The repository's ranked supply-chain risk report (sole_owner_critical / new_in_high_impact / unsigned_in_sensitive / ai_unverified_in_blast_radius) with per-finding evidence + remedy, sliced from the promoted graph.json.

Names risk on specific components, but it is derived from git authorship of the same repo the caller already reads (emails scrubbed, handle-only), so gated at REPOS_READ like the summary + the graph itself -- any repo reader, including a plain member, may see it. (It is a code-ownership surface, not a billing/PII one, so it does not warrant the AUDIT_READ audit-log tier.) Behind contributors_enabled (404 when off). audit is null when the index carries no overlay.