@tangle-network/agent-eval
Trace-first evaluation framework for Tangle agents. Core (spans, pipelines, sandbox harness, OTLP export), trust (dataset, red-team, calibration, behavior DSL), builder-of-builders (three-layer eval, resumable sessions, meta-runtime correlation), and fron
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/belief-state/index.d.ts | AI (source-diff): File is a bundler-generated TypeScript declaration with long import lines; not obfuscated code. | ai | |
| provenance | publisher-changed | AI (provenance): Package publishes via GitHub Actions CI/CD with SLSA attestation; this is the expected publisher for automated releases. | ai | |
| provenance | missing-githead | AI (provenance): Build environment change (removed prepare script) explains missing gitHead; no malicious indicators present. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): All four new deps are established ecosystem packages; addition aligns with OpenAPI/HTTP feature visible in package.json scripts. | ai | |
| provenance | no-provenance | AI (provenance): Package consistently lacks Sigstore provenance; no other risk signals present. | ai | |
| source-diff | obfuscated-file:dist/traces.d.ts | AI (source-diff): Bundler-generated TypeScript declaration file with long re-export lines; not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:dist/rl.d.ts | AI (source-diff): Bundler-generated TypeScript declaration file with long re-export lines; not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:dist/index-ekBXweiQ.d.ts | AI (source-diff): Bundler-generated TypeScript declaration file with long re-export lines; not obfuscated malicious code. | ai |
Versions (showing 100 of 213)
| Version | Deps | Published |
|---|---|---|
| 0.128.2 | 8 / 10 | |
| 0.128.1 | 8 / 10 | |
| 0.128.0 | 8 / 10 | |
| 0.127.0 | 8 / 10 | |
| 0.126.7 | 8 / 9 | |
| 0.126.6 | 8 / 9 | |
| 0.126.5 | 8 / 9 | |
| 0.126.4 | 8 / 8 | |
| 0.126.3 | 8 / 8 | |
| 0.126.2 | 8 / 8 | |
| 0.126.1 | 8 / 8 | |
| 0.126.0 | 8 / 8 | |
| 0.125.0 | 8 / 8 | |
| 0.124.0 | 8 / 8 | |
| 0.123.8 | 8 / 8 | |
| 0.123.7 | 8 / 8 | |
| 0.123.6 | 8 / 8 | |
| 0.123.5 | 8 / 8 | |
| 0.123.4 | 8 / 8 | |
| 0.123.3 | 8 / 8 | |
| 0.123.2 | 8 / 8 | |
| 0.123.1 | 8 / 8 | |
| 0.123.0 | 8 / 8 | |
| 0.122.9 | 8 / 8 | |
| 0.122.8 | 8 / 8 | |
| 0.122.7 | 8 / 8 | |
| 0.122.6 | 8 / 8 | |
| 0.122.5 | 8 / 8 | |
| 0.122.4 | 8 / 8 | |
| 0.122.3 | 8 / 8 | |
| 0.122.2 | 8 / 8 | |
| 0.122.1 | 8 / 8 | |
| 0.122.0 | 8 / 8 | |
| 0.121.0 | 8 / 8 | |
| 0.120.4 | 8 / 8 | |
| 0.120.1 | 8 / 8 | |
| 0.120.0 | 8 / 8 | |
| 0.119.1 | 8 / 8 | |
| 0.119.0 | 8 / 8 | |
| 0.118.3 | 8 / 8 | |
| 0.118.2 | 8 / 8 | |
| 0.118.1 | 8 / 8 | |
| 0.118.0 | 8 / 8 | |
| 0.117.1 | 7 / 8 | |
| 0.117.0 | 7 / 8 | |
| 0.116.0 | 7 / 8 | |
| 0.115.3 | 7 / 8 | |
| 0.115.2 | 7 / 8 | |
| 0.115.1 | 7 / 8 | |
| 0.115.0 | 7 / 8 | |
| 0.114.0 | 7 / 8 | |
| 0.113.0 | 7 / 8 | |
| 0.112.0 | 7 / 8 | |
| 0.111.0 | 7 / 8 | |
| 0.110.1 | 7 / 8 | |
| 0.110.0 | 7 / 8 | |
| 0.109.1 | 7 / 8 | |
| 0.108.1 | 7 / 8 | |
| 0.108.0 | 7 / 8 | |
| 0.107.0 | 7 / 8 | |
| 0.106.3 | 7 / 8 | |
| 0.106.2 | 7 / 8 | |
| 0.106.1 | 7 / 8 | |
| 0.106.0 | 7 / 8 | |
| 0.105.0 | 7 / 8 | |
| 0.104.0 | 7 / 8 | |
| 0.103.2 | 7 / 8 | |
| 0.103.1 | 7 / 8 | |
| 0.103.0 | 7 / 8 | |
| 0.102.1 | 7 / 8 | |
| 0.102.0 | 7 / 8 | |
| 0.101.2 | 7 / 8 | |
| 0.101.1 | 7 / 8 | |
| 0.101.0 | 7 / 8 | |
| 0.100.2 | 7 / 8 | |
| 0.100.1 | 7 / 8 | |
| 0.100.0 | 7 / 8 | |
| 0.99.0 | 7 / 8 | |
| 0.98.0 | 7 / 8 | |
| 0.97.0 | 7 / 8 | |
| 0.96.5 | 7 / 8 | |
| 0.96.4 | 7 / 8 | |
| 0.96.3 | 7 / 8 | |
| 0.96.2 | 7 / 8 | |
| 0.96.1 | 7 / 8 | |
| 0.96.0 | 7 / 8 | |
| 0.95.1 | 7 / 8 | |
| 0.95.0 | 7 / 8 | |
| 0.94.0 | 6 / 9 | |
| 0.93.0 | 6 / 9 | |
| 0.92.0 | 6 / 9 | |
| 0.91.0 | 6 / 9 | |
| 0.90.1 | 6 / 9 | |
| 0.90.0 | 6 / 9 | |
| 0.89.0 | 6 / 9 | |
| 0.86.0 | 6 / 9 | |
| 0.85.0 | 6 / 9 | |
| 0.84.0 | 6 / 9 | |
| 0.83.0 | 6 / 9 | |
| 0.82.0 | 6 / 9 |
v0.128.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.128.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.128.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.127.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.126.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.125.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.124.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.123.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.122.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.121.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.120.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.120.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.120.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.119.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.119.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.117.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.117.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.116.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.115.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.115.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.115.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.115.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.114.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.113.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.112.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.111.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.110.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.110.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.109.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.108.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.108.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.107.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.106.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.106.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.106.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.106.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.105.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.104.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.102.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.102.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.100.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.100.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.