Talos

Reporting routes and reporter-credit policy exist, but a complete documented acknowledgement, triage, remediation, coordinated disclosure and closure process is absent from the merged source. Root prepares that process on the next branch; historic compliance remains a separate fact.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/SECURITY.md

Full strict Ruff and no-new-debt enforcement are running, but the current1,885-finding central baseline does not establish rare exceptions documented at their code locations. Measured findings include166 import-order blocks,1,472 annotation findings and83 complexity findings. The project retains its strict rules and ratchets while scheduling genuine cleanup; zero basic common-mistake findings is not claimed as full style compliance.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/governance/ruff.toml
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/governance/quality-baseline.json
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/CONTRIBUTING.md
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/CLAUDE.md
https://www.bestpractices.dev/en/criteria/1?details=true#coding_standards_enforced

Fresh strict audits of core, current and supported-minimum dependencies report zero findings. The actively distributed TensorFlow2.14/Keras2 extra has 14 unique dependency advisories: wheel-source inspection supports four alert occurrences involving absent Keras3-only modules, but 12 advisories remain unresolved, including nine medium/high advisories older than60days. Upstream deprecated Keras2/tf-keras and explicitly stopped security backports. Preserve legacy compatibility pending the maintainer policy decision; do not claim all advisories fixed or unexploitable.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/pyproject.toml
https://github.com/keras-team/tf-keras/blob/42a913eb4a7a68779a125a3c8e9bcca453ecad67/SECURITY.md

Actual unmerged PR625 candidate execution covers7046/8711 statements (80.886%) across all176 Talos modules, with215 maintained tests passed and0skips. Complete runnable documentation also passed. Existing exclusions and the complete denominator remain unchanged. Met awaits reviewed integration; follow-up runtime changes require a new exact-source report.

https://github.com/autonomio/talos/pull/625
https://github.com/autonomio/talos/blob/7545ad11cde6faa0954635509e9898223b515b10/docs/verification/2026-10-01-openssf.json

Merged contributor instructions require meaningful regression checks and line coverage, but do not explicitly mandate automated tests for all major new functionality. Root restores the clear mandatory policy on the next branch; attest met after reviewed public integration.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/CONTRIBUTING.md
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/CLAUDE.md

Merged contributor instructions require meaningful regression checks and line coverage, but do not explicitly mandate automated tests for all major new functionality. Root restores the clear mandatory policy on the next branch; attest met after reviewed public integration.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/CONTRIBUTING.md
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/CLAUDE.md

Strict analysis and no-new-debt gates execute; compiler/runtime warnings remain visible. Existing substantive diagnostics still need fix or individual source dispositions, and the 1885-finding strict Ruff baseline is not evidence of practical maximal warning cleanliness. Keep the requirement unmet while preserving the selected rules and ratchets.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/governance/ruff.toml
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/pyproject.toml
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/talos/experiment/runner.py

Manifest identifiers intentionally schema-coupled to SHA256; no selectable hash agility. Delegated SSH/TLS algorithms negotiate externally. SHOULD may be unmet with provenance-schema migration explanation; do not change manifest identity merely for badge.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/talos/experiment/serialization.py
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/talos/yaml/store.py

Executing the current ambience sampler reaches a dependency-owned embedded RANDOM.ORG API credential without a caller credential-file or environment configuration argument. A local replacement reads caller-owned private API key files on every request and verifies rotation without changing source; it remains unmerged. Git credential rotation alone does not clear the sampler finding.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/talos/reducers/sample_reducer.py

Executing the current quantum sampler through its distributed Chances0.1.9 dependency reaches urlopen with CERT_NONE and check_hostname=False. A verified stdlib replacement with TLS1.2+, chain/hostname checks and redirect refusal is implemented locally and tested against real loopback TLS servers; it remains unmerged. Other standard dataset/Git transports do not clear this positive finding.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/talos/reducers/sample_reducer.py
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/pyproject.toml

Latest published v1.4 remains unproven as signed. Merged deploy workflow supports signed provenance on a future authorized wheel/sdist publication. The next branch adds release assets and Sigstore bundles, but workflow code or a local build cannot establish an actual signed release. Await reviewed release execution and consumer verification; do not rewrite old tags.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/.github/workflows/deploy.yml
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/docs/Developer/Release-Policy.md
https://github.com/autonomio/talos/releases/tag/v1.4

Current release script creates ordinary tags; latest v1.4 ref is commit object, no signed tag. SUGGESTED can be unmet; do not rewrite historical tags.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/scripts/create_release.py

Current-source probes reproduce committed-manifest content tampering accepted under an unchanged lineage ID, objective direction sideways accepted, and string false accepted for boolean policy controls. Local regressions reject all of these before caller imports/source hydration, while preserving draft/historical identities; fixes remain unmerged and other constrained-input boundaries still require review.

https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/talos/yaml/store.py
https://github.com/autonomio/talos/blob/9783406eafd0c9d72d00010aeffb379a534a5349/talos/yaml/validator.py