From d8bf01659f64e70ccd4d8ce140a4acda4d3cec90 Mon Sep 17 00:00:00 2001 From: Scetrov Date: Wed, 22 Jul 2026 23:00:53 +0100 Subject: [PATCH 1/2] docs: record best practices verification --- docs/best-practices-reconciliation.md | 6 +++++- .../close-remaining-best-practices-controls/tasks.md | 6 +++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/best-practices-reconciliation.md b/docs/best-practices-reconciliation.md index f0108a8..250e5ca 100644 --- a/docs/best-practices-reconciliation.md +++ b/docs/best-practices-reconciliation.md @@ -29,4 +29,8 @@ A subsequent editor review identified 21 additional unanswered score-relevant co | `crypto_call`, `crypto_weaknesses`, `crypto_pfs`, `dynamic_analysis_unsafe` | `N/A` | efctl does not implement the cryptographic protocols or memory-unsafe software to which these controls apply | | `dynamic_analysis`, `dynamic_analysis_enable_assertions` | `Unmet` | These Suggested criteria do not allow `N/A`; efctl does not currently make a dynamic-analysis or assertion-enablement claim | -No repository-controlled enforcement gap was identified by this audit. The remaining score gap is pending authorized-editor review and acceptance; the expanded manifest proposals have not yet been saved to the service. +No repository-controlled enforcement gap was identified by this audit. The expanded manifest proposals are pending authorized-editor review and acceptance. + +## 2026-07-22 final verification + +After the authorized editor saved the accurate proposals and confirmed propagation, project [13754](https://www.bestpractices.dev/projects/13754.json) reported `achieve_passing: Met`. All 64 attested control statuses matched the merged `.bestpractices.json` manifest, with no remaining Passing control discrepancy. The [live README badge](https://www.bestpractices.dev/projects/13754/badge) reported **passing**. diff --git a/openspec/changes/close-remaining-best-practices-controls/tasks.md b/openspec/changes/close-remaining-best-practices-controls/tasks.md index ab50957..8ed9238 100644 --- a/openspec/changes/close-remaining-best-practices-controls/tasks.md +++ b/openspec/changes/close-remaining-best-practices-controls/tasks.md @@ -12,9 +12,9 @@ ## 3. Accept and Verify the Live Score -- [ ] 3.1 Have an authorized bestpractices.dev editor review and save only the accurate repository proposals for project 13754. -- [ ] 3.2 Verify the project endpoint and README badge after the documented propagation interval, recording the resulting score and every remaining control if the score is not complete. -- [ ] 3.3 Run `go test ./...` and all pre-commit hooks, then review the diff to confirm no unsupported private assertions, optional Silver/Gold claims, runtime changes, or dependency changes were introduced. +- [x] 3.1 Have an authorized bestpractices.dev editor review and save only the accurate repository proposals for project 13754. +- [x] 3.2 Verify the project endpoint and README badge after the documented propagation interval, recording the resulting score and every remaining control if the score is not complete. +- [x] 3.3 Run `go test ./...` and all pre-commit hooks, then review the diff to confirm no unsupported private assertions, optional Silver/Gold claims, runtime changes, or dependency changes were introduced. ## 4. Consolidate Pull Requests From 6b111e278e392e3d0dd16d251591526bf2b8ebb6 Mon Sep 17 00:00:00 2001 From: Scetrov Date: Wed, 22 Jul 2026 23:04:25 +0100 Subject: [PATCH 2/2] chore(openspec): archive best practices change --- .../.openspec.yaml | 0 .../design.md | 0 .../proposal.md | 0 .../specs/best-practices-attestation/spec.md | 0 .../best-practices-score-completion/spec.md | 0 .../tasks.md | 0 .../specs/best-practices-attestation/spec.md | 12 ++++- .../best-practices-score-completion/spec.md | 45 +++++++++++++++++++ 8 files changed, 55 insertions(+), 2 deletions(-) rename openspec/changes/{close-remaining-best-practices-controls => archive/2026-07-22-close-remaining-best-practices-controls}/.openspec.yaml (100%) rename openspec/changes/{close-remaining-best-practices-controls => archive/2026-07-22-close-remaining-best-practices-controls}/design.md (100%) rename openspec/changes/{close-remaining-best-practices-controls => archive/2026-07-22-close-remaining-best-practices-controls}/proposal.md (100%) rename openspec/changes/{close-remaining-best-practices-controls => archive/2026-07-22-close-remaining-best-practices-controls}/specs/best-practices-attestation/spec.md (100%) rename openspec/changes/{close-remaining-best-practices-controls => archive/2026-07-22-close-remaining-best-practices-controls}/specs/best-practices-score-completion/spec.md (100%) rename openspec/changes/{close-remaining-best-practices-controls => archive/2026-07-22-close-remaining-best-practices-controls}/tasks.md (100%) create mode 100644 openspec/specs/best-practices-score-completion/spec.md diff --git a/openspec/changes/close-remaining-best-practices-controls/.openspec.yaml b/openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/.openspec.yaml similarity index 100% rename from openspec/changes/close-remaining-best-practices-controls/.openspec.yaml rename to openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/.openspec.yaml diff --git a/openspec/changes/close-remaining-best-practices-controls/design.md b/openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/design.md similarity index 100% rename from openspec/changes/close-remaining-best-practices-controls/design.md rename to openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/design.md diff --git a/openspec/changes/close-remaining-best-practices-controls/proposal.md b/openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/proposal.md similarity index 100% rename from openspec/changes/close-remaining-best-practices-controls/proposal.md rename to openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/proposal.md diff --git a/openspec/changes/close-remaining-best-practices-controls/specs/best-practices-attestation/spec.md b/openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/specs/best-practices-attestation/spec.md similarity index 100% rename from openspec/changes/close-remaining-best-practices-controls/specs/best-practices-attestation/spec.md rename to openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/specs/best-practices-attestation/spec.md diff --git a/openspec/changes/close-remaining-best-practices-controls/specs/best-practices-score-completion/spec.md b/openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/specs/best-practices-score-completion/spec.md similarity index 100% rename from openspec/changes/close-remaining-best-practices-controls/specs/best-practices-score-completion/spec.md rename to openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/specs/best-practices-score-completion/spec.md diff --git a/openspec/changes/close-remaining-best-practices-controls/tasks.md b/openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/tasks.md similarity index 100% rename from openspec/changes/close-remaining-best-practices-controls/tasks.md rename to openspec/changes/archive/2026-07-22-close-remaining-best-practices-controls/tasks.md diff --git a/openspec/specs/best-practices-attestation/spec.md b/openspec/specs/best-practices-attestation/spec.md index c6205a0..765332b 100644 --- a/openspec/specs/best-practices-attestation/spec.md +++ b/openspec/specs/best-practices-attestation/spec.md @@ -64,12 +64,20 @@ The repository SHALL provide an automated, network-independent validator for `.b - **THEN** the standard test workflow fails with an actionable error ### Requirement: Manual badge acceptance and verification -The repository SHALL document that `.bestpractices.json` supplies proposed answers only and that an authorized project editor must review and save them for bestpractices.dev project 13754. The README SHALL display the service's live project badge rather than a hard-coded passing image or statement. +The repository SHALL document that `.bestpractices.json` supplies proposed answers only and that an authorized project editor must review and save them for bestpractices.dev project 13754. The README SHALL display the service's live project badge rather than a hard-coded passing image or statement. The documented workflow SHALL reconcile the live project answers with the repository attestation, record unresolved discrepancies, and re-verify the live project and badge after relevant policy or attestation changes. #### Scenario: Implementation is merged - **WHEN** the implementation PR reaches the default branch -- **THEN** the documented process directs an authorized editor to review, save, and verify the proposed answers on bestpractices.dev +- **THEN** the documented process directs an authorized editor to compare project 13754 with the repository proposals, review and save accurate answers, and verify the resulting project state and live badge #### Scenario: Badge state changes - **WHEN** bestpractices.dev updates project 13754 from pending to passing or later changes its status - **THEN** the README