n bare plugin install, matching plugins/runward-gat\n[…]\n\nsoft per-tool (Cursor/Kiro), discovery-only for MCP (model-controlled,\nnever a gate). Format-uncertainty flags kept in each channel's README\n(Codex/Cursor/Copilot manifests to confirm at submission).",
"is_bot": false,
"headline": "feat(dist): reconcile per-harness packagings with the core (npx harmo…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T08:20:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be3479cfdd8c16e7a15a62e7715832b31b26252b",
"body": null,
"is_bot": false,
"headline": "Merge branch 'worktree-agent-aa229ab9b6d1d6a1d'",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T08:19:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8e51b3f8f854023783963abbd0a2a47675d35a7",
"body": "…Kiro, MCP descriptor (ADR-0028)",
"is_bot": false,
"headline": "feat(dist): per-harness packagings — Gemini, Codex, Copilot, Cursor, …",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T08:18:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17b85217b4fd94d8b4dbf429bee9e68c10851409",
"body": null,
"is_bot": false,
"headline": "docs(dist): the honest channel map (docs/distribution.md) + README link",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T08:12:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32ce06d350fcf7b359186067bee5295d8e67cfaf",
"body": "…gin+marketplace)",
"is_bot": false,
"headline": "wip(dist): ADR-0028 + core packagings (GitHub Action, Claude Code plu…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T08:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dd0d8fee80461dcceffc7567e6df55a67d0185db",
"body": "…ver is gated; OSCAL as a citable spec\n\nThe distribution/message pass: lead the differentiators with the unique\ncombination a code-level benchmark confirmed nobody else pairs (rule-level\ngate with sealed evidence, gated hand-over, published OSCAL mapping); fix\nthe stale '58 craft rules' (now 64); reframe hand-over as a gated\ndeliverable, not a folder; present the OSCAL mapping as the reference,\ncitable mini-spec; add the FedRAMP RFC-0024 / Delve backing for the\nzero-LLM stance.",
"is_bot": false,
"headline": "docs(readme): frame the four grounds; fix rule count (58->64); hand-o…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T06:47:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8794f0f69aa2387198f5bf71d3bf2d20b8384858",
"body": null,
"is_bot": false,
"headline": "docs: refresh README OG banner to v0.17.0",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:53:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d12483ca8d17f0077fd88b7ad7feeb0b734c2076",
"body": "…t date\n\nCHANGELOG for the second-audit hardening (traversal, ReDoS, OSCAL/spec\nreconciliation, seal scope, RUNWARD_NOW, doc regressions), the EU AI Act\ndate correction, and the BMAD review-layer adapter; version 0.17.0; mission\nstamps and CITATION.cff bumped.",
"is_bot": false,
"headline": "chore(release): v0.17.0 — audit remediation + BMAD adapter + EU AI Ac…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:50:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d6593e79d3086ab85173883e6db4810c3a7a18fd",
"body": "…AD calls (ADR-0027)\n\nA fresh code-level competitive benchmark found a distribution seam: BMAD's\nbmad-code-review exposes a review-layers extension point whose instruction\nmay 'run anything (e.g. an external reviewer via bash)'. templates/adapters/\nbmad-review-layer.toml adds runward's deterministic\n[…]\nileged over the\nother orchestrators (ADR-0027). EXPECTED_ADAPTERS 5 -> 6; README documents\nthe seam; smoke covers the path. Also fixed the compliance unit test that\nhad frozen the pre-Omnibus EU date.",
"is_bot": false,
"headline": "feat(adapters): BMAD review-layer adapter — the gate as a reviewer BM…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:49:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d36f4b040622fb4915916c1ed1674dc21f408309",
"body": "…igital Omnibus)\n\nThe Digital Omnibus on AI (Council final green light 29 June 2026) postponed\nthe Annex III/IV high-risk obligations from 2 August 2026 to 2 December 2027\n— our regime data and docs still carried the stale deadline, which the OSCAL\nreadiness draft printed. Corrected in place (a fact\n[…]\nedRAMP RFC-0024 forbidding GenAI-produced evidence\n(a federal validation of the zero-LLM gate) and the Delve affair (AI-prefilled\nSOC 2 audits) — both arguing that AI-produced evidence is not trusted.",
"is_bot": false,
"headline": "fix(compliance): EU AI Act high-risk date 2026-08-02 -> 2027-12-02 (D…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:46:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "669a06d0a1f28e56eb996638e27d5e1a02f9bfd0",
"body": "…r adapter count, README Kiro/topology)\n\n- first-mission.md: the wizard poses five prompts, not four (the 'What are\n you building?' seed was undocumented); refreshed the stale output counts\n (84 -> 119 files, 11 -> 13 deliverables) and the current gate message.\n- doctor + EXPECTED_ADAPTERS: count \n[…]\nng the README; now 5 real adapters).\n- README: execution-topology.md added to the mission tree (a gated\n deliverable was missing), Kiro added to the tool-profiles list and the\n adapter-seam comment.",
"is_bot": false,
"headline": "docs/fix: doc regressions from the audit (first-mission counts, docto…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:45:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8577b2a2dd73a066d499f3a0bebcdd6d8867b324",
"body": "…SCAL/spec drift, seal scope\n\nA second adversarial audit (our own method on ourselves) broke four things\nshipped in v0.15/v0.16. Closed, still deterministic, zero-LLM:\n\n- Path traversal (CASSE): file:/etc/hosts and file:../../etc/hosts passed\n the gate green, contradicting ADR-0019's 'resolves unde\n[…]\ntity across filesystems.\n\nGolden regenerated (href now regime-derived). Unit + smoke cover traversal,\nReDoS, order-independent OSCAL aggregation, the regime-derived link, and the\nRUNWARD_NOW fallback.",
"is_bot": false,
"headline": "fix(gate): close the audit's four gate fissures — traversal, ReDoS, O…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:42:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c3075231b999376c086272aa3c9d82be155826c9",
