feat(assurance)!: require applicable fuzzing and badge participation #19

2026-10-10T17:23:01Z

KofTwentyTwo commented

2026-10-10 17:23:01 +00:00

(Migrated from github.com)

What

Require applicable parser fuzzing (K22-TEST-25) and public Product Best Practices participation (K22-REPO-12), with scope records, criterion evidence, and adoption templates. Add native PowerShell security-property fuzzing to the existing required conformance job: two seeds on PR/main, longer weekly and release-tag campaigns.

Why

Fixes #18. The maintainer requested mandatory requirements where applicable after reviewing the Scorecard Fuzzing and Best Practices warnings. The generated cases exposed checker gaps; regressions now cover quoted checkout actions, YAML block indicators, and exception scope/expiry. Keep Scorecard detection limits visible rather than inventing an unrelated integration.

Badge login is blocked by the provider's anti-spam restriction. EX-0007 proposes an enrollment-only deferral for this repository, reviewed 2026-10-17 and expiring 2026-11-10 UTC. No project ID, submitted assessment, passing badge, or human expertise attestation is fabricated. Downstream repositories receive no waiver. The register is the approval record on merge.

BREAKING CHANGE: Public Product repositories must enroll and maintain an evidence-backed assessment; complex untrusted-input parsers need required CI fuzz campaigns and documented scope. Publish these new MUSTs in a MAJOR release. Release Please explicitly retains MAJOR bumps before 1.0; this PR does not create a version tag or publish a release. Existing immutable v0.1.2 and reserved failed tags remain unchanged.

How it was tested

Checker self-tests, including negative assurance-record, exception-scope, expiry and parser regressions.
Extended fuzz campaigns: seeds 22023 and 99173, 10000 cases each, 320000 assertions total; no generated scripts executed and no network/profile access.
Isolated package regression suite passed.
Markdown lint and offline internal-link/fragment checks passed.
Actionlint, offline zizmor (medium+) and gitleaks passed.
PSScriptAnalyzer passed for the new harness and new assurance helper using repository settings; existing checker formatting was preserved.
Full authenticated conformance passed: no MUST failures, enrollment explicitly EXCEPTED, human-verification checks remain REVIEW. Existing SHOULD warnings are unchanged.

Required GitHub CI and the recorded AI review must be green/resolved before maintainer merge. Substantial AI implementation and review assistance: OpenAI GPT-6 Codex under maintainer authorization; this is not independent human approval.

Checklist

Commits are signed and DCO signed off
Changed code passes relevant formatting/lint checks; no new findings
Behavioral and security regressions added; no separate repository coverage gate exists
Standards, compliance crosswalk, contributor commands and templates updated
No secrets or private keys included; synthetic fixtures only
No new runtime or test dependencies
Substantial AI assistance disclosed
Maintainer reviews the policy scope, assessment evidence and dated EX-0007 before merge

## What Require applicable parser fuzzing (K22-TEST-25) and public Product Best Practices participation (K22-REPO-12), with scope records, criterion evidence, and adoption templates. Add native PowerShell security-property fuzzing to the existing required conformance job: two seeds on PR/main, longer weekly and release-tag campaigns. ## Why Fixes #18. The maintainer requested mandatory requirements where applicable after reviewing the Scorecard Fuzzing and Best Practices warnings. The generated cases exposed checker gaps; regressions now cover quoted checkout actions, YAML block indicators, and exception scope/expiry. Keep Scorecard detection limits visible rather than inventing an unrelated integration. Badge login is blocked by the provider's anti-spam restriction. EX-0007 proposes an enrollment-only deferral for this repository, reviewed 2026-10-17 and expiring 2026-11-10 UTC. No project ID, submitted assessment, passing badge, or human expertise attestation is fabricated. Downstream repositories receive no waiver. The register is the approval record on merge. BREAKING CHANGE: Public Product repositories must enroll and maintain an evidence-backed assessment; complex untrusted-input parsers need required CI fuzz campaigns and documented scope. Publish these new MUSTs in a MAJOR release. Release Please explicitly retains MAJOR bumps before 1.0; this PR does not create a version tag or publish a release. Existing immutable v0.1.2 and reserved failed tags remain unchanged. ## How it was tested - Checker self-tests, including negative assurance-record, exception-scope, expiry and parser regressions. - Extended fuzz campaigns: seeds 22023 and 99173, 10000 cases each, 320000 assertions total; no generated scripts executed and no network/profile access. - Isolated package regression suite passed. - Markdown lint and offline internal-link/fragment checks passed. - Actionlint, offline zizmor (medium+) and gitleaks passed. - PSScriptAnalyzer passed for the new harness and new assurance helper using repository settings; existing checker formatting was preserved. - Full authenticated conformance passed: no MUST failures, enrollment explicitly EXCEPTED, human-verification checks remain REVIEW. Existing SHOULD warnings are unchanged. Required GitHub CI and the recorded AI review must be green/resolved before maintainer merge. Substantial AI implementation and review assistance: OpenAI GPT-6 Codex under maintainer authorization; this is not independent human approval. ## Checklist - [x] Commits are signed and DCO signed off - [x] Changed code passes relevant formatting/lint checks; no new findings - [x] Behavioral and security regressions added; no separate repository coverage gate exists - [x] Standards, compliance crosswalk, contributor commands and templates updated - [x] No secrets or private keys included; synthetic fixtures only - [x] No new runtime or test dependencies - [x] Substantial AI assistance disclosed - [ ] Maintainer reviews the policy scope, assessment evidence and dated EX-0007 before merge

KofTwentyTwo (Migrated from github.com) reviewed

2026-10-10 17:37:24 +00:00

KofTwentyTwo (Migrated from github.com) left a comment

Security assurance patch review

Reviewed by OpenAI GPT-6 Codex on 2026-10-10 against base
fdf5ed029603c938615a32b1beca3628b8787945 and PR #19 head
aa40477a11a2a0df906964d05cf31da81f96890a on feat/security-assurance.
This is an AI review, not independent human approval or authorization to merge.

