kaos-graph v0.1.6

License: Apache-2.0 Runtime: Python 3.13+ Released: 2026-09-23 Repository

Changes since last sweep

No signal changes detected since 2026-11-06.

Trust scorecard

Composite: 7/9 green
Build passing
Latest CI conclusion: success
Tests: PR + compat + min-deps
PR lanes: success; compat: success; min-deps: success
Security scans + dependency advisories
security-light: success; security-full: failure; 3 open advisories (OSV.dev): 1 critical, 2 moderate
Updates merged promptly
3 open PR(s), 3 from Dependabot; oldest 19 day(s) old
Signed release artifacts
PEP 740 attestation verified for 6/6 artifacts
License clean
Wheel license: Apache-2.0
SBOM published
SBOM published — 114 components
Branch protection
GitHub reports main as protected; admin-only rule details were not available to the sweep token
SECURITY.md + CODEOWNERS
SECURITY.md + CODEOWNERS present

CI matrix

Environment pytestruff tybandit pip-audit
linux-x64 / py3.14
linux-x64 / py3.14t
linux-x64 / py3.15
macos-arm64 / py3.13
windows-x64 / py3.13

Security

Open advisories
3 across 114 locked dependencies (OSV.dev)
Maintenance notices
0
Fixed in 90d
not tracked
Open Dependabot PRs
3
Suppressions (total)
not inspected (sibling clone absent)
AdvisoryPackageSeveritySummary
GHSA-6q48-6c7w-9gw2 certifi 2026.5.20 critical certifi bundles emSign root CAs with compromised intermediate CA keys
GHSA-42vr-xj54-vc7v pyjwt 2.14.0 moderate PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
GHSA-x33g-cr3x-6449 pyjwt 2.14.0 moderate PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Suppressions are markers that silence a linter, type-checker, or security scanner. See security.html for the full ledger across the org.

Supply chain

Direct deps
—
Transitive deps
—
SBOM
CycloneDX (mirror) · CycloneDX (GitHub Release)

Governance + velocity

Maintainers
2
Commits 90d
10
Releases 90d
2

Code surface area

Python source (LoC)
3,656 across 32 files
Python tests (LoC)
4,563 across 21 files
Rust source (LoC)
8,792 across 25 files
Rust tests (LoC)
—
Source lines of code
17,011 LoC

Counts non-blank, non-comment lines (sloc). Excludes .venv, target, dist, build, __pycache__, _site, and lockfiles (uv.lock, Cargo.lock). Tests are paths whose ancestors contain tests, test, or benches. Authorship: this codebase is AI-assisted — lines were generated with Claude (Anthropic) and human-reviewed before commit. We count what's in git; we do not claim humans typed every character.

Evidence

Download JSON

Methodology

How these eight checks are scored Each check is collected by an automated workflow against public sources only (GitHub API, OSV, Sigstore transparency log, package registry metadata). No self-attestation is accepted. A check is green when the underlying signal is present and meets a documented threshold, yellow when partial, red when failing, and gray when the collector has not yet implemented the probe. See methodology.html for thresholds and source URLs.