From 685c11100d1657771b3a2d4ff11de84805f6f284 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Thu, 23 Jul 2026 23:57:39 +0300 Subject: [PATCH 01/31] docs: record OpenSSF remediation evidence Signed-off-by: kriptoburak --- OPENSSF.md | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 3 deletions(-) diff --git a/OPENSSF.md b/OPENSSF.md index f856789..aa38972 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -71,6 +71,50 @@ Repository-specific evidence must still prove the affected criterion. - Seventeen standalone projects have current Passing badges. - Seventeen standalone projects run required CI checks. +## Current Remediation Pull Requests + +These pull requests implement repository-specific technical remediation. + +Passing checks prove implementation, not independent review or default-branch adoption. + +| Repository | Pull Request | Verified Scope | +| --- | --- | --- | +| `hermes-tweet` | [#610](https://github.com/Xquik-dev/hermes-tweet/pull/610) | License notices, tests, coverage, and package checks | +| `n8n-nodes-xquik` | [#11](https://github.com/Xquik-dev/n8n-nodes-xquik/pull/11) | License notices, tests, security checks, and reproducible packages | +| `paperclip-plugin-xquik` | [#4](https://github.com/Xquik-dev/paperclip-plugin-xquik/pull/4) | License notices, tests, security checks, and reproducible packages | +| `prefect-xquik` | [#15](https://github.com/Xquik-dev/prefect-xquik/pull/15) | License notices, tests, security checks, and reproducible packages | +| `terraform-provider-x-twitter-scraper` | [#11](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/pull/11) | Coverage, releases, security, documentation, and reproducible builds | +| `tweetclaw` | [#21](https://github.com/Xquik-dev/tweetclaw/pull/21) | Security boundaries, tests, coverage, and public disclosures | +| `x-twitter-scraper` | [#19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) | Coverage, licensing, security, reproducibility, and public disclosures | +| `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | Coverage, cross-platform tests, licensing, releases, and public disclosures | +| `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | +| `xquik-haystack` | [#4](https://github.com/Xquik-dev/xquik-haystack/pull/4) | License notices, tests, and coverage | + +Each pull request requires a different human reviewer before merging. + +Do not count pending changes as default-branch evidence. + +## README & Repository Metadata + +All 19 public repository READMEs were audited on July 23, 2026. + +All default branches contain the approved independence disclosure. + +Fifteen default branches contain the exact unformatted footer. + +Four pending pull requests add that exact footer: + +- [Terraform provider #11](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/pull/11) +- [TweetClaw #21](https://github.com/Xquik-dev/tweetclaw/pull/21) +- [Core Skill and MCP package #19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) +- [CLI #13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) + +All repository descriptions identify their supported purpose. + +All descriptions include the compact independence notice. + +Topics remain specific to supported languages, workflows, and customer tasks. + ## Known Gold Gaps The organization currently has one member. @@ -80,15 +124,18 @@ It does not yet meet these Gold requirements: - A bus factor of 2 or more. - Two unassociated significant contributors per project. - Verifiable independent review for 50% of released modifications. -- Complete per-file copyright and license notices. +- A human security review completed within the last 5 years. + +Open remediation pull requests cannot satisfy these human requirements. These areas still need repository-specific verification: +- Per-file copyright and license notices on default branches. - Reproducible builds. -- Statement and branch coverage. +- Statement coverage of at least 90%. +- Branch coverage when a suitable FLOSS tool exists. - Signed release verification. - Architecture, threat model, and assurance evidence. -- Human security reviews completed within 5 years. - Dynamic analysis before major releases. Never mark a criterion as met without current public evidence. From b85a6601a76cf1420c0257b75fbaf8d91d5c11da Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Thu, 23 Jul 2026 23:59:37 +0300 Subject: [PATCH 02/31] docs: codify AI discoverability review Signed-off-by: kriptoburak --- REVIEWING.md | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/REVIEWING.md b/REVIEWING.md index 54e657f..6d738fd 100644 --- a/REVIEWING.md +++ b/REVIEWING.md @@ -27,6 +27,45 @@ Reviewers must check these areas: - The change preserves backward compatibility or documents migration. - Metadata stays descriptive, unique, accurate, and free from keyword stuffing. +## Discoverability & Agent Readability + +Write for customers first. + +Make public facts easy for search engines and agents to retrieve. + +- Give each README one specific H1. +- Explain the repository's purpose in the opening paragraph. +- Identify