OpenSSF Gap Analysis
Summary
BoardReadyOps is close to a strong passing/silver OpenSSF posture. Gold is not a current target because this is intentionally a solo-maintainer project. The main gaps are required status-check enforcement, review evidence, and optional future governance growth; not basic CI or documentation hygiene.
Passing-level gaps
| Gap |
Status |
Action |
| BadgeApp answer freshness |
Partial |
Update project 13378 with links to this evidence set. |
| Support policy discoverability |
Addressed |
SUPPORT.md added. |
| Maturity evidence register |
Addressed |
docs/repo-maturity-report.md and this file added. |
| NOTICE freshness |
Addressed |
Refresh NOTICE after dependency updates. |
Silver-level gaps
| Gap |
Status |
Action |
| Required status checks |
Partial |
Configure required CI checks on main branch protection/rulesets. |
| Review evidence |
Partial |
Require human review for public contract, release, governance, security, and workflow changes. |
| Dependency policy |
Addressed |
docs/development/dependency-management.md added. |
| Release integrity docs |
Addressed |
docs/security/release-integrity.md added. |
| Threat model depth |
Addressed |
docs/security/threat-model.md expanded. |
Gold/foundation-grade future-only gaps
Gold is not a current target. Keep this list only as future reference if the project grows beyond a solo-maintainer model.
| Gap |
Status |
Required evidence |
| Multiple active maintainers |
Missing |
At least two humans with sustained commits/reviews and documented responsibility. |
| Independent reviewer base |
Missing |
Recent PRs reviewed by someone other than the author or bot. |
| Human review regularity |
Partial |
Branch protection and repository culture prove regular review before merge. |
| Enforced status checks |
Partial |
Required checks configured on main. |
| SLSA/reproducible release depth |
Partial |
Stronger independent verification of binary reproducibility. |
| Governance sustainability |
Partial |
Maintainer rotation/addition policy exercised at least once. |
| Runtime plugin sandbox |
Missing |
Capability enforcement for third-party plugin code or explicit trusted-code model. |
Recommended tracking issues
- #2 v1 trusted plugin execution model documented; runtime isolation remains optional future hardening.
- #3 Done: mutation-nightly type-only file handling.
- #4 Done: docs accessibility flake resilience.
- #5 Done: required status checks configured for
main.
- Contributor and maintainer growth plan.
- Reproducible binary release verification plan.