badge reflects the service's current state without a repository content change + +#### Scenario: A live discrepancy is discovered +- **WHEN** the project 13754 status or justification differs from the version-controlled attestation +- **THEN** the owner workflow records the affected control and resolves it through corrected evidence, a bounded remediation, or a truthful unresolved status + +#### Scenario: Relevant evidence changes +- **WHEN** the attestation, security policy, release process, or cited quality gate changes +- **THEN** the owner workflow re-verifies project 13754 and the live badge after the change merges diff --git a/openspec/specs/best-practices-score-completion/spec.md b/openspec/specs/best-practices-score-completion/spec.md new file mode 100644 index 0000000..638b487 --- /dev/null +++ b/openspec/specs/best-practices-score-completion/spec.md @@ -0,0 +1,45 @@ +## ADDED Requirements + +### Requirement: Live score reconciliation +The project SHALL maintain a reviewable reconciliation of bestpractices.dev project 13754 against the version-controlled `.bestpractices.json` attestation and the current Passing criteria. The reconciliation MUST identify every status mismatch and classify it as pending owner acceptance, unsupported repository evidence, or a service-side discrepancy. + +#### Scenario: Live project differs from the repository proposal +- **WHEN** an owner audits project 13754 and finds a control status or justification that differs from `.bestpractices.json` +- **THEN** the reconciliation records the control, both values, its classification, and the required follow-up + +#### Scenario: Repository evidence cannot support a live answer +- **WHEN** a live answer cannot be justified by public evidence or a confirmed maintainer attestation +- **THEN** the owner workflow does not save it as `Met` and records a remediation or correction + +### Requirement: Authorized owner acceptance and verification +The project SHALL document an authorized-editor procedure for reviewing and saving accurate repository proposals in project 13754. The procedure MUST verify the resulting project state and live badge without storing credentials or automating authenticated service writes. + +#### Scenario: Accurate proposals are ready for acceptance +- **WHEN** the repository manifest has merged and the reconciliation finds only pending owner acceptance +- **THEN** an authorized editor reviews and saves the proposals in project 13754 and records the resulting score and badge state + +#### Scenario: Service update does not propagate +- **WHEN** the saved project state or badge does not reflect the reviewed answers after the documented propagation interval +- **THEN** the workflow records the discrepancy and directs the owner to inspect or correct the service-side project state + +### Requirement: Score-gap remediation lifecycle +Every repository-controlled control that prevents the intended Passing score SHALL have a bounded remediation that corrects evidence, documentation, or enforcement and is validated through the standard repository workflow. Controls requiring unavailable or private facts SHALL remain explicitly unresolved rather than receiving an unsupported claim. + +#### Scenario: Repository-controlled gap is identified +- **WHEN** reconciliation identifies a control whose required evidence or enforcement is absent from the repository +- **THEN** the follow-up defines the narrow remediation and its offline validation before the control is proposed as `Met` + +#### Scenario: Private fact remains unavailable +- **WHEN** a control depends on a fact the maintainer cannot confirm +- **THEN** the attestation retains a truthful `N/A` status where allowed or records the control as unresolved + +### Requirement: Periodic live-score re-verification +The project SHALL require re-verification of project 13754 after an attestation, security-policy, release-process, or relevant criteria change. A live-score regression MUST produce a documented reconciliation and follow-up. + +#### Scenario: A relevant policy changes +- **WHEN** a change modifies `.bestpractices.json`, the security policy, release process, or a cited quality gate +- **THEN** the owner workflow rechecks the live project and badge after the change merges + +#### Scenario: The live score regresses +- **WHEN** project 13754 no longer reports the expected Passing score +- **THEN** the project records the affected controls and opens a remediation follow-up without changing repository claims speculatively