.bestpractices.json

{
  "achieve_silver_justification": "Silver criteria are tracked through the repository trust documentation and this prefill manifest. See https://github.com/paudley/coding-ethos/blob/main/docs/TRUST_SIGNALS.md#openssf-best-practices-badge",
  "achieve_silver_status": "Met",
  "assurance_case_justification": "The project maintains a concrete security assurance case with top-level claims, evidence, input-validation claims, secure-design claims, and known limits. See https://github.com/paudley/coding-ethos/blob/main/docs/SECURITY_ASSURANCE_CASE.md",
  "assurance_case_status": "Met",
  "build_repeatable_justification": "The build uses checked-in lock files, generated-config drift checks, deterministic policy bundle generation, and reproducible Go build flags. See https://github.com/paudley/coding-ethos/blob/main/docs/BUILD_REPRODUCIBILITY.md",
  "build_repeatable_status": "Met",
  "build_reproducible_justification": "The release and local build paths document repeatable inputs and deterministic Go build flags. See https://github.com/paudley/coding-ethos/blob/main/docs/BUILD_REPRODUCIBILITY.md",
  "build_reproducible_status": "Met",
  "code_review_standards_justification": "Contribution and pull request review requirements are documented in CONTRIBUTING.md and the pull request template. See https://github.com/paudley/coding-ethos/blob/main/CONTRIBUTING.md#quality-bar",
  "code_review_standards_status": "Met",
  "contributors_unassociated_justification": "The project does not yet have at least two unassociated significant contributors.",
  "contributors_unassociated_status": "Unmet",
  "copyright_per_file_justification": "Project-controlled source, docs, configs, and workflow files carry SPDX-FileCopyrightText headers. See repository files and the license policy notes at https://github.com/paudley/coding-ethos/blob/main/README.md#license-policy",
  "copyright_per_file_status": "Met",
  "crypto_algorithm_agility_justification": "The project does not implement custom cryptography and documents the required agility review for any future cryptographic feature. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#cryptography",
  "crypto_algorithm_agility_status": "Met",
  "crypto_certificate_verification_justification": "Repository-owned HTTPS access must use normal TLS certificate verification and must not disable verification. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#certificate-and-tls-verification",
  "crypto_certificate_verification_status": "Met",
  "crypto_credential_agility_justification": "Release flows avoid long-lived credentials through GitHub OIDC and PyPI Trusted Publishing, and key rotation is documented through SECURITY.md. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#credential-agility",
  "crypto_credential_agility_status": "Met",
  "crypto_tls12_justification": "Remote delivery and publication use GitHub, PyPI, and Best Practices over HTTPS/TLS. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#certificate-and-tls-verification",
  "crypto_tls12_status": "Met",
  "crypto_used_network_justification": "Network cryptography usage is limited to standard HTTPS/TLS service access, GitHub OIDC/Sigstore attestations, PyPI Trusted Publishing, SHA-256 checksums, and optional OpenPGP reporting. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#cryptography",
  "crypto_used_network_status": "Met",
  "crypto_verification_private_justification": "The project does not maintain private cryptographic verification protocols; repository-owned remote access uses standard HTTPS/TLS verification. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#certificate-and-tls-verification",
  "crypto_verification_private_status": "Met",
  "description": "Policy-as-code and agent-hook enforcement toolkit for AI-assisted software development.",
  "hardened_site_justification": "The project site is static GitHub Pages content served over HTTPS, with no login, cookies, or project-managed password database. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#hosted-site-hardening",
  "hardened_site_status": "Met",
  "hardening_justification": "The project documents site hardening expectations and platform limits for the static GitHub Pages site. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#hosted-site-hardening",
  "hardening_status": "Met",
  "homepage_url": "https://paudley.github.io/coding-ethos",
  "homepage_url_justification": "The project website is published with GitHub Pages at https://paudley.github.io/coding-ethos/",
  "homepage_url_status": "Met",
  "implement_secure_design_justification": "Secure design is documented through the threat model, runtime sandboxing plan, and security assurance case. See https://github.com/paudley/coding-ethos/blob/main/docs/SECURITY_ASSURANCE_CASE.md",
  "implement_secure_design_status": "Met",
  "implementation_languages": "Go, Python, Shell, Makefile, Jinja",
  "input_validation_justification": "The project validates hook payloads, shell commands, CEL inputs, YAML policy, SARIF, and source facts through structured parsers and typed loaders. See https://github.com/paudley/coding-ethos/blob/main/docs/SECURITY_ASSURANCE_CASE.md#input-validation-claim",
  "input_validation_status": "Met",
  "license": "AGPL-3.0-only",
  "license_per_file_justification": "Project-controlled source, docs, configs, and workflow files carry SPDX-License-Identifier headers. See repository files and the license policy notes at https://github.com/paudley/coding-ethos/blob/main/README.md#license-policy",
  "license_per_file_status": "Met",
  "name": "coding-ethos",
  "repo_url": "https://github.com/paudley/coding-ethos",
  "report_url_justification": "GitHub issues are the public bug-reporting and discussion surface. See https://github.com/paudley/coding-ethos/issues",
  "report_url_status": "Met",
  "require_2FA_justification": "The repository owner confirmed GitHub two-factor authentication is enabled for the administering account. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#repository-account-security",
  "require_2FA_status": "Met",
  "secure_2FA_justification": "The repository owner confirmed GitHub two-factor authentication is enabled using GitHub-supported 2FA mechanisms for the administering account. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#repository-account-security",
  "secure_2FA_status": "Met",
  "security_review_justification": "Security review is part of the release and CI gates through CodeQL, OSV-Scanner, Zizmor, Scorecard, SARIF, and release attestations. See https://github.com/paudley/coding-ethos/blob/main/docs/TRUST_SIGNALS.md",
  "security_review_status": "Met",
  "signed_releases_justification": "The release process requires signed v* tags and publishes artifacts with checksums, SBOMs, and attestations. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#release-signing-and-tags",
  "signed_releases_status": "Met",
  "small_tasks_justification": "The contribution guide requires the smallest coherent change, the PR template asks for scoped change summaries and verification, and the ETHOS enforces small sufficient implementation. See https://github.com/paudley/coding-ethos/blob/main/CONTRIBUTING.md#submit-pull-requests",
  "small_tasks_status": "Met",
  "test_branch_coverage80_justification": "Statement coverage is enforced, but branch coverage is not yet measured as a release gate. Tracked in TODO.md.",
  "test_branch_coverage80_status": "Unmet",
  "test_policy_mandated_justification": "The functional-testing principle and contribution guide require behavioral tests for major functionality and bug fixes. See https://github.com/paudley/coding-ethos/blob/main/CONTRIBUTING.md#quality-bar",
  "test_policy_mandated_status": "Met",
  "test_statement_coverage90_justification": "The project currently enforces an 80% coverage floor, not 90%. See https://github.com/paudley/coding-ethos/blob/main/Makefile",
  "test_statement_coverage90_status": "Unmet",
  "two_person_review_justification": "The project uses pull requests and CODEOWNERS, but does not yet have enough independent reviewer capacity to require two-person review for at least 50% of all modifications.",
  "two_person_review_status": "Unmet",
  "version_tags_signed_justification": "The release process requires signed v* tags and documents verification with git tag -v. See https://github.com/paudley/coding-ethos/blob/main/docs/GOLD_SECURITY_POSTURE.md#release-signing-and-tags",
  "version_tags_signed_status": "Met"
}