the intended user and supported integration surface. +- Provide a tested quick start for the repository's primary task. +- Map authentic customer tasks to supported public operations. +- Use natural task language in relevant headings and examples. +- Answer each real customer question once. +- Link canonical documentation for complete contracts. +- Keep commands, parameters, prerequisites, and expected results explicit. +- Label authentication requirements and write-side effects. +- Keep repository topics relevant to purpose, subject, workflow, or language. +- Use no more than 20 GitHub topics. +- Remove stale, duplicate, unsupported, or unverifiable claims. +- Preserve the approved X Corp. independence notice. + +Do not add keyword lists, hidden text, doorway pages, or query permutations. + +Do not add prompt-injection text or instructions aimed at language models. + +Do not create `llms.txt` solely for Google Search visibility. + +Never publish private implementation details to improve discoverability. + +## Primary Discoverability Sources + +Review these sources before changing this policy: + +- [GitHub README guidance](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes) +- [GitHub topic guidance](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics) +- [Google generative AI search guidance](https://developers.google.com/search/docs/fundamentals/ai-optimization-guide) +- [Google spam policies](https://developers.google.com/search/docs/essentials/spam-policies) +- [Bing Webmaster Guidelines](https://www.bing.com/webmasters/help/webmaster-guidelines-30fba23a) + ## Acceptance Approve only when every required check passes. From 87e6bc449257b6b71879e9ba568d5004f3dcf904 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 00:53:39 +0300 Subject: [PATCH 03/31] docs: record Go and TypeScript remediation PRs Signed-off-by: kriptoburak --- OPENSSF.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/OPENSSF.md b/OPENSSF.md index aa38972..9d71616 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -87,7 +87,9 @@ Passing checks prove implementation, not independent review or default-branch ad | `tweetclaw` | [#21](https://github.com/Xquik-dev/tweetclaw/pull/21) | Security boundaries, tests, coverage, and public disclosures | | `x-twitter-scraper` | [#19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) | Coverage, licensing, security, reproducibility, and public disclosures | | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | Coverage, cross-platform tests, licensing, releases, and public disclosures | +| `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | +| `x-twitter-scraper-typescript` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-typescript/pull/15) | Coverage, licensing, security checks, and reproducible packages | | `xquik-haystack` | [#4](https://github.com/Xquik-dev/xquik-haystack/pull/4) | License notices, tests, and coverage | Each pull request requires a different human reviewer before merging. From 2c9e8426fb9e87e43a340cb5958172b0124dcc5d Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 01:16:30 +0300 Subject: [PATCH 04/31] docs: record Terraform branch evidence Signed-off-by: kriptoburak --- OPENSSF.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPENSSF.md b/OPENSSF.md index 9d71616..fc4562e 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -83,7 +83,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `n8n-nodes-xquik` | [#11](https://github.com/Xquik-dev/n8n-nodes-xquik/pull/11) | License notices, tests, security checks, and reproducible packages | | `paperclip-plugin-xquik` | [#4](https://github.com/Xquik-dev/paperclip-plugin-xquik/pull/4) | License notices, tests, security checks, and reproducible packages | | `prefect-xquik` | [#15](https://github.com/Xquik-dev/prefect-xquik/pull/15) | License notices, tests, security checks, and reproducible packages | -| `terraform-provider-x-twitter-scraper` | [#11](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/pull/11) | Coverage, releases, security, documentation, and reproducible builds | +| `terraform-provider-x-twitter-scraper` | [#11](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/pull/11) | 93.6% statements, 82.31% branches, BSD notices, security, and reproducible releases | | `tweetclaw` | [#21](https://github.com/Xquik-dev/tweetclaw/pull/21) | Security boundaries, tests, coverage, and public disclosures | | `x-twitter-scraper` | [#19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) | Coverage, licensing, security, reproducibility, and public disclosures | | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | Coverage, cross-platform tests, licensing, releases, and public disclosures | From c9f314be07469770eb36a64ec1bc98e8e2287fd7 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 01:25:30 +0300 Subject: [PATCH 05/31] docs: record CLI branch coverage evidence Signed-off-by: kriptoburak --- OPENSSF.