rifm

Repo bus factorcaution

One contributor made about 97% of the 38 recent commits, leaving maintenance highly concentrated. A second contributor is active, which reduces but does not remove the continuity risk.

Workflow auditcaution

All 3 workflows were analyzed, use read-only permissions, and have no unpinned action references or untrusted checkout sinks. The auditor reported a low-confidence cache-poisoning pattern in the release workflow; this is a minor hygiene concern rather than a standalone severe risk.