From 1052eb86d1997614c548e21468ae9e28310c5634 Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Tue, 28 Jul 2026 10:59:29 -0700
Subject: [PATCH 1/2] feat(admin): CI/security signals, honest Reach panel,
 releases pagination fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds latest CI run status and open Dependabot alert count to the admin
collector and a new Project Health section. Replaces the two Reach tiles
that were permanently dead for this npm-only project (bundle downloads,
newest release pulls — GitHub release assets don't apply) with real
GitHub-native people signals (contributors, watchers). Fixes a releases
fetch capped at per_page=20 that silently dropped older releases (repo
has 29). Makes the existing npm mirror-inflation exclusion from Reach an
explicit, first-class note instead of a footnote.

See docs/adr/0013 for the full rationale.
---
 README.md                                     |   2 +-
 ...build-security-signals-and-honest-reach.md | 129 ++++++++++++++++++
 docs/adr/README.md                            |   7 +-
 src/commands/x/admin.mjs                      |  13 +-
 src/lib/admin-collect.mjs                     |  39 +++++-
 src/lib/admin-server.mjs                      |   6 +
 src/lib/admin-styles.mjs                      |  15 +-
 src/lib/admin-view.mjs                        |  53 +++++--
 tests/admin.test.cjs                          |  47 ++++++-
 9 files changed, 287 insertions(+), 24 deletions(-)
 create mode 100644 docs/adr/0013-admin-build-security-signals-and-honest-reach.md

diff --git a/README.md b/README.md
index eeecac88..d9b8f982 100644
--- a/README.md
+++ b/README.md
@@ -70,7 +70,7 @@ What the verbs cover:
 | **status** | Per-subsystem ✓/⚠/✗ (versions, the kit's own version, **ruvnet-brain** (present + release drift, or "not installed"), natives (agentdb copies **and** ruflo's own memory runtime — the one `npx ruflo memory` loads — load-tested for a native better-sqlite3, not just the agentdb dirs), **memory-pin** (warns when `CLAUDE_FLOW_DB_PATH` points off the live DB), security, learning, aqe/RVF, **agentdb** (CLI present + coherent with ruflo's bundled version, or a store-skew warning), MCP, **hosts** (claude/codex — version + install method + **auth mode** (subscription $0 vs metered api-key), with the **primary** host marked and a *fail* when the primary host is absent), **providers** (host wiring + aqe fallback chain, or "drifted"/claude-only default), **routing** (per-activity Claude/Codex host+model policy, when dual-host — with drift vs the on-disk `agentOverrides`), daemons, guidance-file blocks (`~/.claude/CLAUDE.md`, project `AGENTS.md`, and `~/.codex/AGENTS.md` on codex machines), statusline), each drift row naming what `sync` would do about it — plus a **health-history** line that flags regressions since the last sync (learning shrank, native slots dropped, drift/security backslid). |
 | **sync** | The one convergence verb: upgrades first when a new release exists, then re-heals everything an upgrade wipes, then re-checks and reports. Included in that heal: it **installs any enabled frontier host** (claude/codex) that's entirely absent — never touching an external (mise/brew/native) install — and **re-applies provider wiring** (the `ENABLE_*` host env, the aqe fallback chain, and ruflo API providers) whenever it has drifted — and, on a dual-host project, **seeds/heals the per-activity routing policy** (materializing it into agentic-qe's `agentOverrides`, e.g. after an aqe upgrade first makes it eligible). It also **installs/repins the standalone `agentdb` CLI** to ruflo's bundled version (keeping the shared cognitive store coherent) and appends a **health-history snapshot** so `status` can flag regressions across syncs. It also **re-runs the RuvNet Brain installer** to pull the latest release when the on-disk KB has drifted (or installs it if absent, when enabled). It also **self-updates the kit**: when a newer `@pacphi/agentic-kit` exists it installs it as the *last* step (the new code applies from the next `ak` run, never mid-sync). Prerelease installs (`4.0.0-alpha.*`) track the `next` npm dist-tag as well as `latest`, so alphas see their successors; stable installs only ever follow `latest`. `--no-upgrade` skips the self-update along with the package upgrades. |
 | **dashboard** | Opens a read-only local web dashboard (`127.0.0.1:7431`, localhost-only, never detaches) with seven tabs: **Overview · Hosts & Routing · Providers · Runtime · Intelligence · Usage · Live**. The first five render `ak status` health and routing; Usage indexes local Claude/Codex transcripts on demand. Live groups work by project, then provider-branded root sessions with nested agent/worker threads, and pairs an interactive agent/tool execution canvas with a rich, server-masked transcript stream. Active sessions can be followed live or reviewed with synchronized play/pause/seek; completed sessions remain available for bounded playback. Live contains no chat or control plane. Ruflo, agentic-qe, and dual-run stores are not auto-discovered; register each trusted structured JSONL file with repeatable `--live-source 'surface=path'` (`surface` is `ruflo`, `aqe`, or `dual-run`). The page is self-contained and offline-first (no internet fetches; local files and loopback subprocesses/endpoints only). See [Live Sessions](docs/LIVE-SESSIONS.md) for coverage, syntax, and privacy limits. **Auto-opens your browser** (`--no-open` for headless/SSH); `--port N` changes the port; tabs deep-link (`#live`) and persist. Stop with Ctrl-C. (Also available as `ak x dashboard`.) |
-| **admin** | Opens the **maintainer admin** (`127.0.0.1:7432`, localhost-only, foreground) — the project-telemetry sibling of `dashboard`, with the same dark/light visual theme and persisted theme preference: unique repo visitors and cloners (GitHub traffic API, needs a push-access token via `GITHUB_TOKEN`/`GH_TOKEN`/`gh auth token` — panels degrade honestly without one), npm download momentum (last 7d vs prior 7d, sparklines), release pulls, a **"since you last looked"** delta strip over a local baseline, open issues/PRs from others (oldest first), and external humans ranked by recency (bots excluded). Access is gated by a **per-session token** carried in the URL fragment and sent header-only; the page makes **zero external fetches** (the server proxies GitHub/npm; your credential never reaches the page or the payload — ADR-0007). Where `dashboard` is offline-first, `admin` does deliberate GitHub/npm egress — that contract split is why they're siblings, not tabs. `--port N`, `--no-open`; Ctrl-C stops. (Also available as `ak x admin`.) |
+| **admin** | Opens the **maintainer admin** (`127.0.0.1:7432`, localhost-only, foreground) — the project-telemetry sibling of `dashboard`, with the same dark/light visual theme and persisted theme preference: unique repo visitors and cloners (GitHub traffic API, needs a push-access token via `GITHUB_TOKEN`/`GH_TOKEN`/`gh auth token` — panels degrade honestly without one), contributors and watchers, npm download momentum (last 7d vs prior 7d, sparklines — shown as trend only, never an absolute reach number, since mirrors/CI inflate the raw count), latest CI run status and open Dependabot alerts, a **"since you last looked"** delta strip over a local baseline, open issues/PRs from others (oldest first), and external humans ranked by recency (bots excluded). Access is gated by a **per-session token** carried in the URL fragment and sent header-only; the page makes **zero external fetches** (the server proxies GitHub/npm; your credential never reaches the page or the payload — ADR-0007, ADR-0013). Where `dashboard` is offline-first, `admin` does deliberate GitHub/npm egress — that contract split is why they're siblings, not tabs. `--port N`, `--no-open`; Ctrl-C stops. (Also available as `ak x admin`.) |
 | **dual** | Runs a **Claude + Codex collaboration swarm** using your per-activity routing policy: `ak dual run <template> "<task>"` materializes a dual-run config (each pipeline step assigned to the host + model your policy chose) and drives it via `claude-flow-codex`. Templates: `feature`, `security`, `refactor`, `packaging`, `release`. `--dry-run` prints the plan + config without running; `--route 'activity:host[:model]'` overrides one step for that run; `--escalate` retries once up the cross-vendor ladder on failure. Requires dual-host enabled (`ak setup --codex`, or `ak x provider pick --host claude,codex`). **Pre-flight refusal:** before spawning a worker, `dual run` refuses to start when ruflo's memory runtime lacks a native better-sqlite3 binding **and** the shared DB has an active native WAL (`-wal`/`-shm` sidecars) — the native WAL writer and the WASM `ruflo memory store` cannot share that DB without corrupting it; the fix is `ak sync` (builds the native binding), then retry. |
 | **uninstall** | Removes the kit's footprint (and any legacy shell-kit install); project data is never touched; `--purge` also offers to remove the global packages. |
 
