@tangle-network/agent-eval
Trace-first evaluation framework for Tangle agents. Core (spans, pipelines, sandbox harness, OTLP export), trust (dataset, red-team, calibration, behavior DSL), builder-of-builders (three-layer eval, resumable sessions, meta-runtime correlation), and fron
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/belief-state/index.d.ts | AI (source-diff): File is a bundler-generated TypeScript declaration with long import lines; not obfuscated code. | ai | |
| provenance | publisher-changed | AI (provenance): Package publishes via GitHub Actions CI/CD with SLSA attestation; this is the expected publisher for automated releases. | ai | |
| provenance | missing-githead | AI (provenance): Build environment change (removed prepare script) explains missing gitHead; no malicious indicators present. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): All four new deps are established ecosystem packages; addition aligns with OpenAPI/HTTP feature visible in package.json scripts. | ai | |
| provenance | no-provenance | AI (provenance): Package consistently lacks Sigstore provenance; no other risk signals present. | ai | |
| source-diff | obfuscated-file:dist/traces.d.ts | AI (source-diff): Bundler-generated TypeScript declaration file with long re-export lines; not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:dist/rl.d.ts | AI (source-diff): Bundler-generated TypeScript declaration file with long re-export lines; not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:dist/index-ekBXweiQ.d.ts | AI (source-diff): Bundler-generated TypeScript declaration file with long re-export lines; not obfuscated malicious code. | ai |
Versions (showing 51 of 213)
| Version | Deps | Published |
|---|---|---|
| 0.128.2 | 8 / 10 | |
| 0.128.1 | 8 / 10 | |
| 0.128.0 | 8 / 10 | |
| 0.127.0 | 8 / 10 | |
| 0.126.7 | 8 / 9 | |
| 0.126.6 | 8 / 9 | |
| 0.126.5 | 8 / 9 | |
| 0.126.4 | 8 / 8 | |
| 0.126.3 | 8 / 8 | |
| 0.126.2 | 8 / 8 | |
| 0.126.1 | 8 / 8 | |
| 0.126.0 | 8 / 8 | |
| 0.125.0 | 8 / 8 | |
| 0.124.0 | 8 / 8 | |
| 0.123.8 | 8 / 8 | |
| 0.123.7 | 8 / 8 | |
| 0.123.6 | 8 / 8 | |
| 0.123.5 | 8 / 8 | |
| 0.123.4 | 8 / 8 | |
| 0.123.3 | 8 / 8 | |
| 0.123.2 | 8 / 8 | |
| 0.123.1 | 8 / 8 | |
| 0.123.0 | 8 / 8 | |
| 0.122.9 | 8 / 8 | |
| 0.122.8 | 8 / 8 | |
| 0.122.7 | 8 / 8 | |
| 0.122.6 | 8 / 8 | |
| 0.122.5 | 8 / 8 | |
| 0.122.4 | 8 / 8 | |
| 0.122.3 | 8 / 8 | |
| 0.122.2 | 8 / 8 | |
| 0.122.1 | 8 / 8 | |
| 0.122.0 | 8 / 8 | |
| 0.121.0 | 8 / 8 | |
| 0.120.4 | 8 / 8 | |
| 0.120.1 | 8 / 8 | |
| 0.120.0 | 8 / 8 | |
| 0.119.1 | 8 / 8 | |
| 0.119.0 | 8 / 8 | |
| 0.118.3 | 8 / 8 | |
| 0.118.2 | 8 / 8 | |
| 0.118.1 | 8 / 8 | |
| 0.118.0 | 8 / 8 | |
| 0.117.1 | 7 / 8 | |
| 0.117.0 | 7 / 8 | |
| 0.116.0 | 7 / 8 | |
| 0.115.3 | 7 / 8 | |
| 0.115.2 | 7 / 8 | |
| 0.115.1 | 7 / 8 | |
| 0.115.0 | 7 / 8 | |
| 0.114.0 | 7 / 8 |
v0.128.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.128.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.128.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.127.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.125.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.124.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.121.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.120.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.120.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.120.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.119.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.119.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.117.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.117.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.116.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.115.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.115.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.115.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.115.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.114.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.