phplrt/position-contracts

Repo bus factorcaution

All 11 recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Security policycaution

The repository has no security policy. For a small interface package this is a transparency gap rather than a severe risk, but it leaves vulnerability-reporting expectations unclear.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous triggers or audit findings, but all 7 action references are unpinned. That weakens build reproducibility and supply-chain hygiene without independently making the package unsafe.