diff --git a/docs/adr/0013-admin-build-security-signals-and-honest-reach.md b/docs/adr/0013-admin-build-security-signals-and-honest-reach.md
new file mode 100644
index 00000000..332a0560
--- /dev/null
+++ b/docs/adr/0013-admin-build-security-signals-and-honest-reach.md
@@ -0,0 +1,129 @@
+# ADR-0013 — Admin: build/security signals, an honest Reach panel, and a pagination fix
+
+- **Status:** Accepted
+- **Date:** 2026-07-28
+- **Deciders:** agentic-kit maintainers
+
+## Context
+
+ADR-0007 shipped `ak x admin` as a loopback, deliberate-egress maintainer console answering "how is
+this project actually doing" from GitHub + npm. A follow-up audit (live queries against the real
+`pacphi/agentic-kit` repo, with the same token the admin server itself resolves) found the page
+answered that question less completely than it could:
+
+1. **Two of the four Reach hero tiles were permanently dead for this project.** "bundle downloads"
+   and "newest release pulls" read from GitHub release **assets**. agentic-kit ships exclusively via
+   npm — verified live, 0 of 29 releases carry any asset — so both tiles rendered `—` forever. That
+   is correct behavior per the model's "unknown is not zero" rule (ADR-0007 §4.1), not a bug, but it
+   is dead screen real estate for this project's actual distribution channel.
+2. **`admin-collect.mjs` capped the releases fetch at `per_page=20`** while the "bundle downloads"
+   tile's own copy claimed "lifetime, **all releases**." The repo already has 29 releases; the oldest
+   9 were silently dropped from both the releases list and `totalAssetDownloads`. Harmless today only
+   because no release carries assets — the moment one does, the label becomes false with no
+   truncation indicator.
+3. **No CI/build health or security-alert signal reached the page at all**, despite `ci`/`release`
+   GitHub Actions workflows running on every push and Dependabot maintaining the dependency tree —
+   both directly answer "how is this project doing" and both were one more `Promise.all` entry away.
+4. **Two already-collected fields were invisible in the UI**: `repo.watchers` (GitHub subscriber
+   count) was computed in the collector and never rendered; `npm.lastWeek`/`npm.lastMonth` were
+   computed and only ever consumed as a trend-arrow input in Momentum, never shown as an absolute
+   number anywhere.
+5. On point 4's npm figures specifically: `admin-view.mjs` already carried a **deliberate** decision
+   to keep npm's absolute download count out of the Reach panel, because `npm downloads are dominated
+   by mirrors` (CI runners, cache warmers, and registry mirrors re-pull as often as a real install,
+   and `api.npmjs.org` cannot distinguish them). That rationale was correct but stated in one
+   half-sentence buried in a footnote — worth stating as its own first-class, explicit entry so a
+   maintainer reading the Gaps tab understands *why* npm never appears as a reach number, not just
+   that it doesn't.
+
+## Decision
+
+### 1. Fix the releases pagination bug
+
+`admin-collect.mjs` now fetches `/releases?per_page=100` (GitHub's per-request ceiling), matching the
+same single-page-best-effort cap already used for issues/stargazers/forks in this file. This is a
+correctness fix, not a new pagination system — the file's existing house pattern (one page, capped at
+100, no further pages followed) is extended consistently rather than reinvented. The 100-item ceiling
+is now called out in a code comment at the fan-out site so a future reader does not mistake it for
+full pagination.
+
+### 2. Replace the two dead Reach tiles with real, GitHub-native people signals
+
+"bundle downloads" and "newest release pulls" are replaced with:
+
+- **contributors** — `GET /repos/{slug}/contributors`, count only. A genuinely different circle from
+  "people who filed issues/PRs" (buildPeople's `people.contributors`): this counts who has code in
+  the tree via GitHub's own merge history.
+- **watching** — `repo.watchers` (already collected, previously unrendered). A standing-interest
+  signal distinct from a one-time visitor.
+
+Both stay inside GitHub's own numbers, so neither reopens the mirror-inflation problem npm carries.
+The npm absolute-download question raised by point 4 was decided explicitly: **npm downloads still do
+not appear in Reach.** The existing exclusion was correct; only the messaging around it was thin (see
+Decision 4).
+
+### 3. A new "Project health" section: latest CI run + open Dependabot alerts
+
+A new subsection in the Overview panel, fed by two more `Promise.all` entries:
+
+- `GET /repos/{slug}/actions/runs?per_page=5` → latest run's `{name, status, conclusion, at, url}`
+  plus a failure count over the fetched page. No runs found renders `—`, never a fabricated
+  "passing" (the same unknown-is-not-zero discipline as everywhere else in this file).
+- `GET /repos/{slug}/dependabot/alerts?state=open&per_page=100` → open alert count. This endpoint
+  needs a token with `security_events` scope (classic PAT) or equivalent fine-grained access; an
+  unconfigured or under-scoped token 403s, which `ghJson` already folds to `null` — the tile
+  degrades to "unknown" with an explanatory `why`, never a false "0 alerts."
+
+Both are additive `Promise.all` entries in the existing single fan-out (ADR-0007 §3) — no new
+request pattern, no new auth flow, no new caching layer.
+
+### 4. Make the npm mirror-inflation rationale a first-class, explicit statement
+
+The Gaps tab (ADR-0007's "honesty section") gains a `design`-tagged entry stating plainly that npm
+download counts are shown as **trend only, never as a reach number**, and why: mirrors/CI/cache
+warmers are indistinguishable from real installs in npm's own data, so an absolute total would
+overstate reach. The Reach panel's footer note and the Momentum tile's note are both tightened to
+carry the same point concisely rather than as an aside.
+
+## Consequences
+
+- `admin-collect.mjs`'s single `Promise.all` grows from 9 to 12 entries: `contributors`,
+  `actions/runs`, `dependabot/alerts` join the existing set. All three follow the file's existing
+  discipline — internally try/caught, degrade to `null`/empty on any failure, never reject the batch,
+  never appear in the payload if the credential is absent from the request itself (contributors and
+  CI runs work unauthenticated on a public repo; Dependabot alerts do not and degrade honestly).
+- The payload contract gains `contributorsCount` (number|null), `ci: {latest, recentFailures,
+  recentTotal}`, and `security: {dependabotAlerts}`. `defaultCollect`'s fail-soft path returns honest
+  empty values for all three so a thrown collector error still yields a renderable payload.
+- The Reach panel's four tiles are now: unique repo visitors (hero), contributors, watching, opted-in
+  installs (still an honest gap) — all either real headcounts or an explicit "not built" admission,
+  none permanently dead for this project's npm-only distribution model.
+- `tests/admin.test.cjs` gained fixtures and assertions for the three new endpoints, including the
+  same never-fabricate-a-zero discipline tested elsewhere (Dependabot 403 → `null`, no workflow runs
+  → `ci.latest: null`, a failing contributors fetch nulls only `contributorsCount`) and an explicit
+  assertion that the releases fetch requests `per_page=100`.
+- `admin-model.mjs` is unchanged — every new field renders through the existing `metric()` helper, so
+  the pure-model import-nothing constraint (ADR-0007 §5) is untouched.
+
+## Alternatives considered
+
+- **Show npm absolute downloads as a Reach tile instead of GitHub-native signals.** Rejected: it
+  would reintroduce exactly the mirror-inflation overstatement the original design deliberately
+  avoided (Context, point 5). GitHub-native signals (contributors, watchers) answer the same "kill
+  the dead tiles" goal without that risk.
+- **Full pagination (follow `Link` headers) for releases/issues/stargazers/forks/contributors.**
+  Rejected for now: none of these currently exceed the 100-item cap for this repo, and full
+  pagination is a larger, inconsistent change against the file's established one-page-best-effort
+  house pattern. The 100-item ceiling is now documented in code rather than silently assumed; revisit
+  if/when any list genuinely exceeds it.
+- **Cache GitHub/npm responses between polls (ETag/`If-None-Match`) to cut request volume on
+  auto-refresh.** Out of scope for this ADR — freshness-over-caching is ADR-0007's explicit contract
+  (`Cache-Control: no-store` on every `/api/*` response), and today's request volume is nowhere near
+  GitHub's rate ceiling. Worth its own ADR if auto-refresh usage patterns change that calculus.
+
+## References
+
+- ADR-0007 (maintainer admin: loopback telemetry with deliberate egress) — this ADR extends its
+  collector/payload/Reach-panel decisions rather than superseding them.
+- `src/lib/admin-collect.mjs`, `src/lib/admin-view.mjs`, `src/lib/admin-server.mjs`,
+  `src/lib/admin-styles.mjs`, `tests/admin.test.cjs`.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index a531db73..e25fba59 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -21,6 +21,7 @@ Consequences**, and cites the grounded source it rests on where relevant.
 | [0010](0010-provider-mediated-quota-reads.md) | Provider-mediated quota reads (the only honest denominators) | Accepted |
 | [0011](0011-local-model-provenance-zero-cost-and-transcript-fidelity.md) | Local models: provenance out-of-band, $0 per model, stated transcript fidelity | Proposed |
 | [0012](0012-live-sessions-observability.md) | Live sessions as local, evidence-graded observability | Accepted |
+| [0013](0013-admin-build-security-signals-and-honest-reach.md) | Admin: build/security signals, an honest Reach panel, and a pagination fix | Accepted |
 
