Ecosystem metrics

New Repos
8
down 68.0%
Commits
898
up 30.0%
Releases
11
up 175.0%
Contributors
59
up 22.9%
Merges
15
down 34.8%

Repository Explorer

10617 commits in all time May 14, 2026 21:09 – Aug 12, 2026 21:09 UTC
Delete an inert workflow copy and fix two dangling audit references
AUDIT_READINESS.md:172 points an auditor at `sdk/ci/ci.yml` as the repo's CI
definition. That file does not exist:

  git ls-files sdk/ci/  ->  release.yml, verify_pinned_digest.py

scripts/verify_all.sh:10 makes the same reference, claiming to "mirror the
sdk/ci/ci.yml signature-kat job recipe EXACTLY". Both now point at
.github/workflows/ci.yml, which is the file that actually runs. An auditor
following the readiness doc hits a 404 on its first CI citation.

sdk/ci/release.yml is deleted. GitHub Actions only executes YAML under
.github/workflows/, so it never ran, and it had drifted into being the WORSE
copy: ad20b42 SHA-pinned every action in the live workflow while this one kept
floating tags -

  actions/checkout@v5                vs  @fbc6f39... # v5.0.1
  actions/setup-python@v6            vs  @ece7cb0... # v6.0.0
  actions/upload-artifact@v4         vs  @ea165f8... # v4.6.2
  actions/download-artifact@v4       vs  @d3f86a1... # v4.3.0
  sigstore/cosign-installer@v4.1.0   vs  @ba7bc0a... # v4.1.0
  softprops/action-gh-release@v2.6.2 vs  @3bb1273... # v2.6.2

19 differing lines, all pins. An inert file is harmless right until someone
copies it back - and this is the release workflow, the one that signs
artifacts and publishes them.

Also gitignores .venv-contracts/, the local virtualenv the contract suite
needs. It was untracked and unignored, which is how a `git add -A` in this
directory sweeps 1757 site-packages files into a commit.

Nothing references the deleted file; verify_all.sh still parses (bash -n).

Found by an adversarial claim-vs-enforcement sweep (TCE-15).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Git Commit 749a3908 Branch docs/stale-ci-references Document 4/5 ++ 182 --
cce go-algorand
Merge 4fb7d5a74e855225413c33831502e171122cbad8 into 8d7f8f778c8668bb5162fad3179bbb4cbb1082bb
Git Commit 81e14447 Branch pull/6659/merge Document 13/2,549 ++ 168 --
Run the contract suite in CI
The contract suite has never run in CI. It is the only thing that exercises
inscription.py at all - falcon_verify on-chain, the C1 ownership conjunction,
write-once, cross-cell replay, the update_owner guards - and the only record
that it passed was a hand-run note in LOCALNET_VALIDATION_2026-06-01.md, dated
two weeks BEFORE 2ec798e changed the contract.

So the flagship's on-chain logic has had no automated coverage of any kind,
and the drift in 2ec798e went unnoticed partly for that reason.

It was never wired up because it needs three things at once:

  1. a LocalNet (algod on :4001)   - without it: 22x urllib.error.URLError
  2. the Falcon C library          - without it: 19x "Could not load Falcon
                                     shared library at './libfalcondet1024.so'"
  3. the committed typed client    - already in the repo

Both failure modes above were reproduced locally before writing this job, so
the recipe is derived from what actually breaks, not from guesswork. The
pinned compile venv (puyapy) is deliberately NOT needed: these tests deploy
the committed client, they do not rebuild the contract.

The library is built from the pinned tarball behind the same digest + FPEMU
gate signature-kat uses. These tests produce REAL det1024 signatures that the
AVM's falcon_verify opcode must accept, so the signer has to be the pinned
build for exactly the reason that job states.

Two guards, both from failures seen elsewhere in this workflow:

  * LocalNet health is polled before the suite runs. A half-started sandbox
    fails with connection errors that read like test failures, destroying the
    signal this job exists to provide.
  * The run asserts 20+ tests actually EXECUTED. pytest exits 5 on "no tests
    collected", but a suite that silently shrank to a handful still exits 0 -
    and "green meaning nothing ran" is the precise defect this job is here to
    end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Git Commit e8a5187c Branch ci/contract-suite-never-runs Document 1/80 ++ 0 --
mitre88 js-algorand-sdk
Merge 9957c1e86e094dff50fab01bb87a53a20d82fc1c into 75c72bf720cdf08705f25d121fcce3e3150f72e6
Git Commit ed5e4512 Branch pull/1128/merge Document 2/27 ++ 0 --
mitre88 algokit-utils-ts
Merge 7589dfb260476331584c8918d53668f114c50998 into b27decbb670d4d5e481699358da41e34ddfc26a4
Git Commit 2e5c07be Branch pull/592/merge Document 5/304 ++ 95 --
mitre88 js-algorand-sdk
fix: explain 24-word BIP-39 mnemonics in seedFromMnemonic
Reject unexpected word counts before decode so a Pera Universal
Wallet 24-word phrase gets an actionable error instead of the
generic failed-to-decode message.

Fixes #1064
Git Commit 9957c1e8 Branch pull/1128/head Document 2/27 ++ 0 --
Test the untested half of C1: the recorded owner who no longer holds
C1 is a conjunction - inscribe requires that the sender (a) currently holds
the Cell ASA AND (b) is the controlling owner recorded at mint - but only (b)
had coverage.

test_flash_custody_rejected builds a holder who is not the owner. Every other
test mints with mint_cell(algorand, admin, admin), so the sender is always
both, and mint_cell's transfer branch is itself dead. The state in which
`assert exists and balance == UInt64(1)` is the DECIDING assert - recorded
owner, no longer holding - was never constructed.

