Document OpenSSF Gold remediation evidence

[kriptoburak]

Summary

• inventory 19 public repositories and 17 standalone badge entries
• record all 19 repository and shared-site remediation pull requests
• record the July 24 live badge and pre-existing PR audit
• distinguish passing implementation checks from merged evidence
• record the README and repository metadata audit
• document the verified human-only Gold blockers
• codify current GitHub SEO and AI discoverability review rules
• prohibit keyword stuffing, query permutations, prompt injection, and unsupported claims

Primary Guidance

• GitHub README and repository topic documentation
• Google generative AI search guidance and spam policies
• Bing Webmaster Guidelines for search and grounding

Verification

• node scripts/check-public-contract.mjs
• git diff --check
• simplify review
• security review
• thermo-nuclear maintainability review

The organization review policy requires approval from a different human before merge.

Note

Document OpenSSF Gold remediation evidence and enforce discoverability policy checks

• Adds several new documents: ASSURANCE.md (security architecture and threat model), RELEASES.md (release integrity and verification guide), and DISCOVERY.md (README and answer-engine policy).
• Expands OPENSSF.md with a July 2026 audit snapshot, verified controls, known Gold gaps, and links to the new documents.
• Extends check-public-contract.mjs to validate README structure (H1 count/length, H2 count, task-oriented headings, code examples, vague link text) and repository metadata (description length, topics, homepage URL).
• Adds a checkRepoDiscovery validator that requires descriptions to be 70–200 chars, include an independence notice, and have 5–20 topics including xquik and at least one customer-intent topic.
• Risk: repositories that previously passed the public-contract check may now fail due to the new README and metadata requirements.

^{Macroscope summarized 8963b88.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[kriptoburak]

Live badge records were refreshed on 2026-07-24.

• All 17 entries now explicitly mark bus factor, two unassociated significant contributors, independent review of 50% of released changes, and a qualifying five-year human security review as Unmet.
• Each entry includes dated remediation guidance.
• The public JSON API confirms Passing 100%, Silver 9%, and Gold 13% for 15 entries.
• n8n-nodes-xquik and x-twitter-scraper report Gold 26%.
• OPENSSF.md records these live values in commit 32e6701.

The contract checker still matches all 19 public repositories, 127 REST routes, 119 MCP tools, and 118 JSON/text operations.

[kriptoburak]

July 24 OpenSSF evidence update

The live badge entries now have complete Silver and Gold assessments.

• 17 Passing tiers remain at 100%.
• 17 Silver tiers now report 84%.
• 15 Gold tiers report 30%.
• 2 Gold tiers report 43%.
• All 55 Silver and 23 Gold fields are classified.
• No Silver or Gold answer remains unknown.
• Required Silver explanations and evidence URLs are complete.
• Every Unmet Silver answer includes a public explanation.

ASSURANCE.md now records the shared architecture, trust boundaries, threats, secure-design argument, CWE countermeasures, residual risks, and pending evidence.

Authenticated contract verification passed:

Checked 19 public repositories. Contracts match 127 REST, 119 MCP, and 118 JSON/text operations.

This evidence does not treat pending branches as default-branch proof. Human continuity, contributor, review, and security-review requirements remain explicitly Unmet.

[kriptoburak]

Gold small_tasks evidence

Each of the 17 standalone projects now has one scoped open task.

Every task has good first issue and help wanted labels.

Public bestpractices.dev readback confirms:

• small_tasks_status is Met on all 17 entries.
• Every badge justification contains its matching issue URL.
• 15 Gold tiers now report 35%.
• n8n and core now report 48%.

Commit 7af105f adds the complete issue index and checks its required policy text.

[kriptoburak]

Verified the published RubyGems artifact independently. The RubyGems Sigstore bundle digest matches x-twitter-scraper-0.5.4.gem, and sigstore-cli validates the Xquik-dev publish workflow identity and transparency proof. Commit a129c32 records the exact consumer verification command and SHA-256 digest. All required checks pass on this head.

[kriptoburak]

Ledger update ce43b29 records the verified Java and Kotlin Maven Central releases. Fourteen projects now have public signed artifacts; C#, Go, and PHP remain. Consumer verification passed in Java run 30076440647 and Kotlin run 30076440671. The public contract checker still matches all 19 repositories: 127 REST routes, 119 MCP tools, and 118 JSON/text operations. This update also records the newly opened independent Haystack contribution and its current post-push review blocker.