 Theme: ADRs **0001–0006** define **dual-host LLM routing and leadership** — how `ak` lets ruflo route
 each development activity (architecture, implementation, testing, review, …) to the right host (Claude
@@ -49,4 +50,8 @@ keep content out of broad topology snapshots/replay while preserving masked loca
 keeping chat/control absent. Claude/Codex collection is
 implemented; ruflo, agentic-qe, and dual-run require explicit, repeatable `--live-source`
 registration. Independent plugin/skill/MCP discovery and a measured frame-time budget remain
-documented limitations rather than implied capabilities.
+documented limitations rather than implied capabilities. **0013** extends 0007's admin collector with
+CI-run and Dependabot-alert signals, fixes a releases-pagination cap that silently dropped older
+releases, replaces two GitHub-release-asset Reach tiles that were permanently dead for this npm-only
+project with real GitHub-native people signals (contributors, watchers), and states the existing
+npm-mirror-inflation exclusion explicitly instead of as a footnote.
diff --git a/src/commands/x/admin.mjs b/src/commands/x/admin.mjs
index de8bdcf3..d64eb84a 100644
--- a/src/commands/x/admin.mjs
+++ b/src/commands/x/admin.mjs
@@ -17,12 +17,13 @@ export const options = {
 export const help = `ak admin — maintainer-only local telemetry admin (localhost only)  [alias: ak x admin]
 