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPENSSF.md b/OPENSSF.md index fc4562e..0f53bc9 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -86,7 +86,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `terraform-provider-x-twitter-scraper` | [#11](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/pull/11) | 93.6% statements, 82.31% branches, BSD notices, security, and reproducible releases | | `tweetclaw` | [#21](https://github.com/Xquik-dev/tweetclaw/pull/21) | Security boundaries, tests, coverage, and public disclosures | | `x-twitter-scraper` | [#19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) | Coverage, licensing, security, reproducibility, and public disclosures | -| `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | Coverage, cross-platform tests, licensing, releases, and public disclosures | +| `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | 91.2% statements, 80.09% branches, BSD notices, portability, and reproducible releases | | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | | `x-twitter-scraper-typescript` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-typescript/pull/15) | Coverage, licensing, security checks, and reproducible packages | From d4a89a69c33bca59833c64316766226e1069232e Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 01:54:09 +0300 Subject: [PATCH 06/31] docs: record Python Gold controls Signed-off-by: kriptoburak --- OPENSSF.md | 1 + 1 file changed, 1 insertion(+) diff --git a/OPENSSF.md b/OPENSSF.md index 0f53bc9..ddec406 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -88,6 +88,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `x-twitter-scraper` | [#19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) | Coverage, licensing, security, reproducibility, and public disclosures | | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | 91.2% statements, 80.09% branches, BSD notices, portability, and reproducible releases | | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | +| `x-twitter-scraper-python` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-python/pull/18) | 94.19% statements, 80.89% branches, licensing, security, and reproducible packages | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | | `x-twitter-scraper-typescript` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-typescript/pull/15) | Coverage, licensing, security checks, and reproducible packages | | `xquik-haystack` | [#4](https://github.com/Xquik-dev/xquik-haystack/pull/4) | License notices, tests, and coverage | From 957b4487e403127d6a4604dad896b74f18e0fe8b Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 02:32:51 +0300 Subject: [PATCH 07/31] docs: add PHP Gold remediation evidence Signed-off-by: kriptoburak --- OPENSSF.md | 1 + 1 file changed, 1 insertion(+) diff --git a/OPENSSF.md b/OPENSSF.md index ddec406..4a18ab0 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -88,6 +88,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `x-twitter-scraper` | [#19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) | Coverage, licensing, security, reproducibility, and public disclosures | | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | 91.2% statements, 80.09% branches, BSD notices, portability, and reproducible releases | | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | +| `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 89.25% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-python` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-python/pull/18) | 94.19% statements, 80.89% branches, licensing, security, and reproducible packages | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | | `x-twitter-scraper-typescript` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-typescript/pull/15) | Coverage, licensing, security checks, and reproducible packages | From 5733298897e89fa3d1335e8f6bb0bcae47285f36 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 03:03:45 +0300 Subject: [PATCH 08/31] docs: record C# Gold controls Signed-off-by: kriptoburak --- OPENSSF.md | 1 + 1 file changed, 1 insertion(+) diff --git a/OPENSSF.md b/OPENSSF.md index 4a18ab0..9126ff4 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -87,6 +87,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `tweetclaw` | [#21](https://github.com/Xquik-dev/tweetclaw/pull/21) | Security boundaries, tests, coverage, and public disclosures | | `x-twitter-scraper` | [#19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) | Coverage, licensing, security, reproducibility, and public disclosures | | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | 91.2% statements, 80.09% branches, BSD notices, portability, and reproducible releases | +| `x-twitter-scraper-csharp` | [#19](https://github.com/Xquik-dev/x-twitter-scraper-csharp/pull/19) | 94.28% lines, 89.20% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | | `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 89.25% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-python` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-python/pull/18) | 94.19% statements, 80.89% branches, licensing, security, and reproducible packages | From e445d54d36c6d45e5372d104e66ae7ec0e795d0e Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 03:11:11 +0300 Subject: [PATCH 09/31] docs: correct PHP branch evidence Signed-off-by: kriptoburak --- OPENSSF.