[kriptoburak]

Cryptographic 2FA evidence is now recorded in acc13ce. Signed-in GitHub settings verified 2FA enabled, a configured passkey selected as the preferred method, an authenticator app configured, and SMS not configured. The public bestpractices.dev API independently confirms secure_2FA=Met and repo_distributed=Met for all 17 entries. Passing remains 100%, Silver remains 84%, and Gold remains 35% for 15 entries plus 48% for n8n and core because secure_2FA is a SHOULD criterion. The contract checker still matches 19 repositories, 127 REST routes, 119 MCP tools, and 118 JSON/text operations.

[kriptoburak]

Forward tag-signing policy added in 78796a4. Future major, minor, and vulnerability-fix tags must use a GitHub-verified signing key and pass local verification before push. The policy forbids replacing or force-pushing published tags. Historical unsigned tags remain untouched, and version_tags_signed remains Unmet until important public tags verify.

[kriptoburak]

Release-tag immutability evidence added in 5f4a137. All 17 standalone projects have active v* tag rulesets blocking deletion and non-fast-forward updates. Terraform also limits creation to its approved release actor. These controls preserve published tag identity without misrepresenting unsigned tags as signed.

[kriptoburak]

Maintainer readiness check: a local-only annotated tag signed with the GitHub-registered SSH signing key passed git verify-tag, then the temporary local ref was deleted. Nothing was pushed or released. This proves the forward procedure is operable, but it is not public release evidence; version_tags_signed remains Unmet.

[kriptoburak]

Organization API verification also confirms two_factor_requirement_enabled=true and the default repository permission is read. This supports the required-2FA control and preserves least-privilege defaults. No membership or permission setting was changed.

[kriptoburak]

SEO and answer-engine maintenance evidence, 2026-07-24:

• Every public repository now includes the xquik discovery topic.
• All 19 descriptions remain specific, 94-185 characters, and end with the compact independence notice.
• Topic sets remain accurate and repository-specific, with 14-20 topics each.
• Commit 675c587 extends the organization-wide contract check to guard README titles, task-oriented sections, copyable examples, descriptive links, image alternative text, HTTPS homepages, concise descriptions, branded discovery, customer-intent topics, and the 20-topic limit.
• The check requires useful structure and accurate terms. It does not require keyword lists or repeated questions.
• Local validation passed for all 19 repositories and still matches 127 REST operations, 119 MCP routes, and 118 JSON/text operations.

This records ongoing GitHub SEO, LLM answerability, and GEO hygiene without treating repetition as optimization.

[kriptoburak]

Discovery & Answer-Engine Update

Commit 2b59c1c adds repository-specific README guidance for choosing this surface and finding supported customer tasks. It avoids query permutations, unsupported comparisons, and keyword stuffing.

Research and review rules are recorded in the organization discovery policy. This commit adds the organization discovery policy and enforces its anti-spam and answer-engine requirements. The public contract checker passed across 19 repositories with 127 REST, 119 MCP, and 118 JSON/text operations.

Hosted checks are rerunning. A different human approval remains required before merge.

[furkanerday]

Changes requested for two evidence defects:

1. CONTRIBUTING.md:42-52 requires DCO sign-off for every non-trivial contribution, but commit 32e67013cb044ad163de228c61e248dcdc6377b3 has no Signed-off-by: trailer. Amend and re-push that commit with a valid author sign-off.

2. OPENSSF.md:181-184 presents post-push approval as the remaining blocker for Haystack #6. Its contributor commit faf5d270 also lacks the required DCO sign-off. The contributor must amend and re-push that commit, and this audit text must record the DCO blocker accurately.

The required check is green and I found no unresolved review threads, but the evidence cannot be approved while these DCO and accuracy issues remain.

[kriptoburak]

Addressed the requested changes.

• Rewrote the maintainer commit as signed-off commit 5871cf1.
• Every current PR commit now has an author-matching DCO trailer.
• Commit 8963b88 records Haystack contributor commit faf5d270 as blocked on DCO.
• I did not modify or sign the contributor-owned commit.
• git diff --check passed.
• The public-contract check passed across all 19 repositories.

Re-requesting independent review.

[furkanerday]

Re-reviewed the updated head. The previously unsigned maintainer commit was rewritten with an author-matching DCO trailer, and OPENSSF.md now accurately records Haystack #6’s missing contributor sign-off and required amend/re-push. The incremental diff, current commit history, updated conversation, required check, and unresolved-thread state are clean; no actionable blocker remains.