 Serves a self-contained web panel showing how the project is actually doing —
-unique repo visitors, release-asset pulls, npm range, GitHub traffic, and the
-humans who filed issues, opened PRs, or forked. Unlike \`ak dashboard\` (which is
-offline-first and never leaves your machine), admin makes DELIBERATE network
-egress: the server fetches GitHub + npm on your behalf and reads a GitHub
-credential (GITHUB_TOKEN → GH_TOKEN → \`gh auth token\`, best-effort) at runtime.
-That credential is never persisted and never reaches the page.
+unique repo visitors, contributors, npm range, GitHub traffic, latest CI run,
+open Dependabot alerts, and the humans who filed issues, opened PRs, or
+forked. Unlike \`ak dashboard\` (which is offline-first and never leaves your
+machine), admin makes DELIBERATE network egress: the server fetches GitHub +
+npm on your behalf and reads a GitHub credential (GITHUB_TOKEN → GH_TOKEN →
+\`gh auth token\`, best-effort) at runtime. That credential is never persisted
+and never reaches the page.
 
 Bound to 127.0.0.1. A fresh session token is minted at startup and carried into
 the browser in the launch URL's # fragment (never a query param, never logged);
diff --git a/src/lib/admin-collect.mjs b/src/lib/admin-collect.mjs
index f6187106..45ef378c 100644
--- a/src/lib/admin-collect.mjs
+++ b/src/lib/admin-collect.mjs
@@ -87,9 +87,13 @@ export async function collectAdminStats({ fetchImpl = fetch, ghToken = '', repoS
 
   // Single Promise.all. Auth-gated calls resolve to null when unconfigured so we
   // never issue a doomed request; each fetch is internally try/caught (EC-3).
-  const [repoRaw, releasesRaw, clonesRaw, viewsRaw, referrersRaw, npmRaw, issuesRaw, starsRaw, forksRaw] = await Promise.all([
+  // releases/issues/stargazers/forks/contributors are single-page reads capped at
+  // GitHub's per_page=100 ceiling — the same one-page-best-effort pattern
+  // throughout this file, not a full-pagination guarantee. At 100+ items the
+  // oldest/lowest-ranked entries silently drop; there is no truncation flag.
+  const [repoRaw, releasesRaw, clonesRaw, viewsRaw, referrersRaw, npmRaw, issuesRaw, starsRaw, forksRaw, contributorsRaw, runsRaw, alertsRaw] = await Promise.all([
     gh('/repos/' + repoSlug),
-    gh('/repos/' + repoSlug + '/releases?per_page=20'),
+    gh('/repos/' + repoSlug + '/releases?per_page=100'),
     configured ? gh('/repos/' + repoSlug + '/traffic/clones') : null,
     configured ? gh('/repos/' + repoSlug + '/traffic/views') : null,
     configured ? gh('/repos/' + repoSlug + '/traffic/popular/referrers') : null,
@@ -97,6 +101,12 @@ export async function collectAdminStats({ fetchImpl = fetch, ghToken = '', repoS
     gh('/repos/' + repoSlug + '/issues?state=all&per_page=100&sort=created&direction=desc'),
     gh('/repos/' + repoSlug + '/stargazers?per_page=100'),
     gh('/repos/' + repoSlug + '/forks?per_page=100&sort=newest'),
+    gh('/repos/' + repoSlug + '/contributors?per_page=100'),
+    gh('/repos/' + repoSlug + '/actions/runs?per_page=5'),
+    // Dependabot alerts need a token with `security_events` scope (classic PAT) or
+    // equivalent fine-grained access; an unconfigured/under-scoped token 403s and
+    // ghJson folds that to null — degrades to "unknown", never a fabricated 0.
+    gh('/repos/' + repoSlug + '/dependabot/alerts?state=open&per_page=100'),
   ]);
 
   const releases = mapReleases(releasesRaw);
@@ -120,6 +130,9 @@ export async function collectAdminStats({ fetchImpl = fetch, ghToken = '', repoS
     },
     npm: npmToBlock(npmRaw),
     people: buildPeople(issuesRaw, starsRaw, forksRaw, owner),
+    contributorsCount: Array.isArray(contributorsRaw) ? contributorsRaw.length : null,
+    ci: buildCi(runsRaw),
+    security: { dependabotAlerts: Array.isArray(alertsRaw) ? alertsRaw.length : null },
     feedback: doors(repoSlug),
   };
 }
@@ -138,7 +151,8 @@ export function defaultCollect({ repoSlug, npmPkg, fetchImpl = fetch, resolveTok
       return {
         generatedAt: new Date().toISOString(), repoSlug, repo: null, releases: [], totalAssetDownloads: 0,
         traffic: { configured: false, note: String((e && e.message) || e), clones: null, views: null, referrers: null },
-        npm: null, people: emptyPeople(), feedback: doors(repoSlug), error: String((e && e.message) || e),
+        npm: null, people: emptyPeople(), contributorsCount: null, ci: emptyCi(),
+        security: { dependabotAlerts: null }, feedback: doors(repoSlug), error: String((e && e.message) || e),
       };
     }
   };
@@ -212,6 +226,25 @@ function npmToBlock(npmRaw) {
   };
 }
 
+/** Latest workflow run + a lightweight failure count over the last page (≤5
+ *  runs). null latest ⇒ no runs found (a brand-new repo, or Actions unused) —
+ *  never fabricated as "passing". */
+function buildCi(runsRaw) {
+  const runs = Array.isArray(runsRaw && runsRaw.workflow_runs) ? runsRaw.workflow_runs : [];
+  if (!runs.length) return emptyCi();
+  const latest = runs[0];
+  return {
+    latest: { name: latest.name, status: latest.status, conclusion: latest.conclusion, at: latest.created_at, url: latest.html_url },
+    recentFailures: runs.filter((r) => r.conclusion && r.conclusion !== 'success').length,
+    recentTotal: runs.length,
+  };
+}
+
+/** An empty CI block, used when the runs fetch fails or returns nothing. */
+function emptyCi() {
+  return { latest: null, recentFailures: null, recentTotal: null };
+}
+
 /** The two "doors" — issues + discussions URLs — built from the slug, never the
  *  network. */
 function doors(repoSlug) {
diff --git a/src/lib/admin-server.mjs b/src/lib/admin-server.mjs
index cf63e0f8..9c94503f 100644
--- a/src/lib/admin-server.mjs
+++ b/src/lib/admin-server.mjs
@@ -224,6 +224,12 @@ function renderPage({ modelSrc, viewSrc }) {
         <div class="mom" data-momentum></div>
         <p class="note" data-momentum-note></p>
       </section>
+
+      <section class="sec">
+        <h2>Project health <span class="qual mono">is the build green, is anything waiting on a fix</span></h2>
+        <p class="lead">The latest CI run and open Dependabot alerts — read live from GitHub, not cached between visits.</p>
+        <div class="health" data-health></div>
+      </section>
     </section>
 
