The1.2.0 tag failed preflight because I omitted the required MINOR
checklist annotation. Record an honest forward recovery: preserve that
signed failed tag, prepare1.2.1 from the same MSI implementation, attach
real conformance/scanning/checklist evidence and include its URL in the
new signed annotation. Do not retag or bypass validation.
Only documentation changes. Actual full conformance exits0 with no FAIL;
the only open code-scanning item is a medium Scorecard Fuzzing process
finding, and no HIGH/CRITICAL Dependabot alerts are open. Current
exceptions are recorded. The existing optional MSI code and all gates
are unchanged. Owner authorized release and no further human-review
requests. Substantial AI assistance: Codex GPT-6. Refs #47 and
KofTwentyTwo/MarkdownViewr.Windows#36.
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>
Sign explicit owned Windows binaries, preserve third-party bytes/signatures, and verify final NuGet/Velopack distribution before publication. Protected release signing uses Azure OIDC, SHA256 and RFC3161 timestamps.
Validation: exact e3aaed4 CI38263239957 passes all required gates; 35 local signing regressions, conformance self-test/full API preflight and document/workflow/security lint pass. Real local representative six-binary and final installer/portable/update signing integration also passes; protected CI OIDC remains to be verified by the consumer release.
Maintainer confirmed review of exact e3aaed4 and resolution of all findings in this session, and authorized release publication.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Publish the stable standards baseline with mandatory applicable badge participation
and parser fuzzing, the passing assessment, professional release text, scoped
frontend audit exception, Windows signing correction and readiness documentation.
Release checklist: https://github.com/KofTwentyTwo/standards/issues/30
Validated full conformance, Markdown and links, package regressions, required PR
gates and both 10000-case fuzz campaigns. Existing Windows consumer limitations
remain documented in issue #22 and docs/releases.md.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
The README and assurance records still say enrollment is blocked, even
though OpenSSF project 15366 now identifies KofTwentyTwo/standards and
displays a passing badge. Add the provider's live badge and project URL,
record the completed maintainer self-assessment, and close the
enrollment-only exception EX-0007 while preserving its history.
Set the next assessment review to 2027-01-08 or before the next
MINOR/MAJOR release, whichever occurs first. Retain the unmet suggested
coverage and warning criteria and the release smoke-test follow-up in
#22. Update Scorecard dispositions without claiming an unobserved score
change.
Validation: public assessment identity and passing status verified;
Markdown lint passed for all 69 documents; offline links and anchors
passed with zero errors; full repository conformance passed with 32
PASS, 5 REVIEW, 3 existing WARN, 1 N/A, and no FAIL/UNKNOWN; git diff
--check passed.
AI assistance: Codex (GPT-6) prepared and validated this documentation
change. No standards requirement, workflow, root AGENTS.md, release tag,
or published asset changes.
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Scope native spacing, bare-link and repeated-heading exceptions to the generated
changelog. Keep normal Markdown rules for other documentation.
Refs: #21
Validation: all nine required checks passed in CI run 38074899308.
Recorded AI review on PR #24 at source fa15d5cd2a.
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Configure professional Release Please wording and native release-note categories,
retain complete package notes, and reject emoji in PR titles and descriptions.
Update contributor and agent guidance and remove the decorative IDE symbol.
Fixes: #21
Validation: all nine required PR checks passed in CI run 38074586698.
Recorded AI review: https://github.com/KofTwentyTwo/standards/pull/23#pullrequestreview-5480239702
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Add mandatory parser fuzzing (K22-TEST-25) and public Product Best Practices participation (K22-REPO-12), with scope records, criterion evidence, and adoption templates. The existing required conformance job runs both PowerShell fuzz seeds on PR/main and longer campaigns on weekly schedules and release tags.
Fixes#18. Preserve Scorecard detection limits: native PowerShell property-based fuzzing is running, but is not a claim of a supported integration or a passing badge. EX-0007 covers standards enrollment only, reviewed 2026-10-17 and expiring 2026-11-10 UTC, while the provider blocks maintainer login.
BREAKING CHANGE: Public Product repositories must enroll and maintain an evidence-backed assessment; complex untrusted-input parsers must have required CI fuzz campaigns and documented scope. Publish these new MUSTs in a MAJOR release. Existing immutable v0.1.2 and reserved failed tags remain unchanged; this merge does not publish another release.
