docs(releases): record security dispositions and pre-1.0 status

Document the reviewed Scorecard process findings and their reassessment dates. Keep draft standards and response commitments separate from the 0.1.0 bundle release.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

CHANGELOG.md

@@ -1,4 +1,3 @@
 # Changelog
 
-Release Please maintains this file from Conventional Commits. No standards bundle
-has been published yet; the first release proposal will be `0.1.0`.
+Release Please maintains this file from Conventional Commits.

README.md

@@ -11,7 +11,7 @@ reusable GitHub Actions workflows, repository templates, and a conformance check
 
 ## Status
 
-> **Draft, before the first release (`v1.0.0`).** The requirements are written and the
+> **Draft standards, before `v1.0.0`.** The requirements are written and the
 > enforcement tooling exists, but no KofTwentyTwo repository has been verified against
 > them yet; adoption starts with this repository, then
 > [AppKit](https://github.com/KofTwentyTwo/AppKit) and
@@ -308,7 +308,6 @@ Download a versioned ZIP or tar.gz standards bundle from
 the repository layout, include checksums and provenance attestations, and become
 immutable on publication. See [bundle releases](docs/releases.md) for semantic version
 proposals, maintainer setup, publishing, verification, and local reproduction.
-The first bundle has not been published yet.
 
 - This repository is versioned with [Semantic Versioning](https://semver.org). A new
   **MUST** that existing repositories do not meet is a MAJOR release; read its release

SECURITY.md

@@ -17,7 +17,7 @@ conformance check that passes when it should fail.
 | Fix released | Critical 7 days, High 30 days, Medium 90 days, Low next release, from confirmation |
 | Public disclosure | coordinated with the reporter; by default 90 days after the report, sooner once fixed |
 
-Until this repository's first release (`v1.0.0`) these timeframes are targets the
+Before `v1.0.0` these timeframes are targets the
 maintainer works to; from `v1.0.0` they are commitments.
 
 Fixed vulnerabilities are published as GitHub Security Advisories with a CVE. These

docs/releases.md

@@ -12,8 +12,8 @@ or copy its configs and templates into another repository.
 
 [Release Please](https://github.com/googleapis/release-please) opens and updates a
 release PR after successful `main` CI, changing `version.txt`, `CHANGELOG.md`, and
-`.release-please-manifest.json`. The first proposal is `0.1.0`; `0.0.0` currently means
-unreleased. The tag is the published version's authority; the files are checked
+`.release-please-manifest.json`. The first proposal is `0.1.0`; `0.0.0` is the
+unreleased bootstrap placeholder. The tag is the published version's authority; the files are checked
 against it before packaging.
 
 | Commit or squash PR title | Bump | Example |

docs/security/scorecard-dispositions.md

@@ -0,0 +1,22 @@
+# Scorecard finding dispositions
+
+Reviewed on 2026-10-10 for the v0.1.0 release. These are repository-process
+heuristics, not identified vulnerabilities in shipped code or dependencies.
+Static review inspected the reported main revision, current rulesets, the security
+policy, and EX-0001. It does not establish an independent human review of historical
+changes or predict future maintenance.
+
+| Alert | Disposition and evidence | Reassess |
+| --- | --- | --- |
+| [#4 Code-Review](https://github.com/KofTwentyTwo/standards/security/code-scanning/4) | Accepted single-maintainer risk under [EX-0001](../../exceptions/register.md#ex-0001). Outside contributors cannot merge; PR checks, AI review, CodeQL, signed commits, and maintainer merge remain required. Scorecard counts human approvals, so it does not represent these compensating controls. | 2027-01-10, or when a second maintainer joins |
+| [#3 Maintained](https://github.com/KofTwentyTwo/standards/security/code-scanning/3) | Age heuristic: GitHub reports creation on 2026-10-09, with recent feature PRs and active CI. The message identifies a repository younger than 90 days, rather than abandoned shipped software. | 2027-01-10 |
+| [#1 Branch-Protection](https://github.com/KofTwentyTwo/standards/security/code-scanning/1) | Accepted human-approval gap under EX-0001. Active `protect-main` has no bypass and enforces PR-only squash merges, nine required checks, signed commits, linear history, and resolved threads. Human approval by another maintainer is unavailable. | 2027-01-10, or when a second maintainer joins |
+
+Keep the accepted risk visible; dismissal is not a claim that the missing second
+maintainer exists. Do not disable Scorecard or weaken protections. Reopen and
+reassess these dispositions when their assumptions change. The LOW best-practices
+badge and MEDIUM fuzzing recommendations remain open for follow-up.
+
+No OpenVEX statement is fabricated for these process findings: no vulnerable shipped
+component or exploit was identified. Any actual vulnerability present but not
+exploitable needs the OpenVEX statement required by K22-SEC-42.

docs/security/threat-model.md

@@ -78,4 +78,6 @@ trust boundaries change.
   no published assets. Highest-impact threat is a compromised credential or upstream
   Action; restricted environments, scoped installation, reviewed SHA pins, and
   required PR gates limit its reach. Provisioning and live checks are recorded in
-  the first-release checklist.
+  the first-release checklist. Existing Scorecard process findings are recorded in
+  [their dispositions](scorecard-dispositions.md); EX-0001 retains the accepted
+  single-maintainer risk.