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPENSSF.md b/OPENSSF.md index 9126ff4..b60ccc7 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -89,7 +89,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | 91.2% statements, 80.09% branches, BSD notices, portability, and reproducible releases | | `x-twitter-scraper-csharp` | [#19](https://github.com/Xquik-dev/x-twitter-scraper-csharp/pull/19) | 94.28% lines, 89.20% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | -| `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 89.25% branches, security fixes, licensing, and reproducible packages | +| `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 88.05% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-python` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-python/pull/18) | 94.19% statements, 80.89% branches, licensing, security, and reproducible packages | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | | `x-twitter-scraper-typescript` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-typescript/pull/15) | Coverage, licensing, security checks, and reproducible packages | From 358698681b2d1cd4fa3032f80a15f1b31d1da3b0 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 04:19:26 +0300 Subject: [PATCH 10/31] docs: add Java SDK Gold evidence Signed-off-by: kriptoburak --- OPENSSF.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/OPENSSF.md b/OPENSSF.md index b60ccc7..97c7b25 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -89,6 +89,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | 91.2% statements, 80.09% branches, BSD notices, portability, and reproducible releases | | `x-twitter-scraper-csharp` | [#19](https://github.com/Xquik-dev/x-twitter-scraper-csharp/pull/19) | 94.28% lines, 89.20% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | +| `x-twitter-scraper-java` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-java/pull/14) | 90.52% maintained lines, 80.77% branches, fuzzing, security, licensing, and reproducibility | | `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 88.05% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-python` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-python/pull/18) | 94.19% statements, 80.89% branches, licensing, security, and reproducible packages | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | @@ -99,6 +100,12 @@ Each pull request requires a different human reviewer before merging. Do not count pending changes as default-branch evidence. +The Java SDK also publishes its generated-inclusive coverage. + +That raw report shows 41.31% lines and 21.79% branches. + +Generated-code coverage applicability remains an explicit assessment gap. + ## README & Repository Metadata All 19 public repository READMEs were audited on July 23, 2026. From 71de3a65495890519d3c244420d85ed58c1b7e94 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 04:48:53 +0300 Subject: [PATCH 11/31] docs: add Kotlin SDK Gold evidence Signed-off-by: kriptoburak --- OPENSSF.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/OPENSSF.md b/OPENSSF.md index 97c7b25..fea51a9 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -90,6 +90,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `x-twitter-scraper-csharp` | [#19](https://github.com/Xquik-dev/x-twitter-scraper-csharp/pull/19) | 94.28% lines, 89.20% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | | `x-twitter-scraper-java` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-java/pull/14) | 90.52% maintained lines, 80.77% branches, fuzzing, security, licensing, and reproducibility | +| `x-twitter-scraper-kotlin` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-kotlin/pull/14) | 91.06% maintained lines, 80.56% branches, fuzzing, security, licensing, and reproducibility | | `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 88.05% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-python` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-python/pull/18) | 94.19% statements, 80.89% branches, licensing, security, and reproducible packages | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | @@ -100,9 +101,11 @@ Each pull request requires a different human reviewer before merging. Do not count pending changes as default-branch evidence. -The Java SDK also publishes its generated-inclusive coverage. +The Java and Kotlin SDKs publish generated-inclusive coverage. -That raw report shows 41.31% lines and 21.79% branches. +Java reports 41.31% lines and 21.79% branches. + +Kotlin reports 39.19% lines and 20.54% branches. Generated-code coverage applicability remains an explicit assessment gap. From b9e40bad3a8d18887df279af2e915fb3dc7a3994 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 05:35:33 +0300 Subject: [PATCH 12/31] docs: record shared-site assurance PR Signed-off-by: kriptoburak --- OPENSSF.