AAIF Gate 5: OpenSSF Best Practices baseline assessment and gap filing

[pshkv]

Objective

Run a baseline OpenSSF Best Practices assessment and capture concrete
remediation gaps for AAIF Gate 5.

Scope

• Repository: sint-ai/sint-protocol
• Evidence page: docs/community/openssf-gap-tracker.md

Baseline Checklist

• Start/verify OpenSSF Best Practices project profile
• Record current score/status in docs
• Identify blocking gaps for badge progression
• Open follow-up issues for each major gap
• Link all issues in the public gap tracker

Initial Gap Buckets

• Security policy/disclosure path verification (OpenSSF Gap: Verify SECURITY disclosure path and response SLA #192)
• Release checklist evidence on tagged RC (OpenSSF Gap: First tagged RC checklist evidence run #195)
• SBOM or dependency review path documentation (OpenSSF Gap: Document SBOM/dependency review path for production deployments #194)
• External evidence links for production-slice validation (OpenSSF Gap: Publish external production-slice validation artifact #193)

Exit Criteria

• At least one follow-up issue exists per major gap bucket
• docs/community/openssf-gap-tracker.md links this issue and follow-ups
• AAIF roadmap status can reference public, reviewable links

[pshkv]

Progress update on Gate 5 baseline (as of 2026-05-22):

Completed and merged:

• OpenSSF Gap: Verify SECURITY disclosure path and response SLA #192 Security disclosure path + SLA verification
• OpenSSF Gap: Publish external production-slice validation artifact #193 Signed production-slice validation artifact
• OpenSSF Gap: First tagged RC checklist evidence run #195 First tagged RC checklist evidence run

Key evidence now published:

• docs/security/vulnerability-reporting-and-response.md
• docs/reports/production-slice-validation-artifact.md
• docs/reports/aaif-release-gate-2026-05-21.md
• docs/community/openssf-gap-tracker.md (rows updated to done where complete)

Remaining open sub-gap under this parent:

• OpenSSF Gap: Document SBOM/dependency review path for production deployments #194 dependency/SBOM path: baseline is documented, next step is remediation follow-through + release policy decision.

[pshkv]

Parent status refresh (2026-05-25):

Gate-5 sub-gap progress now:

• OpenSSF Gap: Verify SECURITY disclosure path and response SLA #192 done (disclosure path + SLA)
• OpenSSF Gap: Publish external production-slice validation artifact #193 done (signed production-slice artifact)
• OpenSSF Gap: First tagged RC checklist evidence run #195 done (first tagged RC checklist evidence run)
• OpenSSF Gap: Document SBOM/dependency review path for production deployments #194 done (dependency-review workflow + dated audit artifact)

Current remaining active item under this lane:

• Dependency remediation: upgrade fast-uri to >=3.1.2 across production graph #209 high-severity dependency remediation (fast-uri advisory path cleanup)

I also merged the graph-first coordination upgrade roadmap track (#211) so the next execution lane is now documented as implementation work, not just strategy text.

[pshkv]

Dependency audit refresh — 2026-07-23:

Opened PR #246 to clear the new July production advisories found by a fresh production audit run.

What changed in the PR:

• raised direct Hono / @hono/node-server / ws ranges on gateway, badge, and client-adjacent surfaces
• added pnpm override floors for Hono, @hono/node-server, ws, fast-uri, express-rate-limit, body-parser, qs, and ip-address
• refreshed the pnpm lockfile

Local validation before opening PR:

• production audit summary: all severities 0, no actions
• gateway-server typecheck passed
• badge-server typecheck passed
• client typecheck passed
• full workspace build passed
• full workspace test passed: 96 tasks successful
• diff whitespace check passed

PR: #246

Keeping this parent open until PR #246 CI passes and merges, then Gate 5 can be closed with a clean July audit snapshot.

[pshkv]

Closing Gate 5 baseline after the July dependency-audit refresh.

Completed evidence now on main:

• OpenSSF Gap: Verify SECURITY disclosure path and response SLA #192 disclosure path + SLA verification
• OpenSSF Gap: Publish external production-slice validation artifact #193 signed production-slice validation artifact
• OpenSSF Gap: First tagged RC checklist evidence run #195 first tagged RC checklist evidence run
• OpenSSF Gap: Document SBOM/dependency review path for production deployments #194 dependency/SBOM path
• Dependency remediation: upgrade fast-uri to >=3.1.2 across production graph #209 original fast-uri remediation
• fix(deps): clear production audit advisories #246 July production audit refresh, merged after CI passed

Final dependency snapshot from PR #246:

• production audit summary: all severities 0, no actions
• remote CI passed: build-and-test (22), generate-benchmark-report, guardrails

This leaves the broader roadmap items open separately, but the OpenSSF baseline/gap-filing lane tracked here is complete.