AxonOS Radar 13.1.0

Added

• Commit provenance is now measured, not assumed. Every automated commit
  here is written through the GitHub Contents API; GitHub signs those when the
  caller is an App identity (a workflow's GITHUB_TOKEN) and leaves them
  unsigned when it is a user PAT. Both write identical files, so the
  difference lived only in the history: of the last 1,281 commits on main,
  716 of the 720 made by github-actions[bot] are signed, while the
  PAT-written data commits since 2026-07-17 are not.
  scripts/check_provenance.py reports the signed share per author and names
  the newest unsigned commit; the health workflow runs it on schedule into its
  job summary. Report-only by design — a rate-limited API is not a repository
  defect. Documented end to end, with three independent ways to verify it, in
  docs/PROVENANCE.md.
• The engine's publish path can now run as a fallback (PUBLISH_MODE,
  switchable from a repository variable): it publishes only once the data here
  has aged past a threshold, i.e. only when this repository's own signed sync
  path has actually stopped. Normal operation becomes fully signed while the
  dual-path guarantee that the map cannot freeze is preserved — and a rare
  unsigned commit becomes a visible alarm rather than the norm. An unknown
  remote age publishes rather than risk a freeze. Seven tests.
• OpenSSF Scorecard — an independent, automated supply-chain audit runs
  weekly and on branch-protection changes, publishing to the public OpenSSF
  dataset and to this repository's Security tab. The project asks others to
  accept a score computed about them; submitting to the same is the consistent
  position.

AxonOS Radar 13.0.1

Fixed

• CI's security gate went red on 13.0.0's own code. The per-file XML
  well-formedness check added to the sync path used xml.dom.minidom, which
  bandit flags (B408/B318) as unsafe against XML entity attacks. The finding
  was correct and the release battery missed it: the local bandit invocation
  swallowed its exit code and printed a success line unconditionally. Both
  are fixed — the check now refuses any document carrying a DOCTYPE or ENTITY
  declaration before a parser sees it and caps the input size, so the
  billion-laughs, quadratic-blowup and XXE vectors cannot reach the parser at
  all; the two remaining suppressions are scoped, documented, and earned by
  that guard rather than asserted. Six tests drive it, including a real
  entity bomb and an external-entity declaration. sync.yml's contract gate
  now calls the same tested function instead of parsing inline.
• The report.html version gate pinned the full patch version, which would
  have failed every showcase-only patch release: the report is rendered by
  the engine, whose patch level moves independently. It now checks the
  feature release (major.minor), still catching a report left behind by an
  older feature release.
• Two README defects introduced in 12.0.0/13.0.0: the Badges and
  Trajectory sections had been inserted inside the dashboard section,
  orphaning its panel table from its heading, and a second Badges section
  with the same title sat further down carrying two stale "🛠 v12" rows for
  work that has shipped. Restructured into one section; the report's refresh
  cadence corrected from "weekly" to every scan.

Added

• README: Who it's for — eight roles, the question each is stuck on, the
  mechanism that answers it, and where to start; What makes it different,
  including an explicit What it is not; and What people build on it.
• Dependabot now watches requirements-ci.txt (pip), grouped weekly like the
  actions — the pins that gate this repository were previously unwatched.

AxonOS Radar 13.0.0

Two roadmap features land together — 11.0's history had been accruing since
mid-July and is now deep enough to draw honestly — plus the remaining findings
from the July architecture/security audit.

Added

• Trajectory (roadmap 11.0) — a measured sparkline on every card: the
  star arc since 2026-06-26 and the BRS delta once the engine's series
  (accruing since 2026-07-16) has two points. data/trajectory.json merges
  both sources into one schema'd endpoint — nothing backfilled, nothing
  interpolated, at most 96 points per project. Cohorts (arrivals by ISO week,
  from the discovery log) join the Stats page.
• Talent (roadmap 13.0) — data/talent.json: per-owner aggregates
  (projects, stars, best BRS, median health, modality/category/language
  spread) and field-level modality clusters, rendered as a builders board on
  Stats. Builder-level by design; the payload states its own scope.
• A contract gate on the sync path — the pull path now refuses wholesale
  (nothing committed, red run) any engine payload that fails validate_payload
  or the published JSON Schema; a post-sync workflow step re-checks whatever
  is in the tree, covering the push path too. Six new tests drive the gate
  with corrupt payloads.
• ENGINE_READ_TOKEN (optional secret) — restores the pull path when the
  engine repository is private: fine-grained, engine-repo-only, Contents:
  Read. The sync log now distinguishes "engine unreadable" from "transient
  upstream error".