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/OPENSSF.md b/OPENSSF.md index fea51a9..e753374 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -73,7 +73,7 @@ Repository-specific evidence must still prove the affected criterion. ## Current Remediation Pull Requests -These pull requests implement repository-specific technical remediation. +These pull requests implement project-specific and shared-site technical remediation. Passing checks prove implementation, not independent review or default-branch adoption. @@ -96,6 +96,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | | `x-twitter-scraper-typescript` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-typescript/pull/15) | Coverage, licensing, security checks, and reproducible packages | | `xquik-haystack` | [#4](https://github.com/Xquik-dev/xquik-haystack/pull/4) | License notices, tests, and coverage | +| `xquik-docs` | [#17](https://github.com/Xquik-dev/xquik-docs/pull/17) | Shared-site classification, 282 tests, dependency integrity, licensing, security, and static validation | Each pull request requires a different human reviewer before merging. From 291d7d96e3f1ec3e607f00c3100804612d2d76dd Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 06:24:38 +0300 Subject: [PATCH 13/31] docs: record final OpenSSF audit snapshot Signed-off-by: kriptoburak --- OPENSSF.md | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/OPENSSF.md b/OPENSSF.md index e753374..b9ba847 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -51,6 +51,16 @@ Use each live entry for current status and submitted evidence. | `x-twitter-scraper-typescript` | [OpenSSF project 13740](https://www.bestpractices.dev/projects/13740) | | `xquik-haystack` | [OpenSSF project 13741](https://www.bestpractices.dev/projects/13741) | +## July 24, 2026 Audit Snapshot + +- Xquik-dev has 19 public repositories. +- Seventeen repositories are standalone software projects. +- All 17 live entries report Passing at 100%. +- All 17 entries report Silver completion at 7%. +- Fifteen entries report Gold completion at 9%. +- `n8n-nodes-xquik` and `x-twitter-scraper` report Gold completion at 22%. +- Latest required checks pass on every ready remediation pull request. + ## Shared Evidence These documents support repository-specific badge evidence: @@ -79,6 +89,7 @@ Passing checks prove implementation, not independent review or default-branch ad | Repository | Pull Request | Verified Scope | | --- | --- | --- | +| `.github` | [#2](https://github.com/Xquik-dev/.github/pull/2) | Shared governance, badge inventory, and public contract verification | | `hermes-tweet` | [#610](https://github.com/Xquik-dev/hermes-tweet/pull/610) | License notices, tests, coverage, and package checks | | `n8n-nodes-xquik` | [#11](https://github.com/Xquik-dev/n8n-nodes-xquik/pull/11) | License notices, tests, security checks, and reproducible packages | | `paperclip-plugin-xquik` | [#4](https://github.com/Xquik-dev/paperclip-plugin-xquik/pull/4) | License notices, tests, security checks, and reproducible packages | @@ -91,7 +102,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | | `x-twitter-scraper-java` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-java/pull/14) | 90.52% maintained lines, 80.77% branches, fuzzing, security, licensing, and reproducibility | | `x-twitter-scraper-kotlin` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-kotlin/pull/14) | 91.06% maintained lines, 80.56% branches, fuzzing, security, licensing, and reproducibility | -| `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 88.05% branches, security fixes, licensing, and reproducible packages | +| `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 83.07% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-python` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-python/pull/18) | 94.19% statements, 80.89% branches, licensing, security, and reproducible packages | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | | `x-twitter-scraper-typescript` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-typescript/pull/15) | Coverage, licensing, security checks, and reproducible packages | @@ -110,9 +121,16 @@ Kotlin reports 39.19% lines and 20.54% branches. Generated-code coverage applicability remains an explicit assessment gap. +## Pre-Existing Pull Request Audit + +- Core [#9](https://github.com/Xquik-dev/x-twitter-scraper/pull/9) remains a conflicting draft. +- Core [#10](https://github.com/Xquik-dev/x-twitter-scraper/pull/10) remains a behind-base draft. +- Both drafts contain explicit release blocks. +- Do not update, merge, tag, or publish either draft. + ## README & Repository Metadata -All 19 public repository READMEs were audited on July 23, 2026. +All 19 public repository READMEs were audited on July 24, 2026. All default branches contain the approved independence disclosure. From 92b63425f1386bb8378b10debfafa4ac7edcc48c Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 06:31:56 +0300 Subject: [PATCH 14/31] docs: record enforced default branch reviews Signed-off-by: kriptoburak --- OPENSSF.