kaos-core v0.1.5

License: Apache-2.0 Runtime: Python 3.13+ Released: 2026-09-23 Repository

Changes since last sweep

No signal changes detected since 2026-11-06.

Trust scorecard

Composite: 8/9 green
Build passing
Latest CI conclusion: success
Tests: PR + compat + min-deps
PR lanes: success; compat: success; min-deps: success
Security scans + dependency advisories
security-light: success; security-full: failure; 1 open advisories (OSV.dev): 1 critical
Updates merged promptly
3 open PR(s), 3 from Dependabot; oldest 12 day(s) old
Signed release artifacts
PEP 740 attestation verified for 2/2 artifacts
License clean
Wheel license: Apache-2.0
SBOM published
SBOM published — 44 components
Branch protection
GitHub reports main as protected; admin-only rule details were not available to the sweep token
SECURITY.md + CODEOWNERS
SECURITY.md + CODEOWNERS present

CI matrix

Environment pytestruff tybandit pip-audit
linux-x64 / py3.14
linux-x64 / py3.14t
linux-x64 / py3.15
macos-arm64 / py3.13
windows-x64 / py3.13

Security

Open advisories
1 across 44 locked dependencies (OSV.dev)
Maintenance notices
0
Fixed in 90d
not tracked
Open Dependabot PRs
3
Suppressions (total)
not inspected (sibling clone absent)
AdvisoryPackageSeveritySummary
GHSA-6q48-6c7w-9gw2 certifi 2026.4.22 critical certifi bundles emSign root CAs with compromised intermediate CA keys

Suppressions are markers that silence a linter, type-checker, or security scanner. See security.html for the full ledger across the org.

Supply chain

Direct deps
—
Transitive deps
—
SBOM
CycloneDX (mirror) · CycloneDX (GitHub Release)

Governance + velocity

Maintainers
2
Commits 90d
4
Releases 90d
—

Code surface area

Python source (LoC)
7,941 across 94 files
Python tests (LoC)
6,633 across 51 files
Rust source (LoC)
—
Rust tests (LoC)
—
Source lines of code
14,574 LoC

Counts non-blank, non-comment lines (sloc). Excludes .venv, target, dist, build, __pycache__, _site, and lockfiles (uv.lock, Cargo.lock). Tests are paths whose ancestors contain tests, test, or benches. Authorship: this codebase is AI-assisted — lines were generated with Claude (Anthropic) and human-reviewed before commit. We count what's in git; we do not claim humans typed every character.

Evidence

Download JSON

Methodology

How these eight checks are scored Each check is collected by an automated workflow against public sources only (GitHub API, OSV, Sigstore transparency log, package registry metadata). No self-attestation is accepted. A check is green when the underlying signal is present and meets a documented threshold, yellow when partial, red when failing, and gray when the collector has not yet implemented the probe. See methodology.html for thresholds and source URLs.