     <section class="panel" id="panel-review" data-panel="review" role="tabpanel" aria-labelledby="tab-review" hidden>
diff --git a/src/lib/admin-styles.mjs b/src/lib/admin-styles.mjs
index 2fd789fa..26846505 100644
--- a/src/lib/admin-styles.mjs
+++ b/src/lib/admin-styles.mjs
@@ -108,6 +108,19 @@ button.primary{background:var(--accent);color:var(--on-accent);border:0;border-r
 .mcell svg{display:block;width:100%;height:30px;margin-top:9px}
 .mcell.unknown b{color:var(--faint);font-size:20px}
 
+.health{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin-top:12px}
+.hcell{border:1px solid var(--ridge);border-radius:12px;padding:15px 17px;background:var(--surface);min-width:0}
+.hcell .top{display:flex;align-items:center;gap:8px;flex-wrap:wrap}
+.hcell .pill{font-family:var(--mono);font-size:11px;letter-spacing:.03em;padding:3px 10px;border-radius:999px;border:1px solid var(--ridge);color:var(--muted)}
+.hcell .pill.ok{background:color-mix(in srgb,var(--accent-3) 16%,transparent);border-color:var(--accent-3);color:var(--accent-3)}
+.hcell .pill.bad{background:color-mix(in srgb,var(--bad) 16%,transparent);border-color:var(--bad);color:var(--bad)}
+.hcell .pill.pending{background:color-mix(in srgb,var(--accent) 16%,transparent);border-color:var(--accent);color:var(--accent)}
+.hcell b{display:block;margin-top:9px;font-family:var(--display);font-weight:600;font-size:20px;color:var(--ink)}
+.hcell.unknown b{color:var(--faint);font-size:18px}
+.hcell span{display:block;margin-top:5px;font-family:var(--mono);font-size:11px;letter-spacing:.03em;color:var(--muted);line-height:1.4}
+.hcell a{color:var(--accent-2);text-decoration:none}
+.hcell a:hover{text-decoration:underline}
+
 .since{background:var(--surface);border:1px solid var(--ridge);border-radius:14px;padding:22px 24px}
 .since .headline{font-family:var(--display);font-weight:600;font-size:1.25rem;color:var(--ink);margin:0 0 6px;line-height:1.34}
 .since .headline b{color:var(--accent)}
@@ -182,7 +195,7 @@ table.adm td.num{font-family:var(--mono)}
 .foot{margin-top:26px;padding-top:14px;border-top:1px solid var(--ridge);color:var(--faint);font-size:11.5px}
 
 @media (max-width:880px){
-  .dstrip,.mom,.reach{grid-template-columns:1fr 1fr}
+  .dstrip,.mom,.reach,.health{grid-template-columns:1fr 1fr}
   .ppl{grid-template-columns:1fr}
 }
 @media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}
diff --git a/src/lib/admin-view.mjs b/src/lib/admin-view.mjs
index beff8cf9..f16638ff 100644
--- a/src/lib/admin-view.mjs
+++ b/src/lib/admin-view.mjs
@@ -121,20 +121,17 @@ function rcell(o) {
 function renderReach(d) {
   const t = d.traffic || {};
   const trafficWhy = t.configured ? 'no data in the current 14-day window' : 'no GitHub token — traffic API needs push access';
-  const rels = Array.isArray(d.releases) ? d.releases : [];
-  const newest = rels.filter((r) => r.assets && r.assets.length)[0] || null;
-  const newestDl = newest ? newest.assets.reduce((n, a) => n + (a.downloads || 0), 0) : null;
 
   $('[data-reach]').innerHTML = [
     rcell({ hero: true, label: 'unique repo visitors', window: 'rolling 14 days · github.com',
       value: metric(t.views && t.views.uniques, trafficWhy),
       caveat: 'The only tile here that counts PEOPLE. GitHub de-duplicates by visitor — humans who opened the repo, not machines or CI.' }),
-    rcell({ label: 'bundle downloads', window: 'lifetime, all releases',
-      value: metric(d.totalAssetDownloads, 'no release data returned'),
-      caveat: 'Downloads, NOT people — GitHub exposes no unique-downloader field for assets. One machine can count many times.' }),
-    rcell({ label: newest ? 'pulled ' + newest.tag : 'newest release pulls', window: newest ? 'since ' + String(newest.publishedAt || '').slice(0, 10) : 'no published release found',
-      value: metric(newestDl, 'no assets on the newest release'),
-      caveat: 'The closest read on the ACTIVE installed base: every live machine pulls the current bundle once. An estimate of machines.' }),
+    rcell({ label: 'contributors', window: 'lifetime · merged code',
+      value: metric(d.contributorsCount, 'no contributor data returned'),
+      caveat: 'People with code in the tree, from GitHub\'s own merge history — a smaller, different circle than who filed issues or PRs.' }),
+    rcell({ label: 'watching', window: 'current · github.com subscribers',
+      value: metric(d.repo && d.repo.watchers, 'repo metadata unavailable'),
+      caveat: 'Standing interest: people who opted into notifications for every change, not a one-time visit.' }),
     rcell({ label: 'opted-in installs', window: 'lifetime · consenting machines only',
       value: metric(null, 'ak ships no opt-in counter — an honest gap, not a zero'),
       caveat: 'ak has no telemetry to count this. It renders "—" on purpose; see "Not instrumented yet" below.' }),
@@ -145,7 +142,8 @@ function renderReach(d) {
     ? '★ ' + num(stars) + ' stars · ' + num((d.repo && d.repo.forks) || 0) + ' forks'
     : 'repo metadata unavailable';
   $('[data-reach-note]').textContent = 'No counter here is a headcount, and the gap between them is the point: visitors are people, '
-    + 'bundle pulls are machines. npm downloads are excluded from this row — mirrors dominate them — and appear only in Momentum, as shape.';
+    + 'contributors and watchers are named GitHub accounts, opted-in installs would be machines. npm downloads sit out of this row on '
+    + 'purpose — see the note below the Momentum tiles.';
 }
 