"body": null,
"is_bot": false,
"headline": "docs: refresh README OG banner to v0.16.0",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:05:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "634783c96dbb8a36fbb28c714c4e36d6e3e9587d",
"body": null,
"is_bot": false,
"headline": "chore(release): v0.16.0 — changelog, version bump, mission stamps",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:01:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7eff24e904a909b87eb155dd33c56db149d4a640",
"body": "The audit's whitespace finding, executed with ADR-0017's own move: the\npromise 'the hand-over is proven by a real task redone without you' was\nDefinition-of-Done prose no gate verified — the differentiator was the\nleast backed claim in the chain. Now:\n\n- runward/handover.md joins the mission layout \n[…]\nt on both missions.\n- The handover workflow's Outputs/DoD name the gated note; the golden\n OSCAL is regenerated (the new rules extend ASI08/09/10 coverage);\n smoke covers the fifth phase end to end.",
"is_bot": false,
"headline": "feat(gate): hand-over becomes a gated conformance phase (ADR-0026)",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T02:00:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9a6745cef5d8194f83fa64206afb980e0477c6b1",
"body": "…ec (ADR-0025)\n\ndocs/spec/runward-oscal-mapping.md v1.0 — implementation-independent: the\ndecision -> ADR -> manifest -> OSCAL chain, the component-definition shape,\nthe implementation-status derivation rules (with the paper-coverage\nasymmetry stated), the deterministic UUID seed grammar, the regime\n[…]\nations. The golden fixture\nis promoted to normative example (the conformance suite wins over the\nprose). CITATION.cff at the root makes citing mechanical; README and the\ncompliance docs link the spec.",
"is_bot": false,
"headline": "docs(spec): publish the OSCAL mapping as a versioned, citable mini-sp…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T01:53:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0afd80c6c2ceb1207a24323f9abf12e8d996f38c",
"body": "… gate sample (ADR-0018 amended)\n\n--tools kiro mirrors the phase skills as .kiro/steering/runward-<phase>.md\n(inclusion: auto + name + description — Kiro's relevance idiom, same\nsemantics as the SKILL.md trigger); AGENTS.md is read natively by Kiro so\nthe charter needs no extra file. templates/adapt\n[…]\nne port as the Claude Code hook. EXPECTED_ADAPTERS 5 -> 6;\nadapters README documents both seams; smoke covers profile emission,\nrelevance frontmatter, subordination to the gate, and the adapter count.",
"is_bot": false,
"headline": "feat(adapters): Kiro — steering mirror of the phase skills, Stop-hook…",
"author_name": "Thibault Souris",
"author_login": "stranxik",
"committed_at": "2026-07-16T01:50:47Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 26,
"commits_last_year": 240,
"latest_release_at": "2026-07-21T15:17:35Z",
"latest_release_tag": "v0.22.0",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 4,
"days_since_latest_release": 8,
"mean_days_between_releases": 0.6
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 100,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "runward",
"exists": true,
"license": "MIT",
"keywords": [
"agentic",
"ai-agents",
"spec-driven",
"delivery",
"governance",
"llm",
"architecture"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/runward",
"is_deprecated": false,
"latest_version": "0.22.0",
"repository_url": "https://github.com/stranxik/runward",
"versions_count": 27,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 3163,
"first_published_at": "2026-07-06T12:51:50.241000Z",
"latest_published_at": "2026-07-21T15:18:25.901000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 8
}
]
},
"popularity": {
"forks": 0,
"stars": 1,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 8
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": true,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"examples/request-triage/code/tsconfig.json",
"floor-ts/tsconfig.json",
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 41069,
"source_files_sampled": 90,
"oversized_source_files": 0,
"agent_instruction_files": [
"examples/request-triage/AGENTS.md",
"floor-ts/AGENTS.md",
"templates/targets/AGENTS.md"
],
"agent_instruction_max_bytes": 133430
},
"dependencies": {
"manifests": [
"floor-ts/package.json",
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 27,
"malicious_count": 0,
"assessed_package": "npm:runward@0.22.0",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "zod",
"manifest": "floor-ts/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.3"
},
{
"name": "@inquirer/prompts",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^8.5.2"
},
{
"name": "chalk",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^5.6.0"
},
{
"name": "commander",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^15.0.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 8,
"merged_prs": 33,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 1,
"closed_unmerged_prs": 6
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "stranxik",
"commits": 200,
"avatar_url": "https://avatars.githubusercontent.com/u/26541747?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"release.yml",
"scorecard.yml",
"watch-external-facts.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "8 out of 8 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/13 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 9,
"reason": "dependency not pinned by hash detected -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "9c30a25dd438f14658afbdd5b47b1ec40c06ad63",
"ran_at": "2026-07-30T03:35:05Z",
"aggregate_score": 5.9,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-29T09:54:31Z",
"oldest_open_prs": [
{
"number": 24,
"created_at": "2026-07-18T19:46:16Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 40,
"created_at": "2026-07-22T03:24:24Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 41,
"created_at": "2026-07-22T03:24:27Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 43,