The patch introduces K22-REPO-12 and K22-TEST-25, native PowerShell fuzzing in the
existing required conformance job, scope/evidence records and downstream templates.
It proposes EX-0007 solely for standards enrollment, expiring 2026-11-10 UTC.

Review findings resolved before publication:

Quoted checkout actions and block-scalar indentation/comment forms now retain
deterministic regressions as well as generated-input properties.
An explicit owner/repository exception cannot authorize another owner with the
same short repository name; local static checks identify the canonical origin.
Dated exceptions stop covering failures on their expiry date; review dates are
not misinterpreted as expiry dates. Conditional expiry still requires review.
Invalid/incomplete assurance records fail closed; boolean schema versions do not
masquerade as version 1. A command in a comment cannot satisfy a fuzz reference.
Static evidence yields REVIEW, never invented certification. Missing evidence is
not covered by the enrollment-only exception. Repository identity, scope,
assessment answers, campaign scheduling and actual required-check execution need
maintainer verification.
Declared commands are inspected as data and never executed by the checker;
generated attacker scripts are never executed by the harness. Paths must be
repository-relative. No new dependency, credential, workflow permission or bypass.
Release Please retains MAJOR bumps for the breaking standards change. The
published v0.1.2 assets/tags and version files remain unchanged.

Validation passed: checker self-tests, two 10000-case fuzz campaigns (320000
assertions), package regression suite, Markdown lint, offline relative-link/fragment
checks, actionlint, offline zizmor medium+ gate, gitleaks, and full authenticated
conformance. New harness and assurance helper pass configured PSScriptAnalyzer.
Full conformance has zero MUST failures, one enrollment exception, four REVIEW
rows and three existing SHOULD warnings. No whole-tool coverage claim is made.

No blocking code finding remains. Maintainer must review the new policy scope,
criterion answers and EX-0007. GitHub verified the signed source commit. Required
checks all passed in run 38071510140, including the native fuzz campaigns,
documentation, CodeQL, secret scanning, SCA and workflow security. The maintainer
explicitly authorized this commit/push/PR after the initial automatic review
rejection, and subsequently instructed "merge it" after the review-comment request.
This records the required AI review before the authorized squash merge. Badge
assessment enrollment and human attestations remain deferred as documented. No
version tag or new release is authorized by this merge instruction.

# Security assurance patch review Reviewed by OpenAI GPT-6 Codex on 2026-10-10 against base `fdf5ed029603c938615a32b1beca3628b8787945` and PR #19 head `aa40477a11a2a0df906964d05cf31da81f96890a` on `feat/security-assurance`. This is an AI review, not independent human approval or authorization to merge. The patch introduces K22-REPO-12 and K22-TEST-25, native PowerShell fuzzing in the existing required conformance job, scope/evidence records and downstream templates. It proposes EX-0007 solely for standards enrollment, expiring 2026-11-10 UTC. Review findings resolved before publication: - Quoted checkout actions and block-scalar indentation/comment forms now retain deterministic regressions as well as generated-input properties. - An explicit owner/repository exception cannot authorize another owner with the same short repository name; local static checks identify the canonical origin. - Dated exceptions stop covering failures on their expiry date; review dates are not misinterpreted as expiry dates. Conditional expiry still requires review. - Invalid/incomplete assurance records fail closed; boolean schema versions do not masquerade as version 1. A command in a comment cannot satisfy a fuzz reference. - Static evidence yields REVIEW, never invented certification. Missing evidence is not covered by the enrollment-only exception. Repository identity, scope, assessment answers, campaign scheduling and actual required-check execution need maintainer verification. - Declared commands are inspected as data and never executed by the checker; generated attacker scripts are never executed by the harness. Paths must be repository-relative. No new dependency, credential, workflow permission or bypass. - Release Please retains MAJOR bumps for the breaking standards change. The published v0.1.2 assets/tags and version files remain unchanged. Validation passed: checker self-tests, two 10000-case fuzz campaigns (320000 assertions), package regression suite, Markdown lint, offline relative-link/fragment checks, actionlint, offline zizmor medium+ gate, gitleaks, and full authenticated conformance. New harness and assurance helper pass configured PSScriptAnalyzer. Full conformance has zero MUST failures, one enrollment exception, four REVIEW rows and three existing SHOULD warnings. No whole-tool coverage claim is made. No blocking code finding remains. Maintainer must review the new policy scope, criterion answers and EX-0007. GitHub verified the signed source commit. Required checks all passed in run 38071510140, including the native fuzz campaigns, documentation, CodeQL, secret scanning, SCA and workflow security. The maintainer explicitly authorized this commit/push/PR after the initial automatic review rejection, and subsequently instructed "merge it" after the review-comment request. This records the required AI review before the authorized squash merge. Badge assessment enrollment and human attestations remain deferred as documented. No version tag or new release is authorized by this merge instruction.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#19