 // ── momentum: 7d vs prior 7d inside each source's own series ───────────────────
@@ -175,7 +173,38 @@ function renderMomentum(d) {
     mcell('npm downloads, last 7d', momentum(npmSeries), 'var(--accent-3)', 'npm range unavailable'),
   ].join('');
   $('[data-momentum-note]').textContent = 'Left to right, each tile sits further from a human. Unique visitors are people; cloners are machines '
-    + '(ak\'s own CI among them); npm downloads are dominated by mirrors and move with release cadence, not adoption — its last day is partial.';
+    + '(ak\'s own CI among them). npm downloads appear ONLY here, as shape, never as a reach number: mirrors, CI runners, and cache warmers '
+    + 're-pull the registry as often as a real install, and npm exposes no way to tell them apart — the trend is directional, the total is not a headcount. Its last day is partial.';
+}
+
+// ── project health: latest CI run + open Dependabot alerts ────────────────────
+function ciPill(latest) {
+  if (!latest) return { cls: '', text: 'no runs found' };
+  if (latest.status !== 'completed') return { cls: 'pending', text: latest.status || 'running' };
+  if (latest.conclusion === 'success') return { cls: 'ok', text: 'passing' };
+  return { cls: 'bad', text: latest.conclusion || 'failing' };
+}
+
+function renderHealth(d) {
+  const ci = d.ci || {};
+  const latest = ci.latest;
+  const ciCell = latest
+    ? (() => {
+        const pill = ciPill(latest);
+        return '<div class="hcell"><div class="top"><span class="pill ' + pill.cls + '">' + esc(pill.text) + '</span>'
+          + '<span>' + esc(latest.name || 'workflow') + '</span></div>'
+          + '<b><a href="' + safeUrl(latest.url) + '" target="_blank" rel="noopener">' + esc(agoLabel(latest.at)) + '</a></b>'
+          + '<span>latest CI run' + (Number.isFinite(ci.recentFailures) ? ' · ' + ci.recentFailures + '/' + ci.recentTotal + ' of the last ' + ci.recentTotal + ' failed' : '') + '</span></div>';
+      })()
+    : '<div class="hcell unknown"><b>—</b><span>latest CI run</span><span>no workflow runs found (Actions unused, or the token can\'t read them)</span></div>';
+
+  const alerts = metric(d.security && d.security.dependabotAlerts, 'no Dependabot permission (needs a token with security_events scope) or Dependabot not enabled');
+  const alertsCell = alerts.known
+    ? '<div class="hcell"><div class="top"><span class="pill ' + (alerts.v > 0 ? 'bad' : 'ok') + '">' + (alerts.v > 0 ? 'open' : 'clear') + '</span>'
+      + '<span>security</span></div><b>' + num(alerts.v) + '</b><span>open Dependabot alert' + (alerts.v === 1 ? '' : 's') + '</span></div>'
+    : '<div class="hcell unknown"><b>—</b><span>open Dependabot alerts</span><span>' + esc(alerts.why) + '</span></div>';
+
+  $('[data-health]').innerHTML = ciCell + alertsCell;
 }
 
 // ── since you last looked: cumulative deltas only (Rule 2) ────────────────────
@@ -310,6 +339,7 @@ function renderGaps(d) {
   const out = [];
   const t = d.traffic || {};
   if (!t.configured) out.push(['config', 'Clones, views, and referrers are dark.', 'No GITHUB_TOKEN / GH_TOKEN / gh auth token with push access resolved. Every traffic panel says so rather than showing 0.']);
+  out.push(['design', 'npm download counts, shown as trend only — never as a reach number.', 'Mirrors, CI runners, and cache warmers hit the npm registry as often as a real install, and api.npmjs.org has no field to tell them apart. The daily series still moves with real release cadence, so Momentum uses it for shape (up/down) — but no absolute npm total appears as "how many people," because that would overstate reach.']);
   if (d.repo && d.repo.stars > 0 && !((d.people && d.people.stargazers) || []).length) out.push(['config', 'The ' + num(d.repo.stars) + ' stargazers are counted but unnamed.', 'GET /stargazers answers 401 without a token — the count is public, the list is not.']);
   out.push(['code', 'Opt-in install / search telemetry.', 'ak ships no phone-home counter, so "opted-in installs" reads "—". Building one is a code change, not a config toggle — hence a gap, never a fabricated zero.']);
   out.push(['code', 'The actual words people wrote.', 'The collector maps each thread to {number,title,state,isPR,url,at} and drops comment bodies, reactions, and sentiment. This page proves a conversation happened and links to it — it does not quote or score it.']);
@@ -340,6 +370,7 @@ function render(d) {
   renderPeople(d, s, base);
   renderFeed(s, since.newIds);
   renderMomentum(d);
+  renderHealth(d);
   renderReferrers(d);
   renderGaps(d);
   renderDoors(d);
diff --git a/tests/admin.test.cjs b/tests/admin.test.cjs
index 523cabc4..4ce4d640 100644
--- a/tests/admin.test.cjs
+++ b/tests/admin.test.cjs
@@ -75,6 +75,14 @@ function ghFixtures(url) {
   }
   if (/\/repos\/pacphi\/agentic-kit\/stargazers/.test(url)) return { body: [{ login: 'carol' }, { login: 'pacphi' }] };
   if (/\/repos\/pacphi\/agentic-kit\/forks/.test(url)) return { body: [{ owner: { login: 'dave' }, created_at: '2026-04-01T00:00:00Z' }] };
+  if (/\/repos\/pacphi\/agentic-kit\/contributors/.test(url)) return { body: [{ login: 'pacphi' }, { login: 'alice' }, { login: 'bob' }] };
+  if (/\/repos\/pacphi\/agentic-kit\/actions\/runs/.test(url)) {
+    return { body: { workflow_runs: [
+      { name: 'ci', status: 'completed', conclusion: 'success', created_at: '2026-07-27T00:00:00Z', html_url: 'https://github.com/pacphi/agentic-kit/actions/runs/1' },
+      { name: 'ci', status: 'completed', conclusion: 'failure', created_at: '2026-07-26T00:00:00Z', html_url: 'https://github.com/pacphi/agentic-kit/actions/runs/2' },
+    ] } };
+  }
+  if (/\/repos\/pacphi\/agentic-kit\/dependabot\/alerts/.test(url)) return { body: [{ number: 1 }, { number: 2 }] };
   if (/\/repos\/pacphi\/agentic-kit$/.test(url)) return { body: { stargazers_count: 20, forks_count: 4, subscribers_count: 3, open_issues_count: 2 } };
   if (/api\.npmjs\.org/.test(url)) return { body: { downloads: Array.from({ length: 30 }, (_, i) => ({ day: '2026-01-' + String(i + 1).padStart(2, '0'), downloads: i + 1 })) } };
   return { ok: false, status: 404, body: null };
@@ -150,6 +158,23 @@ async function main() {
 