It is not a hypothetical. update_owner is a separate, voluntary call, so a
seller who transfers the Cell ASA on a secondary market stays the recorded
controlling owner until someone calls it. Without (a) that seller can inscribe
the buyer's cell; C2 makes inscription write-once and update_owner is blocked
afterwards, so the buyer's cell is PERMANENTLY consumed with the seller's
artifact. That is the exact inverse of the flash-custody vector the suite does
cover.

The test also asserts WHICH conjunct fired. A bare pytest.raises(Exception) -
the pattern every other negative test here uses - would pass if the rejection
came from (b) or from anything unrelated, leaving (a) untested while looking
covered.

MUTATION PROOF, end to end rather than by inspection:
  - deleted the C1(a) assert from inscription.py
  - recompiled with the pinned puyapy 5.8.1 and regenerated the typed client
  - confirmed the string is gone from the TEAL and the client
  - ran the suite against a LocalNet deployment of the mutated contract

    1 failed, 22 passed
    test_recorded_owner_who_no_longer_holds_is_rejected: DID NOT RAISE

The 22 pre-existing tests stayed green, exactly as predicted, and the failure
mode is the vulnerability itself: the inscribe SUCCEEDED. Restored and
re-verified: 23 passed.

Reproducing this needs LocalNet, a built Falcon library, and the pinned
compile venv; see the PR for the build notes.

Found by an adversarial claim-vs-enforcement sweep (TCE-14).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Git Commit 3ac8d445 Branch test/c1-holding-conjunct-untested Document 1/45 ++ 0 --
iglosiggio go-algorand-sdk
feat: Add an extensible signer API
Git Commit 44245e3a Branch extensible-signing-api Document 24/606 ++ 260 --
mitre88 algokit-utils-py
chore: pin gitpython to clear pip-audit
Direct-dev-pin GitPython>=3.1.58 so pip-audit stops failing on the
15 advisories in the 3.1.50 copy pulled in by python-semantic-release.
Same pattern already used for pygments, requests, and filelock.
Git Commit 975a1bbb Branch pull/327/head Document 2/7 ++ 4 --
mitre88 algokit-utils-ts
ci: add npm audit exclusions for dev-only advisories
Git Commit 7589dfb2 Branch pull/592/head Document 3/117 ++ 95 --
Merge 3a21c29e74c5c3b342964d34ffc385a0f9739a5a into a06f0e8e671d1760d708fab4da7bfa240de2448c
Git Commit 7fa5f0a7 Branch pull/187/merge Document 1/1 ++ 0 --
PhearZero liquid-auth
Merge 4933a4a1081af83bb80512a44199ef683f5df8c8 into 5202ec1658b5d9d2171c375d30504b3bdce5534d
Git Commit 301d7204 Branch pull/67/merge Document 5/514 ++ 10 --
PhearZero liquid-auth
chore: harden existing links by checking for wallet claims
Git Commit 4933a4a1 Branch chore/harden-existing-links Document 5/514 ++ 10 --
Merge 873f1e60df1ffd49a3e820286ba1d88cb53499cc into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit b5391cfd Branch pull/167/merge Document 2/2,050 ++ 2,392 --
chore(deps-dev): bump semantic-release from 23.0.6 to 25.0.9
Bumps [semantic-release](https://github.com/semantic-release/semantic-release) from 23.0.6 to 25.0.9.
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](https://github.com/semantic-release/semantic-release/compare/v23.0.6...v25.0.9)

---
updated-dependencies:
- dependency-name: semantic-release
  dependency-version: 25.0.9
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Git Commit 873f1e60 Branch dependabot/npm_and_yarn/semantic-release-25.0.9 Document 2/2,050 ++ 2,392 --
Merge 1346787e2f23c4b91a7f9c40835ea71060af689f into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit 72d11470 Branch pull/166/merge Document 2/215 ++ 72 --
chore(deps-dev): bump typedoc from 0.25.12 to 0.28.20
Bumps [typedoc](https://github.com/TypeStrong/TypeDoc) from 0.25.12 to 0.28.20.
- [Release notes](https://github.com/TypeStrong/TypeDoc/releases)
- [Changelog](https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md)
- [Commits](https://github.com/TypeStrong/TypeDoc/compare/v0.25.12...v0.28.20)

---
updated-dependencies:
- dependency-name: typedoc
  dependency-version: 0.28.20
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Git Commit 1346787e Branch dependabot/npm_and_yarn/typedoc-0.28.20 Document 2/215 ++ 72 --
Merge 42d5a07fd74d365e8072a037e2a3f252f888096f into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit a1b6ce62 Branch pull/165/merge Document 83/12,017 ++ 11,515 --
Merge cd3fdb4916565631eea4c4a1d5f30f9be498719a into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit 874ae35d Branch pull/163/merge Document 142/19,683 ++ 13,051 --
Merge 92edec2d4fc471818f5b247bc135ad395b885b33 into d2de6fadecafa220eaa47dbd00ea1221fc6af26f
Git Commit 88a6a87a Branch pull/161/merge Document 142/19,685 ++ 13,052 --