track: 2026-06-13 — 35 tracked, 38 case-study ready, 2 rule-adopted

auditor/disagreements.jsonl

@@ -157,3 +157,6 @@
 {"event":"pr_comments_snapshot","timestamp":"2026-06-08T17:14:38Z","pr":"avifenesh/agentsys#338","pr_state":"closed_unmerged","comments_hash":"sha256:ca61d3657ffabd5114857f496a15cad23ecd47997214ed5e3ee92958969fef64","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDOQ6RbDc8AAAABAJJ99g","author":{"login":"avifenesh"},"authorAssociation":"COLLABORATOR","body":"Closing as superseded by #333, which covers both web-auth and web-browse hardcoded-path fixes in a single PR. The fix in this PR is a strict subset of #333.\n\nSame NLPM finding surfaced in re-audit issue #341; will close #341 once #333 and #339 merge.\n\nThanks for the audit!","createdAt":"2026-04-23T13:02:26Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/agent-sh/agentsys/pull/338#issuecomment-4304567798","viewerDidAuthor":false}]}
 {"event":"pr_comments_snapshot","timestamp":"2026-06-08T17:19:18Z","pr":"upstash/context7#2508","pr_state":"closed_unmerged","comments_hash":"sha256:00b60532e46461308556d93d374dee595020c5c90bbf84e564c720dea8dc7c08","fingerprints":["sha256:de76bede1ce4edcdb14d261df159c1b414d78757f705174626648a9f9ed345d0","sha256:c2f552d3c220e979d92596e9e0fe52fdeb0436bdcae135c57b8aaccefa15fe33"],"rule_ids":["BUG-missing-frontmatter","BUG-undeclared-tool"],"comments":[{"id":"IC_kwDOOPWeNc8AAAABFTR_ow","author":{"login":"enesgules"},"authorAssociation":"COLLABORATOR","body":"not valid","createdAt":"2026-06-08T15:44:39Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/upstash/context7/pull/2508#issuecomment-4650729379","viewerDidAuthor":false}]}
 {"event":"pr_comments_snapshot","timestamp":"2026-06-09T01:02:16Z","pr":"pbakaus/impeccable#92","pr_state":"closed_unmerged","comments_hash":"sha256:2073076d80144759a84189b1b2f0c48bd779f3e71327ebe391b533aeb2919e59","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDOQWgufc8AAAABArIq_A","author":{"login":"pbakaus"},"authorAssociation":"OWNER","body":"Thanks again, this one would also be a clean improvement. Quick note before we can land it:\n\nThe branch needs a rebase against `main`, and the conflict resolution drops one of the three changes. After the v3.0 build refactor:\n\n1. `scripts/build.js`: the `validateAntipatternRules` function this PR modified was removed entirely. `generateCounts` now scans `src/detect-antipatterns.mjs` with a different regex that only counts `id: '...'` lines, no `new Function`. So please drop the `scripts/build.js` change (no import needed).\n2. `scripts/build-extension.js`: still has `new Function()` at line 62. PR fix applies cleanly.\n3. `scripts/lib/sub-pages-data.js`: still has `new Function()` at line 152. PR fix applies with minor context drift.\n\nIf you can rebase to keep just (2) and (3), happy to merge.\n\nOne framing note: I'd retitle from `security:` to something like `refactor:` or `chore:`. Build-time code from your own repo's source files isn't really an attack surface (anyone with commit access can already run anything at build), so the value here is code quality (less brittle, removes the `no-new-func` lint suppression), not security. Tiny thing, just helps the changelog read accurately later.","createdAt":"2026-04-29T01:14:35Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/pbakaus/impeccable/pull/92#issuecomment-4340198140","viewerDidAuthor":false},{"id":"IC_kwDOQWgufc8AAAABFV87cw","author":{"login":"pbakaus"},"authorAssociation":"OWNER","body":"Thanks again for this PR. The project has changed quite a bit since it was opened, and the useful part of this cleanup has now landed through the detector registry refactor.\r\n\r\n`main` already imports `ANTIPATTERNS` directly from `cli/engine/registry/antipatterns.mjs` in the build, extension, and sub-page data paths, and there is no remaining `new Function()` extraction in those scripts. This PR now conflicts and targets the old `src/detect-antipatterns.mjs` path, so rebasing it would produce no meaningful remaining diff.\r\n\r\nClosing this as already addressed.","createdAt":"2026-06-08T21:03:55Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/pbakaus/impeccable/pull/92#issuecomment-4653529971","viewerDidAuthor":false}]}
