93%Org DCO sign-off (90d avg)
82%Conventional commits (90d avg)
969
Commits last 90d
256
Releases last 90d
Repo hygiene
| Signal | Coverage | Notes |
|---|---|---|
Branch protection on main | 13 / 18 | Required reviews + status checks. False on a private alpha is acceptable; it should flip before GA. |
CODEOWNERS present | 18 / 18 | Path-scoped reviewer routing; pairs with branch protection's required-reviewers rule. |
SECURITY.md present | 18 / 18 | NIST SSDF RV.1.3 + CRA Annex I Part II §5. |
NOTICE shipped | 18 / 18 | Apache-2.0 §4 attribution. |
| Median time tag → PyPI publish | 336 s | Provenance latency. Tight numbers (<60s) suggest direct CI-driven publish via Trusted Publisher. |
Per-package signals
| Package | DCO 90d | CC 90d | Verified 90d | Commits | Releases | Branch prot. | Time→PyPI |
|---|---|---|---|---|---|---|---|
| kaos-agents | 86% | 81% | 78% | 131 | 47 | 161 s | |
| kaos-citations | 92% | 83% | 94% | 36 | 6 | 340 s | |
| kaos-content | 92% | 87% | 70% | 67 | 16 | 200 s | |
| kaos-core | 93% | 76% | 90% | 42 | 14 | 551 s | |
| kaos-graph | 97% | 85% | 91% | 33 | 7 | 798 s | |
| kaos-llm-client | 90% | 79% | 81% | 42 | 12 | 168 s | |
| kaos-llm-core | 88% | 84% | 64% | 88 | 27 | 194 s | |
| kaos-mcp | 94% | 74% | 94% | 35 | 7 | 551 s | |
| kaos-ml-core | 94% | 77% | 90% | 31 | 7 | 284 s | |
| kaos-names | 96% | 88% | 84% | 25 | 3 | 190 s | |
| kaos-nlp-core | 98% | 89% | 82% | 54 | 17 | 868 s | |
| kaos-nlp-transformers | 98% | 86% | 79% | 42 | 11 | 705 s | |
| kaos-office | 88% | 81% | 76% | 58 | 14 | 336 s | |
| kaos-pdf | 88% | 79% | 94% | 48 | 14 | 373 s | |
| kaos-source | 95% | 86% | 95% | 42 | 13 | 508 s | |
| kaos-tabular | 92% | 83% | 94% | 36 | 8 | 291 s | |
| kaos-ui | 92% | 87% | 48% | 108 | 15 | 55 s | |
| kaos-web | 94% | 76% | 74% | 51 | 18 | 218 s |
What we deliberately do not show
- No composite governance score. Buyers see through scores; they incentivize gaming cheap signals. We surface every signal raw.
- No maintainer identity (country, employer, real name). Encourages discrimination and false-positives on pseudonymous-but-trusted maintainers.
- No GitHub stars / fork counts.
event-stream,colors.js, andua-parser-jswere all high-star at the moment of compromise. - Verified commit ratio is never a binary green pill. Without branch-protection-required-signatures, a signed-commit ratio is decorative.