     // feedback doors built from slug, never network
     assert(d.feedback.issues.includes('pacphi/agentic-kit') && d.feedback.discussions.includes('pacphi/agentic-kit'), 'doors from slug');
+
+    // contributors: owner included here (GitHub's own contributor list, unlike people.*)
+    eq(d.contributorsCount, 3);
+
+    // ci: latest run + failure count over the fetched page
+    eq(d.ci.latest.conclusion, 'success');
+    eq(d.ci.latest.name, 'ci');
+    eq(d.ci.recentFailures, 1);
+    eq(d.ci.recentTotal, 2);
+
+    // security: open Dependabot alert count
+    eq(d.security.dependabotAlerts, 2);
+
+    // releases fetch requests the full 100-per-page ceiling, not the old 20 cap
+    // that silently dropped this repo's older releases (verified live: 29 exist)
+    const releasesCall = fetchImpl.calls.find((u) => /\/releases\?/.test(u));
+    assert(releasesCall && releasesCall.includes('per_page=100'), 'releases must be fetched at per_page=100, got: ' + releasesCall);
   });
 
   await test('collectAdminStats URL-encodes a scoped npm package name (AC-3)', async () => {
@@ -201,6 +226,26 @@ async function main() {
     eq(JSON.stringify(d.people.stargazers), '[]');
   });
 
+  await test('dependabot alerts 403 (no security_events scope) degrades to unknown, never a fabricated 0', async () => {
+    const fetchImpl = mkFetch((url) => (/dependabot\/alerts/.test(url) ? { ok: false, status: 403, body: null } : ghFixtures(url)));
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    eq(d.security.dependabotAlerts, null);
+  });
+
+  await test('no workflow runs found → ci.latest null, not a fabricated "passing"', async () => {
+    const fetchImpl = mkFetch((url) => (/actions\/runs/.test(url) ? { body: { workflow_runs: [] } } : ghFixtures(url)));
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    eq(d.ci.latest, null);
+    eq(d.ci.recentFailures, null);
+  });
+
+  await test('contributors fetch failing nulls contributorsCount, siblings unaffected', async () => {
+    const fetchImpl = mkFetch((url) => (/contributors/.test(url) ? new Error('boom') : ghFixtures(url)));
+    const d = await C.collectAdminStats({ fetchImpl, ghToken: 'tok', repoSlug: 'pacphi/agentic-kit', npmPkg: 'agentic-kit' });
+    eq(d.contributorsCount, null);
+    assert(d.repo && d.repo.stars === 20, 'the repo block is unaffected by a contributors failure');
+  });
+
   // ── NFR-3 — the credential NEVER appears in the payload or any error note ────
   const FAKE_TOKEN = 'ghp_FAKE_SECRET_do_not_leak_0123456789abcdef';
   await test('NFR-3: a real collect with a credential set never echoes it into the payload', async () => {
@@ -223,7 +268,7 @@ async function main() {
   });
 
   // ── admin-server: auth (AC-1), loopback + CSP + self-contained (AC-5) ────────
-  const FIXTURE_PAYLOAD = { generatedAt: '2026-07-24T00:00:00Z', repoSlug: 'pacphi/agentic-kit', repo: { stars: 20, forks: 4, watchers: 3, openIssues: 2 }, releases: [], totalAssetDownloads: 0, traffic: { configured: false, note: 'no token', clones: null, views: null, referrers: null }, npm: null, people: { externalEngagers: 0, totalIssues: 0, totalPRs: 0, contributors: [], stargazers: [], forks: [] }, feedback: { issues: 'x', discussions: 'y' } };
+  const FIXTURE_PAYLOAD = { generatedAt: '2026-07-24T00:00:00Z', repoSlug: 'pacphi/agentic-kit', repo: { stars: 20, forks: 4, watchers: 3, openIssues: 2 }, releases: [], totalAssetDownloads: 0, traffic: { configured: false, note: 'no token', clones: null, views: null, referrers: null }, npm: null, people: { externalEngagers: 0, totalIssues: 0, totalPRs: 0, contributors: [], stargazers: [], forks: [] }, contributorsCount: 3, ci: { latest: null, recentFailures: null, recentTotal: null }, security: { dependabotAlerts: 0 }, feedback: { issues: 'x', discussions: 'y' } };
 
   const admin = await S.startAdmin({ port: 0, collect: async () => FIXTURE_PAYLOAD });
   try {

From b348b20c9ba0abb6f518185c792e9ebd258b2f2e Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Tue, 28 Jul 2026 11:10:22 -0700
Subject: [PATCH 2/2] fix(admin): exclude owner/bots from contributorsCount,
 link stargazer names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The new "contributors" Reach tile counted GitHub's raw contributor list
verbatim, including the repo owner and dependabot[bot] — inconsistent
with buildPeople(), which already excludes both from contributors/
stargazers/forks elsewhere in this file. Verified live: contributorsCount
was reporting 3 (pacphi + dependabot[bot] + one real external
contributor) when the honest count is 1.