+{"event":"pr_comments_snapshot","timestamp":"2026-06-13T20:40:53Z","pr":"wuji-labs/nopua#13","pr_state":"closed_unmerged","comments_hash":"sha256:82cb6c12c8eefee4baf553b0a4e1ad5953f289b77667670abae83e1e1395a2e3","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORml_Fc8AAAABGBglZA","author":{"login":"wuji-labs"},"authorAssociation":"OWNER","body":"Thank you, @xiaolai. Fixed on `main` in v2.0.1 (`171acfc`) — the six non-existent skill paths are gone and the manifest now registers only the skills that ship (`nopua`, `nopua-zh`, `nopua-lite`). Closing as superseded by the consolidated fix; the credit for the find is yours. 🙏\n","createdAt":"2026-06-13T17:07:03Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/wuji-labs/nopua/pull/13#issuecomment-4699202916","viewerDidAuthor":false},{"id":"IC_kwDORml_Fc8AAAABGBmNWA","author":{"login":"wuji-labs"},"authorAssociation":"OWNER","body":"Thank you, @xiaolai — your NLPM audit caught a real bug. Those six skill paths in `plugin.json` were dangling, and the manifest now declares only the skills that actually exist (`nopua`, `nopua-zh`, `nopua-lite`).\n\nWe owe you an apology on process: this PR sat unreviewed and the fix then landed via a direct commit to `main` instead of by merging your branch. That wasn't fair to the work — the diagnosis here was yours, and the credit for it is yours. We've since adopted a rule to read open issues and PRs **before** touching a repo, exactly so a contributor's standing work isn't bypassed again. Grateful for the catch.\n","createdAt":"2026-06-13T17:43:26Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/wuji-labs/nopua/pull/13#issuecomment-4699295064","viewerDidAuthor":false}]}
+{"event":"pr_comments_snapshot","timestamp":"2026-06-13T20:40:54Z","pr":"wuji-labs/nopua#14","pr_state":"closed_unmerged","comments_hash":"sha256:0429c87aa9e2dcf5006db8f610ec9f9eceafa05bd674283e06af0e6ca98710b2","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORml_Fc8AAAABGBgmDA","author":{"login":"wuji-labs"},"authorAssociation":"OWNER","body":"Fixed on `main` in v2.0.1 (`171acfc`): `skills/nopua/SKILL.md` is now labeled `en`, and `skills/nopua-zh/SKILL.md` is registered as `zh-CN`. Thanks for catching that zh-CN users were being served English content. Closing as superseded — the fix landed as one consolidated commit. 🙏\n","createdAt":"2026-06-13T17:07:08Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/wuji-labs/nopua/pull/14#issuecomment-4699203084","viewerDidAuthor":false},{"id":"IC_kwDORml_Fc8AAAABGBmNrA","author":{"login":"wuji-labs"},"authorAssociation":"OWNER","body":"Credit to you, @xiaolai — the language label was wrong and `nopua-zh` was unregistered, exactly as your audit reported. `plugin.json` now carries the correct `language` fields and registers `nopua-zh` (zh-CN). \n\nAs on #13: sorry this was resolved by a direct push rather than by merging your PR, and sorry for the silence in between. The fix you identified is live; the finding is credited to you. Thank you for making the manifest honest.\n","createdAt":"2026-06-13T17:43:28Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/wuji-labs/nopua/pull/14#issuecomment-4699295148","viewerDidAuthor":false}]}
+{"event":"pr_comments_snapshot","timestamp":"2026-06-13T20:40:55Z","pr":"wuji-labs/nopua#15","pr_state":"closed_unmerged","comments_hash":"sha256:5f4cff2341c8ad8b640f3b28a03bb37435139247fa12c49e80c38b18f495e3b0","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORml_Fc8AAAABGBgmsA","author":{"login":"wuji-labs"},"authorAssociation":"OWNER","body":"Fixed on `main` in v2.0.1 (`171acfc`): both `nopua-mentor-en` and `nopua-mentor-ja` are now in the registry. Thanks, @xiaolai. Closing as superseded by the consolidated fix. 🙏\n","createdAt":"2026-06-13T17:07:11Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/wuji-labs/nopua/pull/15#issuecomment-4699203248","viewerDidAuthor":false},{"id":"IC_kwDORml_Fc8AAAABGBmN8w","author":{"login":"wuji-labs"},"authorAssociation":"OWNER","body":"You were right here too, @xiaolai — `agents/nopua-mentor-en.md` and `agents/nopua-mentor-ja.md` existed on disk but weren't declared. They're now both registered in `plugin.json` alongside `nopua-mentor`. \n\nSame apology as on #13/#14 for closing this without merging and for the delay. Three real manifest bugs found by your NLPM run, all now fixed — thank you for the thorough audit. If you're open to it, we'd welcome more.\n","createdAt":"2026-06-13T17:43:30Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/wuji-labs/nopua/pull/15#issuecomment-4699295219","viewerDidAuthor":false}]}