Fixed

• report.html — the front door from the AxonOS org profile — carried two
  links to the engine's nonexistent Pages site and a stale version. The
  root cause was upstream: the engine's report template derived its links
  from GITHUB_REPOSITORY, which inside the engine's own Actions names a
  private repository. The template now pins the public site; the committed
  report is re-rendered clean; CI fails the build if engine links or a stale
  version ever reach it again.
• CSV formula injection in data/projects.csv — string cells beginning with
  = + @ - or control characters are prefixed with ' (numeric
  columns, including real negative deltas, untouched).
• docs/METHODOLOGY.md claimed "the radar excludes its own repository" —
  it does not, and should not: the radar appears on its own map, scored by
  the same engine, evidence ledger public. The text now says exactly that.
• Avatars in the ecosystem strip were blocked by the page's own CSP
  (img-src lacked avatars.githubusercontent.com); allowed on all three
  pages. A frame-buster now guards every interactive page — GitHub Pages
  cannot send frame-ancestors, and the <meta> variant is ignored by spec
  (documented in the threat model).
• Committed data/badge-ecosystem.json had been frozen at the 62-project
  era; refreshed, and added to the sync set so it stays current.
• weekly.json gains an independent CI plausibility gate, and the schema
  caps projects at 2,000 — the engine's own hard cap.
• CI dependency pins: bandit==1.8.6, jsdom@26.

AxonOS Radar 12.0.6

The most consequential findings from a full architecture/security/CI pass —
one is a correction to a fix from two releases ago that turned out not to
work in production, and one is a validation gap in the product's actual
primary output.

Fixed

• v12.0.4's report.html correction never actually ran. It was correct
  code, gated behind the same "is the engine's data newer" check as
  everything else in the sync loop — but the push path routinely commits
  data/radar.json and the uncorrected report.html in the same scan, so
  by the time this script runs, that gate is already true and main()
  returns before the FILES loop is ever reached. sync_report_html() is
  now a separate function that runs first, unconditionally, every
  invocation — independent of whether the rest of the data is "new." Worst
  case it's briefly wrong for the ~20-minute offset between the engine's
  scan and this script's schedule, not indefinitely.
• brs, relevance_tier, and relevance_ledger — the current, primary
  scoring system, the entire point of this project — had zero validation
  anywhere in the pipeline. Not in the JSON Schema, not in
  validate_payload.py. Only the legacy v3 evidence_tier fields were
  checked. A malformed score (out of range, wrong type, malformed tier
  string, broken ledger entry) could have shipped to the live map
  undetected. Now validated: brs must be a number 0–100; relevance_tier
  must match L[0-4]_UPPER_SNAKE; relevance_ledger entries must carry
  points (number), kind, and reason. Adversarially tested against
  seven corruption cases (out-of-range, negative, wrong type, bool-as-int,
  malformed tier, out-of-range tier number, missing ledger fields) before
  shipping — each one confirmed caught, and the real 120-project payload
  confirmed to still validate clean.
• docs/DATA_MODEL.md described the v2/v3 schema only — the primary v5
  fields above weren't documented at all, only the legacy ones. Rewritten
  against the actual schema and live data, legacy fields kept and clearly
  marked as superseded-but-still-valid.
• docs/INCIDENT_RESPONSE.md's containment step pointed at disabling a
  workflow ("AxonOS Radar") that's been disabled since the 8.0.0 cutover —
  scanning happens in the private engine now; this repo's own containment
  lever is sync.yml.

Added

• tests/test_validate_payload.py — 22 tests. This script had none before,
  despite being described as "the executable half of the public data
  contract" and despite every other script under scripts/ having
  dedicated coverage.

AxonOS Radar 12.0.5

Two more live instances of the same recurring class, found while mapping out
false positives for a new CI check meant to end the pattern — not a seventh
manual audit pass finding a seventh manual fix.

Fixed

• index.html's "↻ Publish fresh data to the issue" button — a real,
  clickable button on the main page — linked to workflows/radar.yml,
  retired at the 8.0.0 cutover. Points at stats-issue.yml, the workflow
  that actually publishes it, now.
• docs/SBOM.md had drifted to describing v7.0.0 (five releases, ten days)
  despite its own header promising regeneration every release: stale version
  labels, an import list four modules wrong in each direction, an
  actions/upload-artifact pin for an action this repo's workflows don't
  even use anymore, and the same dead radar.yml references as everywhere
  else. Corrected by hand against the real current tree.

Added

• A CI check — Docs don't reference things the 8.0.0 cutover deleted —
  that greps every tracked .md/.html file for scripts/radar.py, an
  active (non-.disabled) workflows/radar.yml reference, or the engine's
  nonexistent Pages URL, and fails the build if any turn up outside
  CHANGELOG.md's legitimate historical mentions. This exact pattern has now
  recurred six separate times across four audit passes — SECURITY.md,
  THREAT_MODEL.md, CONTRIBUTING.md, docs/RETENTION.md, report.html (twice),
  index.html, docs/SBOM.md — each caught by re-reading files by hand. This
  makes a seventh instance a build failure instead of something that needs
  another audit to notice. Adversarially tested against all three patterns
  plus the legitimate .disabled exemption before shipping.