"created_at": "2026-07-29T03:23:49Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 44,
"created_at": "2026-07-29T03:23:59Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 45,
"created_at": "2026-07-29T03:24:05Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 46,
"created_at": "2026-07-29T03:24:11Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 47,
"created_at": "2026-07-29T03:24:15Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-29T09:53:59Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/stranxik/runward",
"host": "github.com",
"name": "runward",
"owner": "stranxik"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 63,
"inputs": {
"security": 67,
"vitality": 70,
"community": 47,
"governance": 54,
"engineering": 77
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 70,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"commits_last_year": 240,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "240 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 240
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 26,
"latest_release_tag": "v0.22.0",
"releases_from_tags": false,
"days_since_latest_release": 8,
"mean_days_between_releases": 0.6
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "26 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 26
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 8 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.6 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.6
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 47,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 1,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 1
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 58,
"inputs": {
"packages": [
"runward"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 3163
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "3,163 downloads/month across npm",
"points": 46.7,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 3163,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 54,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"merged_prs": 33,
"open_issues": 0,
"closed_issues": 1,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 6
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "33/39 decided PRs merged",
"points": 32.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 33,
"decided": 39
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/13 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 46,
"inputs": {
"followers": 6,
"owner_type": "User",
"is_verified": null,
"owner_login": "stranxik",
"public_repos": 15,
"account_age_days": 3418
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "6 followers of stranxik",
"points": 6.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 6,
"login": "stranxik"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "15 public repos, account ~9 yr old",
"points": 20.8,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 15
}
},
{
"code": "account_age_years",
"params": {
"years": 9
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"runward"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 8
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 8 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 8
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "27 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 27
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 77,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "4 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 4
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "8 out of 8 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": "https://runward.dev",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://runward.dev",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 67,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 5.9
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "8 out of 8 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/13 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 9",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:runward@0.22.0 runtime dependency closure — what installing the published package pulls in — 27 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:runward@0.22.0",
"assessed": 27
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 27,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 27,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 72,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.95,
"agent_instruction_files": [
"examples/request-triage/AGENTS.md",
"floor-ts/AGENTS.md",
"templates/targets/AGENTS.md"
],
"agent_instruction_max_bytes": 133430
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "examples/request-triage/AGENTS.md, floor-ts/AGENTS.md, templates/targets/AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples/request-triage/AGENTS.md, floor-ts/AGENTS.md, templates/targets/AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "95 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 95,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"examples/request-triage/code/tsconfig.json",
"floor-ts/tsconfig.json",
"tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "examples/request-triage/code/tsconfig.json, floor-ts/tsconfig.json, tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples/request-triage/code/tsconfig.json, floor-ts/tsconfig.json, tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "dependency automation configured, none observed in the sampled commits",
"points": 5,
"status": "partial",
"details": [
{
"code": "dependency_bot_config_only",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 9",
"points": 9,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 41069,
"source_files_sampled": 90,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/90 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 90,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "moderate",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-30T03:35:19.084065Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/stranxik/runward.svg",
"full_name": "stranxik/runward",
"license_state": "standard",
"license_spdx": "MIT"
}