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/OPENSSF.md b/OPENSSF.md index b9ba847..72104b5 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -78,6 +78,11 @@ Repository-specific evidence must still prove the affected criterion. - GitHub requires two-factor authentication for organization members. - Every public repository supports private vulnerability reporting. +- Every default branch requires 1 current approval. +- The last pusher cannot provide that approval. +- Administrators cannot bypass required checks or reviews. +- Every default branch dismisses stale reviews and requires resolved conversations. +- Every default branch blocks force pushes and deletion. - Seventeen standalone projects have current Passing badges. - Seventeen standalone projects run required CI checks. From 5871cf112c3aaf207d824fddb13e85c446ae2335 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 06:55:31 +0300 Subject: [PATCH 15/31] docs: record verified Gold blockers Signed-off-by: kriptoburak --- OPENSSF.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/OPENSSF.md b/OPENSSF.md index 72104b5..a09ab14 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -56,9 +56,11 @@ Use each live entry for current status and submitted evidence. - Xquik-dev has 19 public repositories. - Seventeen repositories are standalone software projects. - All 17 live entries report Passing at 100%. -- All 17 entries report Silver completion at 7%. -- Fifteen entries report Gold completion at 9%. -- `n8n-nodes-xquik` and `x-twitter-scraper` report Gold completion at 22%. +- All 17 entries report Silver completion at 9%. +- Fifteen entries report Gold completion at 13%. +- `n8n-nodes-xquik` and `x-twitter-scraper` report Gold completion at 26%. +- All 17 entries mark 4 verified human requirements as Unmet. +- Each entry includes dated remediation guidance for those requirements. - Latest required checks pass on every ready remediation pull request. ## Shared Evidence From ba933e79e380ea59481cc1e11611d037628f2d4f Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 08:24:42 +0300 Subject: [PATCH 16/31] docs: record final hosted verification state Signed-off-by: kriptoburak --- OPENSSF.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/OPENSSF.md b/OPENSSF.md index a09ab14..afbb7e7 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -62,6 +62,8 @@ Use each live entry for current status and submitted evidence. - All 17 entries mark 4 verified human requirements as Unmet. - Each entry includes dated remediation guidance for those requirements. - Latest required checks pass on every ready remediation pull request. +- All 19 ready remediation pull requests are mergeable. +- All 21 open pull requests have zero unresolved review threads. ## Shared Evidence @@ -101,7 +103,7 @@ Passing checks prove implementation, not independent review or default-branch ad | `n8n-nodes-xquik` | [#11](https://github.com/Xquik-dev/n8n-nodes-xquik/pull/11) | License notices, tests, security checks, and reproducible packages | | `paperclip-plugin-xquik` | [#4](https://github.com/Xquik-dev/paperclip-plugin-xquik/pull/4) | License notices, tests, security checks, and reproducible packages | | `prefect-xquik` | [#15](https://github.com/Xquik-dev/prefect-xquik/pull/15) | License notices, tests, security checks, and reproducible packages | -| `terraform-provider-x-twitter-scraper` | [#11](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/pull/11) | 93.6% statements, 82.31% branches, BSD notices, security, and reproducible releases | +| `terraform-provider-x-twitter-scraper` | [#11](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/pull/11) | 93.6% statements, 82.45% branches, race-safe JSON encoding, BSD notices, security, and reproducible releases | | `tweetclaw` | [#21](https://github.com/Xquik-dev/tweetclaw/pull/21) | Security boundaries, tests, coverage, and public disclosures | | `x-twitter-scraper` | [#19](https://github.com/Xquik-dev/x-twitter-scraper/pull/19) | Coverage, licensing, security, reproducibility, and public disclosures | | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | 91.2% statements, 80.09% branches, BSD notices, portability, and reproducible releases | From 5546c95bbf2ef9ed67ffa3eec46c2128b3c8bcc0 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 09:01:53 +0300 Subject: [PATCH 17/31] docs: record complete Silver and Gold assessments Signed-off-by: kriptoburak --- OPENSSF.md | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/OPENSSF.md b/OPENSSF.md index afbb7e7..eba501c 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -56,9 +56,12 @@ Use each live entry for current status and submitted evidence. - Xquik-dev has 19 public repositories. - Seventeen repositories are standalone software projects. - All 17 live entries report Passing at 100%. -- All 17 entries report Silver completion at 9%. -- Fifteen entries report Gold completion at 13%. -- `n8n-nodes-xquik` and `x-twitter-scraper` report Gold completion at 26%. +- All 17 entries report Silver completion at 84%. +- Fifteen entries report Gold completion at 30%. +- `n8n-nodes-xquik` and `x-twitter-scraper` report Gold completion