100%Org DCO sign-off (90d avg)
95%Conventional commits (90d avg)
176
Commits last 90d
18
Releases last 90d
Repo hygiene
| Signal | Coverage | Notes |
|---|---|---|
Branch protection on main | 13 / 18 | Required reviews + status checks. False on a private alpha is acceptable; it should flip before GA. |
CODEOWNERS present | 18 / 18 | Path-scoped reviewer routing; pairs with branch protection's required-reviewers rule. |
SECURITY.md present | 18 / 18 | NIST SSDF RV.1.3 + CRA Annex I Part II §5. |
NOTICE shipped | 18 / 18 | Apache-2.0 §4 attribution. |
| Median time tag → PyPI publish | 261 s | Provenance latency. Tight numbers (<60s) suggest direct CI-driven publish via Trusted Publisher. |
Per-package signals
| Package | DCO 90d | CC 90d | Verified 90d | Commits | Releases | Branch prot. | Time→PyPI |
|---|---|---|---|---|---|---|---|
| kaos-agents | 100% | 85% | 100% | 13 | 2 | 261 s | |
| kaos-citations | 100% | 100% | 100% | 8 | 0 | — | |
| kaos-content | 100% | 86% | 100% | 7 | 1 | 126 s | |
| kaos-core | 100% | 100% | 100% | 8 | 0 | — | |
| kaos-graph | 100% | 100% | 100% | 9 | 0 | — | |
| kaos-llm-client | 100% | 100% | 100% | 7 | 0 | — | |
| kaos-llm-core | 100% | 91% | 100% | 11 | 1 | 330 s | |
| kaos-mcp | 100% | 100% | 100% | 10 | 2 | 621 s | |
| kaos-ml-core | 100% | 100% | 100% | 7 | 0 | — | |
| kaos-names | 100% | 100% | 100% | 7 | 0 | — | |
| kaos-nlp-core | 100% | 95% | 100% | 21 | 6 | 806 s | |
| kaos-nlp-transformers | 100% | 100% | 100% | 7 | 0 | — | |
| kaos-office | 100% | 91% | 100% | 11 | 1 | 176 s | |
| kaos-pdf | 100% | 81% | 100% | 16 | 3 | 223 s | |
| kaos-source | 100% | 100% | 100% | 7 | 0 | — | |
| kaos-tabular | 100% | 100% | 100% | 7 | 0 | — | |
| kaos-ui | 100% | 100% | 100% | 7 | 0 | — | |
| kaos-web | 100% | 85% | 100% | 13 | 2 | 168 s |
What we deliberately do not show
- No composite governance score. Buyers see through scores; they incentivize gaming cheap signals. We surface every signal raw.
- No maintainer identity (country, employer, real name). Encourages discrimination and false-positives on pseudonymous-but-trusted maintainers.
- No GitHub stars / fork counts.
event-stream,colors.js, andua-parser-jswere all high-star at the moment of compromise. - Verified commit ratio is never a binary green pill. Without branch-protection-required-signatures, a signed-commit ratio is decorative.