Sign explicit owned Windows binaries, preserve third-party bytes/signatures, and verify final NuGet/Velopack distribution before publication. Protected release signing uses Azure OIDC, SHA256 and RFC3161 timestamps.
Validation: exact e3aaed4 CI38263239957 passes all required gates; 35 local signing regressions, conformance self-test/full API preflight and document/workflow/security lint pass. Real local representative six-binary and final installer/portable/update signing integration also passes; protected CI OIDC remains to be verified by the consumer release.
Maintainer confirmed review of exact e3aaed4 and resolution of all findings in this session, and authorized release publication.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Publish the stable standards baseline with mandatory applicable badge participation
and parser fuzzing, the passing assessment, professional release text, scoped
frontend audit exception, Windows signing correction and readiness documentation.
Release checklist: https://github.com/KofTwentyTwo/standards/issues/30
Validated full conformance, Markdown and links, package regressions, required PR
gates and both 10000-case fuzz campaigns. Existing Windows consumer limitations
remain documented in issue #22 and docs/releases.md.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
The README and assurance records still say enrollment is blocked, even
though OpenSSF project 15366 now identifies KofTwentyTwo/standards and
displays a passing badge. Add the provider's live badge and project URL,
record the completed maintainer self-assessment, and close the
enrollment-only exception EX-0007 while preserving its history.
Set the next assessment review to 2027-01-08 or before the next
MINOR/MAJOR release, whichever occurs first. Retain the unmet suggested
coverage and warning criteria and the release smoke-test follow-up in
#22. Update Scorecard dispositions without claiming an unobserved score
change.
Validation: public assessment identity and passing status verified;
Markdown lint passed for all 69 documents; offline links and anchors
passed with zero errors; full repository conformance passed with 32
PASS, 5 REVIEW, 3 existing WARN, 1 N/A, and no FAIL/UNKNOWN; git diff
--check passed.
AI assistance: Codex (GPT-6) prepared and validated this documentation
change. No standards requirement, workflow, root AGENTS.md, release tag,
or published asset changes.
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Add mandatory parser fuzzing (K22-TEST-25) and public Product Best Practices participation (K22-REPO-12), with scope records, criterion evidence, and adoption templates. The existing required conformance job runs both PowerShell fuzz seeds on PR/main and longer campaigns on weekly schedules and release tags.
Fixes#18. Preserve Scorecard detection limits: native PowerShell property-based fuzzing is running, but is not a claim of a supported integration or a passing badge. EX-0007 covers standards enrollment only, reviewed 2026-10-17 and expiring 2026-11-10 UTC, while the provider blocks maintainer login.
BREAKING CHANGE: Public Product repositories must enroll and maintain an evidence-backed assessment; complex untrusted-input parsers must have required CI fuzz campaigns and documented scope. Publish these new MUSTs in a MAJOR release. Existing immutable v0.1.2 and reserved failed tags remain unchanged; this merge does not publish another release.
Validation: all nine required PR checks passed at aa40477a11, including both native fuzz seeds. Extended local campaigns passed 20000 cases and 320000 assertions. Checker/package regressions, Markdown/links, workflow lint/security, secret scans, configured analysis of new PowerShell code, and full authenticated conformance passed.
AI review: https://github.com/KofTwentyTwo/standards/pull/19#pullrequestreview-5480144854. No blocking code findings remain. Substantial AI assistance: OpenAI GPT-6 Codex, under explicit maintainer implementation and merge authorization. No independent human review or completed badge assessment is claimed.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>
First published immutable standards bundle containing policies, profiles, architectures, configs, workflows, templates, and tooling. Version and manifest are 0.1.2; changelog describes the complete snapshot and the corrected secret contract. v0.1.0 and v0.1.1 remain unpublished and reserved.
Release checklist: https://github.com/KofTwentyTwo/standards/issues/17
Validated package regression tests, Markdown lint, recorded AI review, and required PR gates. Substantial AI assistance: OpenAI GPT-6 Codex under maintainer authorization.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>
## What Publish committed standards as versioned ZIP/tar.gz bundles with a source manifest, SHA256SUMS, release notes, and GitHub build attestations. Release Please proposes reviewed semantic version PRs; maintainer-created tags invoke all existing CI gates and protected immutable publication. First version: **0.1.0**. Closes#7. ## Why Consumers need a complete snapshot whose version identifies permanent bytes and a verifiable source commit across languages and operating systems. ## How it was tested Package regression fixtures verify committed-only content, hidden files, both archive formats, deterministic output, checksum coverage, version/changelog validation, and refusal to overwrite output. Checker self-tests, static conformance, actionlint, zizmor (offline), markdownlint, internal links, gitleaks, and separate-process PSScriptAnalyzer checks pass. Live CI will re-run required checks before merge. ## GitHub setup and scope Immutable releases are already enabled. Configure `release-automation` for main only and `release` for v* tags with KofTwentyTwo approval and no admin bypass. An App installed only on this repository gets Contents/PR write and Administration read, no ruleset bypass. Its key stays in environment secrets. EX-0006 records only the main-only version-bot key exception; main/tag rulesets and GITHUB_TOKEN PR restrictions remain intact. MINOR/MAJOR checklists receive `release: ready` after preflight; post-publication verification remains pending until shipping. ## Checklist - [x] Commits signed and DCO signed off - [x] Format/lint clean; no application build required - [x] Behavioral package tests added; no existing coverage gate - [x] Contributor guide, distribution ADR, threat model, and release instructions included - [x] No secrets or private data in the patch - [x] New SHA-pinned actions justified for version proposals, scoped App tokens, and provenance; no runtime dependencies - [x] Substantial AI assistance: Codex (GPT-6); maintainer review and release approval remain required
Security review: docs/security/scorecard-dispositions.md records the Scorecard process alerts and 2027-01-10 reassessment. Automated code review is posted on this PR; all current required checks passed.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
james.maesandCodex