at 43%. +- All 55 Silver and 23 Gold fields have explicit classifications. +- No Silver or Gold field remains unknown. +- Every required Silver explanation and evidence URL is present. - All 17 entries mark 4 verified human requirements as Unmet. - Each entry includes dated remediation guidance for those requirements. - Latest required checks pass on every ready remediation pull request. @@ -162,7 +165,11 @@ Topics remain specific to supported languages, workflows, and customer tasks. The organization currently has one member. -It does not yet meet these Gold requirements: +It does not yet meet this required Silver prerequisite: + +- Access continuity after the loss of the sole organization member. + +It does not yet meet these human Gold requirements: - A bus factor of 2 or more. - Two unassociated significant contributors per project. @@ -171,15 +178,18 @@ It does not yet meet these Gold requirements: Open remediation pull requests cannot satisfy these human requirements. -These areas still need repository-specific verification: +These Silver and Gold areas still need default-branch evidence: +- Repository-specific architecture and assurance cases. +- Repeatable and reproducible builds. +- A 6-month regression-test ratio. +- Statement coverage of at least 80% and 90%. +- Secure-design and input-validation evidence. +- Signed releases and public verification instructions. - Per-file copyright and license notices on default branches. -- Reproducible builds. -- Statement coverage of at least 90%. - Branch coverage when a suitable FLOSS tool exists. -- Signed release verification. -- Architecture, threat model, and assurance evidence. - Dynamic analysis before major releases. +- Requested debug-information preservation where applicable. Never mark a criterion as met without current public evidence. From f765575c4af945f2fdd8091f2167b4b75202d548 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 09:05:43 +0300 Subject: [PATCH 18/31] docs: add shared security assurance case Signed-off-by: kriptoburak --- ASSURANCE.md | 157 ++++++++++++++++++++++++++++++ OPENSSF.md | 1 + scripts/check-public-contract.mjs | 10 ++ 3 files changed, 168 insertions(+) create mode 100644 ASSURANCE.md diff --git a/ASSURANCE.md b/ASSURANCE.md new file mode 100644 index 0000000..43dd132 --- /dev/null +++ b/ASSURANCE.md @@ -0,0 +1,157 @@ +# Public Project Architecture & Security Assurance + +This assurance case covers every standalone public Xquik-dev project. + +It documents shared architecture, trust boundaries, threats, controls, and residual risks. + +Repository evidence must still prove each project-specific claim. + +## Project Architecture + +Public projects use this common request flow: + +1. A caller supplies task parameters and credentials. +2. The project maps inputs into a documented Xquik request. +3. A maintained runtime sends the request through HTTPS. +4. The project parses the documented public response. +5. The caller controls storage, display, and downstream use. + +The hosted Xquik service has a separate operational boundary. + +Public repositories exclude its private implementation and infrastructure. + +### Project Families + +| Projects | Released Components | Primary Boundary | +| --- | --- | --- | +| `hermes-tweet`, `n8n-nodes-xquik`, `paperclip-plugin-xquik`, `prefect-xquik`, `tweetclaw`, `xquik-haystack` | Host adapter, configuration mapping, client call, and response mapping | Host runtime to the public Xquik API | +| `terraform-provider-x-twitter-scraper` | Provider configuration, resources, data sources, API client, and state mapping | Terraform configuration and state to the public Xquik API | +| `x-twitter-scraper` | Skill instructions, MCP tools, request schemas, and client operations | Agent host or MCP caller to the public Xquik API | +| `x-twitter-scraper-cli` | Command parser, API client, output formatter, and release binary | Local process to the public Xquik API | +| `x-twitter-scraper-csharp`, `x-twitter-scraper-go`, `x-twitter-scraper-java`, `x-twitter-scraper-kotlin`, `x-twitter-scraper-php`, `x-twitter-scraper-python`, `x-twitter-scraper-ruby`, `x-twitter-scraper-typescript` | Service facades, request models, transport, response models, and errors | Application process to the public Xquik API | + +Generated SDK files mirror the public API contract. + +Maintained runtime code owns transport and safety behavior. + +Package managers own dependency resolution and installation. + +GitHub Actions owns public build, test, analysis, and release automation. + +### Trust Boundaries + +| Boundary | Untrusted Input | Required Handling | +| --- | --- | --- | +| Caller to project | Arguments, identifiers, URLs, files, and output options | Apply available type, schema, range, and format checks | +| Project to network | Base URL, headers, credentials, and request bodies | Default to HTTPS and verify TLS certificates | +| Network to project | Status codes, headers, JSON, text, and files | Parse defensively and bound retry behavior | +| Project to host | Returned records, files, logs, and