Which has better activity and maintenance signals?

Based on the RepoPilot analysis and repository signals provided:

julien-cpsn/atac shows concerning maintenance signals:

• Verdict: WAIT — Single-maintainer risk — this is a direct flag from the architecture analysis
• OpenSSF Scorecard: 4.9/10 (weak across Security-Policy, SAST, and Branch-Protection)
• No SAST/code scanning alerts configured (0/0)
• 1 moderate CVE in a transitive dependency (RUSTSEC-2025-0141 in bincode)
• GitHub activity shows CI/CD present (Rust workflows), but the single-maintainer risk suggests limited oversight

openai/codex signals better maintenance practices:

• The AGENTS.md document explicitly describes development workflows, schema validation processes, and testing standards [AGENTS.md:L298-L309], indicating documented practices
• References to regeneration tooling (just write-app-server-schema, just test) suggest automated guardrails
• Development conventions documented for TUI code [AGENTS.md:L137-L145] and Python practices [AGENTS.md:L308-L309]
• More complex organizational structure (multiple codex-rs subdirectories) suggests team-scale maintenance

Summary: openai/codex appears better maintained — it has documented development workflows and testing infrastructure. julien-cpsn/atac carries explicit single-maintainer risk and lower security scorecard ratings, making it riskier to depend on long-term.

FOLLOW_UPS:

• What are atac's 8 circular dependency chains?
• Does codex have security advisories or CVEs listed?
• How many contributors does each project have?