Validation: all nine required PR checks passed at aa40477a11, including both native fuzz seeds. Extended local campaigns passed 20000 cases and 320000 assertions. Checker/package regressions, Markdown/links, workflow lint/security, secret scans, configured analysis of new PowerShell code, and full authenticated conformance passed.
AI review: https://github.com/KofTwentyTwo/standards/pull/19#pullrequestreview-5480144854. No blocking code findings remain. Substantial AI assistance: OpenAI GPT-6 Codex, under explicit maintainer implementation and merge authorization. No independent human review or completed badge assessment is claimed.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>
First published immutable standards bundle containing policies, profiles, architectures, configs, workflows, templates, and tooling. Version and manifest are 0.1.2; changelog describes the complete snapshot and the corrected secret contract. v0.1.0 and v0.1.1 remain unpublished and reserved.
Release checklist: https://github.com/KofTwentyTwo/standards/issues/17
Validated package regression tests, Markdown lint, recorded AI review, and required PR gates. Substantial AI assistance: OpenAI GPT-6 Codex under maintainer authorization.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>
Declare the one named App key in the caller and required reusable workflow contract. Its value remains in the reviewer-protected tag-only environment; nested CI receives no secrets.
Both failed versions remain reserved. All required PR checks, actionlint, zizmor, Markdown lint, and full conformance passed. Substantial AI assistance: OpenAI GPT-6 Codex.
Release-As: 0.1.2
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>
## What
Grant the release gates the PR read permission their nested CI caller requires. Preserve optional PATCH checklist links. Closes#12.
## Why
GitHub rejected the first tag before any job ran because reusable-workflow permissions cannot increase at a lower level, even for skipped PR jobs. Keep v0.1.0 unchanged; publish the first 0.1 bundle as v0.1.1.
## Validation
Actionlint and zizmor pass. Dispatch the actual release workflow on this branch to check GitHub's complete call-chain validation without publishing (the top-level tag condition skips branch publication). Normal PR gates and reviewed version metadata remain required before tagging.
Commits are signed/DCO signed off. No new dependency or secret. Substantial AI assistance: Codex (GPT-6). Release-As: 0.1.1.
Release-As: 0.1.1
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
## What Publish committed standards as versioned ZIP/tar.gz bundles with a source manifest, SHA256SUMS, release notes, and GitHub build attestations. Release Please proposes reviewed semantic version PRs; maintainer-created tags invoke all existing CI gates and protected immutable publication. First version: **0.1.0**. Closes#7. ## Why Consumers need a complete snapshot whose version identifies permanent bytes and a verifiable source commit across languages and operating systems. ## How it was tested Package regression fixtures verify committed-only content, hidden files, both archive formats, deterministic output, checksum coverage, version/changelog validation, and refusal to overwrite output. Checker self-tests, static conformance, actionlint, zizmor (offline), markdownlint, internal links, gitleaks, and separate-process PSScriptAnalyzer checks pass. Live CI will re-run required checks before merge. ## GitHub setup and scope Immutable releases are already enabled. Configure `release-automation` for main only and `release` for v* tags with KofTwentyTwo approval and no admin bypass. An App installed only on this repository gets Contents/PR write and Administration read, no ruleset bypass. Its key stays in environment secrets. EX-0006 records only the main-only version-bot key exception; main/tag rulesets and GITHUB_TOKEN PR restrictions remain intact. MINOR/MAJOR checklists receive `release: ready` after preflight; post-publication verification remains pending until shipping. ## Checklist - [x] Commits signed and DCO signed off - [x] Format/lint clean; no application build required - [x] Behavioral package tests added; no existing coverage gate - [x] Contributor guide, distribution ADR, threat model, and release instructions included - [x] No secrets or private data in the patch - [x] New SHA-pinned actions justified for version proposals, scoped App tokens, and provenance; no runtime dependencies - [x] Substantial AI assistance: Codex (GPT-6); maintainer review and release approval remain required
Security review: docs/security/scorecard-dispositions.md records the Scorecard process alerts and 2027-01-10 reassessment. Automated code review is posted on this PR; all current required checks passed.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
james.maesandCodex GPT-6