98%Org DCO sign-off (90d avg)
84%Conventional commits (90d avg)
145
Commits last 90d
32
Releases last 90d
Repo hygiene
| Signal | Coverage | Notes |
|---|---|---|
Branch protection on main | 18 / 18 | Required reviews + status checks. False on a private alpha is acceptable; it should flip before GA. |
CODEOWNERS present | 18 / 18 | Path-scoped reviewer routing; pairs with branch protection's required-reviewers rule. |
SECURITY.md present | 18 / 18 | NIST SSDF RV.1.3 + CRA Annex I Part II §5. |
NOTICE shipped | 18 / 18 | Apache-2.0 §4 attribution. |
| Median time tag → PyPI publish | 309 s | Provenance latency. Tight numbers (<60s) suggest direct CI-driven publish via Trusted Publisher. |
Per-package signals
| Package | DCO 90d | CC 90d | Verified 90d | Commits | Releases | Branch prot. | Time→PyPI |
|---|---|---|---|---|---|---|---|
| kaos-agents | 100% | 83% | 100% | 6 | 1 | 172 s | |
| kaos-citations | 100% | 89% | 100% | 9 | 5 | 126 s | |
| kaos-content | 89% | 78% | 100% | 9 | 2 | 309 s | |
| kaos-core | 100% | 100% | 100% | 4 | 0 | — | |
| kaos-graph | 100% | 80% | 100% | 10 | 2 | 766 s | |
| kaos-llm-client | 100% | 83% | 100% | 6 | 1 | 432 s | |
| kaos-llm-core | 100% | 83% | 100% | 6 | 1 | 175 s | |
| kaos-mcp | 100% | 100% | 100% | 6 | 2 | 621 s | |
| kaos-ml-core | 100% | 78% | 100% | 9 | 2 | 242 s | |
| kaos-names | 100% | 100% | 100% | 5 | 0 | — | |
| kaos-nlp-core | 100% | 82% | 100% | 11 | 4 | 602 s | |
| kaos-nlp-transformers | 100% | 64% | 100% | 11 | 2 | 812 s | |
| kaos-office | 100% | 83% | 100% | 6 | 1 | 555 s | |
| kaos-pdf | 67% | 87% | 100% | 15 | 3 | 223 s | |
| kaos-source | 100% | 75% | 100% | 4 | 1 | 496 s | |
| kaos-tabular | 100% | 80% | 100% | 5 | 1 | 169 s | |
| kaos-ui | 100% | 100% | 100% | 8 | 0 | — | |
| kaos-web | 100% | 73% | 100% | 15 | 4 | 168 s |
What we deliberately do not show
- No composite governance score. Buyers see through scores; they incentivize gaming cheap signals. We surface every signal raw.
- No maintainer identity (country, employer, real name). Encourages discrimination and false-positives on pseudonymous-but-trusted maintainers.
- No GitHub stars / fork counts.
event-stream,colors.js, andua-parser-jswere all high-star at the moment of compromise. - Verified commit ratio is never a binary green pill. Without branch-protection-required-signatures, a signed-commit ratio is decorative.