Also makes the 20 unnamed-but-dated-stargazer names clickable GitHub
profile links, matching every other person-card on the page instead of
rendering as plain "@login" text.
---
 src/lib/admin-collect.mjs |  8 +++++++-
 src/lib/admin-view.mjs    | 11 ++++++-----
 tests/admin.test.cjs      | 10 +++++++---
 3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/src/lib/admin-collect.mjs b/src/lib/admin-collect.mjs
index 45ef378c..35f9d1c7 100644
--- a/src/lib/admin-collect.mjs
+++ b/src/lib/admin-collect.mjs
@@ -10,6 +10,7 @@
 // network-free (NFR-6).
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { isBot } from './admin-model.mjs';
 
 const execFileP = promisify(execFile);
 
@@ -130,7 +131,12 @@ export async function collectAdminStats({ fetchImpl = fetch, ghToken = '', repoS
     },
     npm: npmToBlock(npmRaw),
     people: buildPeople(issuesRaw, starsRaw, forksRaw, owner),
-    contributorsCount: Array.isArray(contributorsRaw) ? contributorsRaw.length : null,
+    // Owner + bots excluded, same discipline buildPeople already applies to
+    // contributors/stargazers/forks below — GitHub's raw contributor list
+    // otherwise counts the repo owner and dependabot[bot]/similar as "people".
+    contributorsCount: Array.isArray(contributorsRaw)
+      ? contributorsRaw.filter((c) => c.login && c.login !== owner && !isBot(c.login)).length
+      : null,
     ci: buildCi(runsRaw),
     security: { dependabotAlerts: Array.isArray(alertsRaw) ? alertsRaw.length : null },
     feedback: doors(repoSlug),
diff --git a/src/lib/admin-view.mjs b/src/lib/admin-view.mjs
index f16638ff..8b6bf5c9 100644
--- a/src/lib/admin-view.mjs
+++ b/src/lib/admin-view.mjs
@@ -274,14 +274,15 @@ function renderPeople(d, s, base) {
     starNote = num(stars) + ' stars exist, but GitHub returns the stargazer list only to an authenticated caller — set GITHUB_TOKEN to see who. '
       + 'Their absence here is a missing credential, not a missing person.';
   } else if (namedStars.length) {
-    // Built UNESCAPED — the sink esc()'s the whole starNote once (single-escape at
-    // the sink, the house rule; the logins were being double-escaped otherwise).
+    // Built pre-escaped, matching the pcard links below: each login is esc()'d at
+    // the point it's interpolated into an <a>, so the sink inserts starNote raw
+    // rather than escaping it again (that would turn the anchors into literal text).
     starNote = 'Plus ' + namedStars.length + ' stargazer' + (namedStars.length === 1 ? '' : 's') + ' with no dated activity: '
-      + namedStars.slice(0, 20).map((l) => '@' + l).join(', ') + '.';
+      + namedStars.slice(0, 20).map((l) => '<a href="https://github.com/' + esc(l) + '" target="_blank" rel="noopener">@' + esc(l) + '</a>').join(', ') + '.';
   }
   qual.textContent = known + ' named · bots excluded' + (s.botItems ? ' (' + s.botItems + ' bot items hidden)' : '');
   if (!known) {
-    host.innerHTML = '<div class="inbox-zero ridge">No external humans have filed an issue, opened a PR, or forked yet.' + (starNote ? ' ' + esc(starNote) : '') + '</div>';
+    host.innerHTML = '<div class="inbox-zero ridge">No external humans have filed an issue, opened a PR, or forked yet.' + (starNote ? ' ' + starNote : '') + '</div>';
     return;
   }
   host.innerHTML = '<div class="ppl">' + s.people.map((p) => {
@@ -298,7 +299,7 @@ function renderPeople(d, s, base) {
     if (p.forked) counts.push('forked');
     return '<div class="pcard' + (recent ? ' active' : '') + '"><div class="who"><a href="https://github.com/' + esc(p.login) + '" target="_blank" rel="noopener">@' + esc(p.login) + '</a>' + badges + '</div>'
       + '<p class="span">' + esc(counts.join(' · ') || 'engaged') + '<br>last seen ' + esc(agoLabel(p.last)) + ' · first seen ' + esc(agoLabel(p.first)) + '</p></div>';
-  }).join('') + '</div>' + (starNote ? '<p class="note">' + esc(starNote) + '</p>' : '');
+  }).join('') + '</div>' + (starNote ? '<p class="note">' + starNote + '</p>' : '');
 }
 
 function renderFeed(s, newIds) {
diff --git a/tests/admin.test.cjs b/tests/admin.test.cjs
index 4ce4d640..d49df0aa 100644
--- a/tests/admin.test.cjs
+++ b/tests/admin.test.cjs
@@ -75,7 +75,7 @@ function ghFixtures(url) {
   }
   if (/\/repos\/pacphi\/agentic-kit\/stargazers/.test(url)) return { body: [{ login: 'carol' }, { login: 'pacphi' }] };
   if (/\/repos\/pacphi\/agentic-kit\/forks/.test(url)) return { body: [{ owner: { login: 'dave' }, created_at: '2026-04-01T00:00:00Z' }] };
-  if (/\/repos\/pacphi\/agentic-kit\/contributors/.test(url)) return { body: [{ login: 'pacphi' }, { login: 'alice' }, { login: 'bob' }] };
+  if (/\/repos\/pacphi\/agentic-kit\/contributors/.test(url)) return { body: [{ login: 'pacphi' }, { login: 'alice' }, { login: 'bob' }, { login: 'dependabot[bot]' }] };
   if (/\/repos\/pacphi\/agentic-kit\/actions\/runs/.test(url)) {
     return { body: { workflow_runs: [
       { name: 'ci', status: 'completed', conclusion: 'success', created_at: '2026-07-27T00:00:00Z', html_url: 'https://github.com/pacphi/agentic-kit/actions/runs/1' },
@@ -159,8 +159,9 @@ async function main() {
     // feedback doors built from slug, never network
     assert(d.feedback.issues.includes('pacphi/agentic-kit') && d.feedback.discussions.includes('pacphi/agentic-kit'), 'doors from slug');
 
-    // contributors: owner included here (GitHub's own contributor list, unlike people.*)
-    eq(d.contributorsCount, 3);
+    // contributors: owner AND bots excluded, same discipline as people.contributors below
+    // (fixture carries pacphi + dependabot[bot] alongside alice/bob to prove both filters)
+    eq(d.contributorsCount, 2);
 
     // ci: latest run + failure count over the fetched page
     eq(d.ci.latest.conclusion, 'success');
@@ -295,6 +296,9 @@ async function main() {
       assert(r.body.includes('x-admin-token'), 'the client sends the admin token header');
       // the model import line must have been stripped (no bare module fetch)
       assert(!/from ['"]\.\/admin-model\.mjs['"]/.test(r.body), 'model import must be stripped at serve');
+      // stargazer names render as real profile links, not plain "@login" text
+      // (admin-view.mjs is embedded/not node-tested per ADR-0007 §5 — source presence only)
+      assert(r.body.includes('https://github.com/\' + esc(l)'), 'named stargazers must link to their GitHub profile');
     });
 
     await test('admin uses the dashboard theme contract without adding browser dependencies', async () => {