docs: the badge self-assessment, including what it fails #78

Merged

extant2000git merged 1 commits from docs/best-practices-self-assessment into main 2026-10-15 01:11:52 +00:00

Conversation 0 Commits 1 Files Changed 1

+118

extant2000git commented 2026-10-15 01:11:09 +00:00

Owner

Copy Link

Copy Source

OSTIF asks for an OpenSSF Best Practices Badge self-assessment before an audit application. This is one, answered from the repository rather than from memory, with the evidence beside each answer.

Of the 67 passing-level criteria, the cryptographic and testing ones are the strongest and the release-engineering ones are the weakest, which is the opposite of most projects applying for this badge.

The gap that matters beyond the badge. package.json says 2.0.0-draft.1 and this repository has zero tags and zero releases. An audit is of a version, and there is only main. Deciding when 2.0.0 is 2.0.0 belongs to the maintainer, so the document names the gap and does not close it.

Also unmet and stated plainly:

• No linter or static analysis. devDependencies is empty by design, and the suites catch behaviour rather than shape.
• No fuzzing or sanitizer run. The honest answer is a fuzz target over payloadToEnvelope and openSealed; the interop suites are differential testing, which is not what those criteria ask for.
• No discussion channel beyond the issue tracker.
• No outside vulnerability report yet, so two criteria have no record to point at.

The sites_https answer carries an asterisk the criteria do not anticipate. The host is HTTPS with a valid certificate, and it also returns 451 to the EU 27, the EEA 3 and the UK, so a reader in Europe cannot fetch this repository. "Public" is true with a caveat until the mirror in hitthosting-infra/mirror/ runs.

Every claim was checked and two did not survive. A draft credited a test/complete.mjs that does not exist, since complete is an inline CI step. Another said one issue had ever been opened; there are five, four closed, and all five have at least one comment, which makes report_responses and enhancement_responses arguably met rather than unanswerable.

Measured for the document: conformance 304 passed with 2 skipped, client 289, ratchet 35, vault 26, all 0 failures. Secret sweep clean across 88 files, and check-doc-references.py resolves all 153 sections.

🤖 Generated with Claude Code

OSTIF asks for an OpenSSF Best Practices Badge self-assessment before an audit application. This is one, answered from the repository rather than from memory, with the evidence beside each answer. Of the 67 passing-level criteria, the cryptographic and testing ones are the strongest and the release-engineering ones are the weakest, which is the opposite of most projects applying for this badge. **The gap that matters beyond the badge.** `package.json` says `2.0.0-draft.1` and this repository has **zero tags and zero releases**. An audit is of a version, and there is only `main`. Deciding when 2.0.0 is 2.0.0 belongs to the maintainer, so the document names the gap and does not close it. Also unmet and stated plainly: - No linter or static analysis. `devDependencies` is empty by design, and the suites catch behaviour rather than shape. - No fuzzing or sanitizer run. The honest answer is a fuzz target over `payloadToEnvelope` and `openSealed`; the interop suites are differential testing, which is not what those criteria ask for. - No discussion channel beyond the issue tracker. - No outside vulnerability report yet, so two criteria have no record to point at. The `sites_https` answer carries an asterisk the criteria do not anticipate. The host is HTTPS with a valid certificate, and it also returns 451 to the EU 27, the EEA 3 and the UK, so a reader in Europe cannot fetch this repository. "Public" is true with a caveat until the mirror in `hitthosting-infra/mirror/` runs. **Every claim was checked and two did not survive.** A draft credited a `test/complete.mjs` that does not exist, since `complete` is an inline CI step. Another said one issue had ever been opened; there are five, four closed, and all five have at least one comment, which makes `report_responses` and `enhancement_responses` arguably met rather than unanswerable. Measured for the document: conformance 304 passed with 2 skipped, client 289, ratchet 35, vault 26, all 0 failures. Secret sweep clean across 88 files, and `check-doc-references.py` resolves all 153 sections. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

extant2000git added 1 commit 2026-10-15 01:11:09 +00:00

docs: the badge self-assessment, including what it fails ... 06817c612e

OSTIF asks for an OpenSSF Best Practices Badge self-assessment before an
audit application, so here is one answered from the repository rather
than from memory, with the evidence beside each answer.

Of the 67 passing-level criteria the cryptographic and testing ones are
the strongest and the release-engineering ones are the weakest, which is
the opposite of most projects applying for this badge.

🔴 The gap that matters beyond the badge: package.json says
2.0.0-draft.1 and this repository has zero tags and zero releases. An
audit is of a version, and there is only `main`. Deciding when 2.0.0 is
2.0.0 belongs to the maintainer, so this document names the gap and does
not close it.

Also unmet and stated plainly: no linter or static analysis, because
devDependencies is empty by design and the suites catch behaviour rather
than shape; no fuzzing or sanitizer run, where the honest answer is a
fuzz target over payloadToEnvelope and openSealed; no discussion channel
beyond the issue tracker; and no outside vulnerability report yet, so
two response criteria have no record to point at.

The `sites_https` answer carries an asterisk the criteria do not
anticipate. The host is HTTPS with a valid certificate and it also
returns 451 to the EU 27, the EEA 3 and the UK, so a reader in Europe
cannot fetch this repository. "Public" is true with a caveat until the
mirror in hitthosting-infra runs.

Every claim was checked against the repository and two did not survive.
A draft credited a `test/complete.mjs` that does not exist, since
`complete` is an inline CI step. Another said one issue had ever been
opened; there are five, four closed, and all five have at least one
comment, which makes two response criteria arguably met rather than
unanswerable.

Measured for this document: conformance 304 passed 2 skipped, client
289, ratchet 35, vault 26, all with 0 failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

extant2000git merged commit 8327bffd41 into main 2026-10-15 01:11:52 +00:00

extant2000git deleted branch docs/best-practices-self-assessment 2026-10-15 01:11:52 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

accuracy

A public page or doc claims something the code does not do

blocked:apple

Waiting on App Store review

docs

ops

Deploy, CI, infrastructure

parity

One platform has it and the other does not

privacy

Changes what is stored, or what we say is stored

protocol

unwired

Built in the engine, not reachable from the UI

verification

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

extant2000git

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-e2e#78