AxonOS Radar 12.0.4

Fixed

• report.html's "Live map" / "Dashboard" / "GitHub" links pointed at
  axonos-radar-core (the private engine, no public Pages site) instead of
  this repo — the same bug patched once before and silently overwritten by
  the next engine sync, because the fix lived in the wrong place. The
  correction now lives in sync_engine_data.py itself, applied to the
  fetched body on every sync before it's ever committed — it survives every
  future sync instead of being undone by it, and becomes a no-op
  automatically once the engine's own template is corrected upstream.
• CONTRIBUTING.md told a new contributor to run
  GH_TOKEN=… python3 scripts/radar.py to refresh data locally — that file
  was deleted at the 8.0.0 open-core cutover, so this was a guaranteed
  FileNotFoundError on the first thing the guide asked anyone to try.
  Replaced with what's actually runnable now (preview, tests, validator)
  and an honest note that discovery/scoring has no local equivalent anymore.
• docs/RETENTION.md attributed retention constants to scripts/radar.py
  (deleted) and radar.yml (disabled) in three separate table rows — all
  three now correctly say the private engine.
• ROADMAP.md's "Where we are" line still said v10.0 while the table two
  lines below it already correctly showed v12.0 shipped — updated the
  summary to match the table it was supposed to summarize.

AxonOS Radar 12.0.3

Fixed

• The pipeline-health alert linked to actions/workflows/radar.yml, which
  hasn't existed since the 8.0.0 open-core cutover (only radar.yml.disabled
  remains) — a broken link inside the exact message meant to help diagnose a
  broken pipeline. Now points at sync.yml, the workflow that's actually
  live in this repo, with a note to check axonos-radar-core's own Actions
  if the engine itself is the silent one.
• CI's schema check for data/signals.json looked for that file in the
  checkout and always found nothing — build_signals.py is explicit that
  it's "deploy-time and pure ... commits nothing," so the file never exists
  there. The check always printed "skip" and never actually validated
  anything. CI now builds signals.json the same way the real deploy does
  and validates that output, matching the coverage trajectory.json (which
  is committed) already had for real.

AxonOS Radar 12.0.2

Fixed

• In-page tab links (the "Where to start" cards' #axonos/#builders/etc.
  anchors) only worked on a fresh page load. location.hash was read once,
  at load time, with no hashchange listener — so clicking one of these
  links after the page was already open changed the URL but never called
  switchView(), and the target tab silently stayed hidden. The read is now
  wrapped in applyHash() and re-run on every hashchange, so the same
  links work whether they're the first thing you click or the tenth.

AxonOS Radar 12.0.1

Four fixes, none of them architectural — the pattern common to all four is
that the code had already moved on and the prose describing it hadn't.

Fixed

• SECURITY.md's Scope and Hardening sections still named scripts/radar.py,
  removed at the 8.0.0 open-core cutover; both now name the files that
  actually do the work today (sync_engine_data.py, validate_payload.py).
• docs/THREAT_MODEL.md's Accepted Risks still described assets/app.js as
  rendering card content via innerHTML from escaped strings. That was true
  once; the codebase has carried zero innerHTML calls (all textContent)
  for several releases. The stale entry is removed rather than corrected in
  place, since the risk it described no longer exists.
• CI's schema validation step checked data/radar.json against
  data/radar.schema.json and stopped there — data/signals.schema.json
  and data/trajectory.schema.json are shipped and advertised in the API
  index, but nothing ever validated live data against either. Both are now
  actually enforced, not just pointed to.
• validate_payload.py's invariant gate was hardcoded to payload versions
  (3, 4). The live payload has been on version 5 for some time, which means
  every v3/v4 invariant — required evidence_tier/inclusion_reason, and
  all four counts.* reconciliation checks — has been silently skipped on
  every run, with no warning and a green check mark throughout. Verified
  directly against live production data before extending the known-version
  set: 120/120 projects still carry both legacy fields, and all four counts
  reconcile, so version 5 is added to the known set rather than exempted from
  checking. Any future unrecognized version now fails the build loudly
  instead of silently skipping the invariants it doesn't know how to check.

AxonOS Radar 12.0.0

Added

• A live scored badge for every project — badges/<owner>/<repo>.json,
  a shields.io endpoint carrying the project's BRS and relevance tier, derived
  from the engine's last scan. Never hand-granted; refreshes with the map
  (cacheSeconds: 10800). badges/index.json catalogs every badge with
  ready-to-paste Markdown; Copy badge on each evidence ledger does the same
  in one tap. Guide: docs/BADGES.md.
• Trajectory groundwork — the engine now persists per-project time series
  (data/trajectory.json: BRS, stars, health per scan; 96-point window,
  45-day retention), schema'd and pre-cataloged in the API front door. History
  accrues from 2026-07-16; nothing is backfilled.
• The README's Ecosystem Intelligence dashboard re-rendered from the current
  dataset.

Fixed

• Scheduled site deploys were inert (the deploy job's event guard predated the
  schedule trigger); the safety clock now deploys.
• The publish-token preflight gained a write probe (an unreferenced git blob),
  catching read-only fine-grained tokens before the publish step reports 403s.