Maturity Map

Maturity map — Silver, Gold, OSPS Baseline

An honest mapping of this project against the higher OpenSSF tiers (Best Practices Silver and Gold) and the OSPS Baseline (L1/L2/L3). The passing-level page covers the entry badge; this page adds the tiers above it, and — the point of the page — states plainly the criteria a solo, AI-assisted project structurally cannot meet, so nothing is implied-met.

Three buckets per criterion: Met (with evidence), Planned (tracked issue), Structurally N/A (a one-maintainer AI-assisted project cannot meet it; the honest disposition and compensating controls are named).

Read this first — who reviews the code

Human review here is single-maintainer + AI-assisted. The four accounts in .github/CODEOWNERS are the maintainer's own team, not independent auditors — the file says so, and this page repeats it because a badge assessor scanning CODEOWNERS could otherwise misread it as multi-person independent review. There is one person with authority (GOVERNANCE.md). Every criterion below that assumes ≥2 independent humans is dispositioned as Structurally N/A, with the compensating controls named — never quietly checked.

Structurally N/A (one-maintainer, AI-assisted — cannot be met by design)

Tier	Criterion	Why N/A	Compensating controls
Gold	bus_factor — "a bus factor of 2 or more"	One maintainer	Everything to build/test/release is in-repo (reproducible CI, documented pipeline, no private build secrets); GPL-3.0 guarantees the community can fork and continue (this project is such a continuation of the archived 9p4); intent to archive-with-notice rather than go silently stale — see GOVERNANCE.md § Continuity
Gold	contributors_unassociated — "at least two unassociated significant contributors"	Solo project	Same as above; the fork path keeps the project continuable by others
Gold	two_person_review — "≥50% of proposed modifications reviewed before release by a person other than the author"	Single author; the CODEOWNERS accounts are the maintainer's own AI-assisted team, not independent reviewers	The adversarial multi-lens /security-review (independent refute-by-default lenses on every security-touching change — see Review Gate), mutation testing, SAST (CodeQL + the Opengrep invariant ruleset), warnings-as-errors build, and SLSA v1.1 Build L3 provenance stand in for a second human
OSPS Baseline L3	OSPS-QA-07.01 — non-author approval before merge	Same as two_person_review	Same compensating controls; the merge gate is CI + the adversarial lens review + the maintainer
OSPS Baseline L2/L3	OSPS-AC-03.01 — no admin bypass of required checks	Admin-merge is currently used to land on green during the internal gate	Tracked as a hardening item in #715 (remove the admin always-bypass, require all gating checks) — not claimed met here

These are disclosed, not worked around. A one-person project has a real bus factor of one; the mitigations reduce the continuity risk, they do not manufacture a second reviewer.

Met (evidence in-repo)

• Crypto — TLS-only fetches; AES-256-GCM secrets at rest; no weak-primitive acceptance (SHA-1 XML-DSig rejected). (Security Model)
• Signed, provenance-bearing releases — SLSA v1.1 Build L3 attestation + MD5/SHA-256 sidecars on every stable release. (SECURITY.md)
• Supply chain — SHA-pinned Actions (zizmor-audited), Scorecard weekly, Dependabot (both ecosystems), dependency-review at fail-on-severity: low + transitive scan, locked-mode restore. (Review Gate)
• Static analysis applied and gating — CodeQL (security-extended) + the Opengrep invariant ruleset + --warnaserror. (Review Gate)
• Documented governance, support, privacy and CRA position — GOVERNANCE.md, SECURITY.md (support window + CRA), docs/PRIVACY.md, docs/SECURITY-REMEDIATION-POLICY.md.
• Coordinated vulnerability handling — private advisory flow.
• Unique version control + immutable, single-use release tags.

Planned (tracked)

Area	Criterion	Issue
Test coverage	test_statement_coverage90 / test_branch_coverage80 (Gold)	#718, #713
Reproducible build	build_reproducible (Gold)	#764
SBOM	CycloneDX per release (OSPS-QA-02.02)	#729
VEX	OpenVEX for triaged/non-exploitable findings	#763
Per-file licensing	SPDX + copyright headers	#747
Sign-off	DCO with automated check	#746
Required-check hardening	remove admin bypass	#715
Badge completion	Silver/Gold questionnaire fill	OpenSSF project 13660

Maintenance

Keep this map true: when a control lands or an issue closes, move the row. Never promote a Structurally N/A row to Met without an actual second independent human — the honesty of this page is its whole value.