auditor/logs/events.jsonl

@@ -2504,3 +2504,7 @@
 {"timestamp":"2026-06-13T09:18:26Z","workflow":"track","event":"status_check","run_id":"27462522388","run_number":337,"data":{"contributed":36,"tracked":34,"case_study_ready":37,"rule_adopted":2}}
 {"timestamp":"2026-06-13T12:51:41Z","workflow":"track","event":"status_check","run_id":"27467106331","run_number":338,"data":{"contributed":36,"tracked":34,"case_study_ready":37,"rule_adopted":2}}
 {"timestamp":"2026-06-13T16:42:40Z","workflow":"track","event":"status_check","run_id":"27472591361","run_number":339,"data":{"contributed":36,"tracked":34,"case_study_ready":37,"rule_adopted":2}}
+{"timestamp":"2026-06-13T20:40:53Z","workflow":"track","event":"finding_outcome","run_id":"27478315456","run_number":340,"data":{"pr":"wuji-labs/nopua#13","pr_state":"closed_unmerged","fingerprints":[],"rule_ids":[]}}
+{"timestamp":"2026-06-13T20:40:54Z","workflow":"track","event":"finding_outcome","run_id":"27478315456","run_number":340,"data":{"pr":"wuji-labs/nopua#14","pr_state":"closed_unmerged","fingerprints":[],"rule_ids":[]}}
+{"timestamp":"2026-06-13T20:40:55Z","workflow":"track","event":"finding_outcome","run_id":"27478315456","run_number":340,"data":{"pr":"wuji-labs/nopua#15","pr_state":"closed_unmerged","fingerprints":[],"rule_ids":[]}}
+{"timestamp":"2026-06-13T20:41:25Z","workflow":"track","event":"status_check","run_id":"27478315456","run_number":340,"data":{"contributed":35,"tracked":35,"case_study_ready":38,"rule_adopted":2}}

auditor/registry/repos.json

@@ -7549,39 +7549,39 @@
       "prs": [
         {
           "number": 13,
-          "state": "OPEN",
+          "state": "CLOSED",
           "mergedAt": null,
-          "closedAt": null,
+          "closedAt": "2026-06-13T17:07:05Z",
           "title": "fix: remove six non-existent skill paths from plugin.json",
-          "updatedAt": "2026-06-05T10:23:04Z",
+          "updatedAt": "2026-06-13T17:43:26Z",
           "createdAt": "2026-04-23T00:38:18Z",
-          "outcome": "open",
+          "outcome": "applied_separately",
           "fingerprints": [],
           "rule_ids": [],
           "stale_90d_emitted": false
         },
         {
           "number": 14,
-          "state": "OPEN",
+          "state": "CLOSED",
           "mergedAt": null,
-          "closedAt": null,
+          "closedAt": "2026-06-13T17:07:09Z",
           "title": "fix: correct language label for skills/nopua/SKILL.md and register nopua-zh",
-          "updatedAt": "2026-06-05T10:23:04Z",
+          "updatedAt": "2026-06-13T17:43:28Z",
           "createdAt": "2026-04-23T00:38:52Z",
-          "outcome": "open",
+          "outcome": "applied_separately",
           "fingerprints": [],
           "rule_ids": [],
           "stale_90d_emitted": false
         },
         {
           "number": 15,
-          "state": "OPEN",
+          "state": "CLOSED",
           "mergedAt": null,
-          "closedAt": null,
+          "closedAt": "2026-06-13T17:07:13Z",
           "title": "fix: register nopua-mentor-en and nopua-mentor-ja in plugin.json",
-          "updatedAt": "2026-06-05T10:23:04Z",
+          "updatedAt": "2026-06-13T17:43:30Z",
           "createdAt": "2026-04-23T00:39:15Z",
-          "outcome": "open",
+          "outcome": "applied_separately",
           "fingerprints": [],
           "rule_ids": [],
           "stale_90d_emitted": false
@@ -7594,8 +7594,9 @@
       "star_anomaly": 0.0,
       "star_velocity": 1.0,
       "stars": 1229,
-      "status": "contributed",
-      "strategy": "single"
+      "status": "tracked",
+      "strategy": "single",
+      "case_study_candidate": true
     },
     "xiaolai/codex-toolkit-for-claude": {
       "case_study_candidate": true,