milpa/resolver

The architecture resolver: pure logic that resolves contracts, versioned capabilities, and surfaces against a host profile and reports whether the graph is valid, bootable-with-warnings, blocked, or legacy-compatible.

Latest v0.7.1

Packagist

74%

Total Score

caution

Usable with caveats: active project, but all workflow actions are unpinned and maintenance is concentrated in one contributor.

Health Score Breakdown

Repo bus factor

All 19 recent commits came from one contributor, concentrating maintenance knowledge and creating a meaningful continuity risk. Organization backing partly offsets this, but no second active contributor is shown.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. The repository's SECURITY.md and workflow audit provide some compensating transparency, so this is only a minor gap.

Version stability

Version 0.7.1 is not a prerelease, but it remains below major version 1, so compatibility expectations are weaker than for a mature stable-major package.

Workflow audit

All four workflows were analyzed with no audit findings or untrusted checkout and script-injection sinks. However, three workflows grant top-level write permissions and all seven action references are unpinned, leaving reproducibility and token-scope hygiene concerns.