type-fest

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence was collected, leaving release origin less independently verifiable despite the otherwise healthy project evidence.

Token permissionscaution

All four workflows lack top-level permission declarations, and none declares read-only permissions; although no top-level write permissions were found, explicit least-privilege policy would improve workflow safety.