Thriving 
PY Accountable Autonomy: open-source evidence layer that gates every AI agent tool call against your policy and writes a hash-chained record an auditor verifies offline, without trusting you. Root-agnostic; binds to TPM 2.0 / SEV-SNP when present. Your environment, no SaaS, no telemetry. AGPL-3.0.
https://vaara.io ↗// readme
Your AI agent transferred the funds, wrote the file, called the tool. Later, someone who does not trust you asks you to prove exactly what it did and why: a regulator, an auditor, a customer after an incident. Your own logs will not settle it, because you could have edited them.
pip install vaara # Python: CLI, MCP proxy, server
brew tap vaaraio/tap && brew install vaara # macOS: CLI + menu-bar app (built from source)
npm install @vaara/client # TypeScript client for the HTTP API
import vaara
@vaara.govern
def transfer_funds(to: str, amount: float) -> str:
...
That is the whole thing. Every call to a governed function is risk-scored and decided against your policy before the body runs. An allowed call runs, and the decision, the call, and the outcome land in a hash-chained, tamper-evident record anyone can verify offline, with a signed receipt beside it. Sign the whole trail at export (vaara trail export) for third-party proof. Records persist to ~/.vaara/trail/audit.db by default, so evidence survives restarts. Python 3.10+. The base install carries three runtime dependencies,…
How much a project earns versus how much attention it actually gets. Above 50 means the work is outrunning its audience. Recomputed nightly from commit velocity, contributor effort, issue resolution, fork utility, release cadence, and project maturity — divided by a logarithmic reach factor.
score = signal / reach
signal = 0.25·commit_velocity // commits in last 90 days (cap 30)
+ 0.20·contributor_work // unique authors × velocity (cap 100)
+ 0.20·issue_resolution // closed ÷ total issues
+ 0.20·fork_ratio // forks ÷ stars (proxy for real usage)
+ 0.10·release_cadence // releases in 90 days (cap 3)
+ age_bonus // +0 to +0.30 after 6 months
+ homepage_bonus // +0.05 if homepage is set
reach = log₁₀(stars + watchers + 10)█ Is the project alive and maintained right now? A 0–100 pulse recomputed nightly from commit recency, rhythm, how fast issues close, and how quickly PRs get merged.
health = 0.35·recency // days since last commit (90d decay)
+ 0.25·cadence // commit rhythm consistency
+ 0.20·issue_health // closed ÷ total issues
+ 0.20·pr_health // merged ÷ total PRs█ The colour and label on every card come straight from the health score.
Healthy 80 – 100 active, responsive, regular releases
Stable 60 – 79 maintained, steady, no alarms
Quiet 40 – 59 slowing down — watch this one
At Risk 0 – 39 going dark · candidate for rescue█ Tags are independent behavioral signals computed nightly. A project can hold multiple at once. They drive the home page sections.
solo_builder one person holds > 80% of commits (last 180d)
needs_contributors has open "help wanted" or "good first issue" labels
hidden_gem < 100 stars · active in last 3 months · documented
legacy_hero repo > 5 years old · committed this year
fork_magnet forks/stars > 0.5 · used as template or dependency
release_machine 5+ releases in the last 90 days
under_pressure > 10 open issues · ≤ 2 contributors · health ≥ 60
community_watch watchers > stars · devs tracking before the public
community_hub GitHub Discussions enabled · > 20 discussions
funded maintainer has active funding channel█ Stars are an outcome, not effort. A project with 8 stars and daily commits is doing more interesting work than one coasting on 8k. We measure the building, then divide by the attention already received — so the genuinely undervalued rise to the top.
// stars = lagging indicator
// commits = leading indicator
// we rank by the leading one█