v1.3.11

• OpenSecOps awarded the OpenSSF Best Practices Passing-level badge (project
  entry
  bestpractices.dev/projects/12827).
  README.md carries the badge at the top; docs/security/supply-chain.md §13
  intake-checklist crosswalk gains a corresponding row stating the level
  achieved, the project URL, and the controls the attestation covers.

Full Changelog: v1.3.10...v1.3.11

v1.3.10

• docs/security/supply-chain.md §7 gains §7.1 "Development environment
  posture" — names the controls operating on the cathedral / maintainer-laptop
  release environment: workstation controls (FileVault, automatic screen lock,
  automatic OS updates, password manager with maximum-entropy random passwords),
  identity controls (hardware-bound passkey MFA on every release-signing
  identity, OpenSecOps-Org organisation-wide MFA enforcement, branch
  protection on main re-verified weekly by OpenSSF Scorecard), what the
  cathedral model removes from the threat surface (no long-lived signing keys,
  no CI release path, no external committers), and what is logged for audit
  (Sigstore Rekor public transparency log, GitHub organisation audit log,
  Scorecard SARIF). Closes with a "future expansion contingent on client
  requirement" paragraph stating CI/CD-anchored controls (SLSA Build L2 in
  particular, plus any S2C2F or SSDF item presuming a hosted build platform)
  will be considered if a specific enterprise customer requires them. ToC and
  §13 intake-checklist crosswalk updated.

Full Changelog: v1.3.9...v1.3.10

v1.3.9

• docs/security/supply-chain.md §1: rewrote the converted-set listing to name
  all 24 OpenSecOps components alphabetically, and replaced the Python-only
  conversion-artefact list with a two-shape description (Python-bearing
  components carry requirements.in/requirements.txt/SBOM/provenance;
  libraryless components emit a deterministic git archive HEAD source tarball
  plus a SLSA Build L1 in-toto provenance document, all Sigstore-signed
  identically). Reflects the steady-state where every component publishes
  through the same ./publish toolchain.

Full Changelog: v1.3.8...v1.3.9

v1.3.8

• Releases of this repository are now Sigstore-signed. Each GitHub Release ships
  four assets: the git archive HEAD source tarball, a SLSA Build L1 in-toto
  provenance document attesting to it, and Sigstore .bundle signatures for
  each. Customers downloading the docs can verify the bytes against the
  OpenSecOps signing identity using the recipe in
  docs/security/supply-chain.md §9.3.

Full Changelog: v1.3.7...v1.3.8

v1.1.2

• Updated screen shots, links to OpenSecOps on GitHub, and corrected a few typos.

Full Changelog: v1.1.1...v1.1.2

v1.1.1

• Adjustments and removal of obsolete information.

Full Changelog: v1.1.0...v1.1.1