errors | Preserve documented types and avoid secret disclosure | +| Source to release | Dependencies, generators, workflows, and artifacts | Pin, review, scan, test, and verify outputs | + +Applications remain responsible for their own authorization and data retention. + +Callers must protect exported data and credentials. + +## Security Requirements + +The shared [security policy](SECURITY.md) defines response and disclosure requirements. + +Each public project must preserve these claims: + +| Claim | Required Property | +| --- | --- | +| Credential confidentiality | Credentials stay outside source, URLs, outputs, and ordinary logs | +| Secure transport | Default endpoints use HTTPS with TLS 1.2 or newer | +| Certificate verification | Maintained runtimes verify certificates before sending credentials | +| Contract integrity | Requests and responses follow documented public schemas | +| Input safety | Restricted inputs use positive type, range, or format checks | +| Output safety | Remote content remains data and is never executed implicitly | +| Supply-chain integrity | Dependencies and workflows remain reviewable, pinned, and scanned | +| Release integrity | Published artifacts remain reproducible and cryptographically verifiable | + +## Threat Model + +### Protected Assets + +- API credentials and authorization headers +- Customer-selected identifiers and exported records +- Public API and package contracts +- Source, workflows, tags, and release artifacts +- Vulnerability reports before coordinated disclosure + +### Threat Actors + +- A caller supplying malformed or hostile input +- A remote endpoint returning malformed content +- A compromised or obsolete dependency +- A malicious contribution or workflow change +- A compromised distribution path +- An accidental maintainer error + +### Threats & Controls + +| Threat | Primary Controls | Residual Risk | +| --- | --- | --- | +| Credential disclosure | Separate configuration, HTTPS defaults, redaction, and review | Host applications can still log or expose supplied credentials | +| Endpoint redirection | Trusted defaults, certificate verification, and redirect guards | Explicit caller overrides can choose a less safe endpoint | +| Malformed remote data | Typed decoding, schema tests, bounds, and generic errors | Callers must safely handle returned content | +| Resource exhaustion | Bounded retries, capped delays, timeouts, and pagination controls | Large requested exports still consume caller resources | +| Dependency compromise | Lock data, Dependabot, audits, CodeQL, and least privilege | Newly disclosed vulnerabilities need timely remediation | +| Workflow compromise | Immutable action pins, restricted permissions, and required review | The sole maintainer remains an access-continuity risk | +| Artifact substitution | Reproducibility, checksums, provenance, and signing | Public verification remains incomplete for some projects | + +## Secure Design Argument + +The projects apply these secure-design principles: + +- Fail-safe defaults use HTTPS and maintained certificate verification. +- Least privilege limits workflow permissions and credential scope. +- Complete mediation routes network access through maintained transports. +- Economy of mechanism relies on standard runtimes and package managers. +- Separation keeps credentials outside source and ordinary configuration examples. +- Open design keeps public contracts, checks, and security policies reviewable. + +The current evidence register links each pending technical control. + +See [OpenSSF Best Practices Evidence](OPENSSF.md). + +## Common Weakness Countermeasures + +| Weakness | Countermeasure | +| --- | --- | +| CWE-20 improper input validation | Typed request models, schema checks, range checks, and regression tests | +| CWE-200 information exposure | Secret-free examples, redaction, generic errors, and private reporting | +| CWE-400 uncontrolled resource consumption | Retry caps, bounded delays, pagination, and timeout controls | +| CWE-601 open redirect | Maintained transports restrict credential-forwarding redirects | +| CWE-829 untrusted components | Machine-readable dependencies, lock data, audits, and update automation | +| CWE-918 server-side request forgery | Trusted default endpoints and isolated network tests | + +Not every weakness applies to every project family. + +Repository tests must demonstrate each applicable countermeasure. + +## Assurance Status + +Passing badges and public policies provide baseline evidence. + +Ready remediation pull requests provide verified technical evidence. + +Pending changes do not count as default-branch evidence. + +The organization still lacks required continuity and independent human evidence. + +Release signing and 6-month regression ratios also need complete public proof. + +Never claim Silver or Gold while a mandatory criterion remains unmet. + +## Maintenance + +Run repository checks before every release. + +Reassess threats after public contract or trust-boundary changes. + +Review this case after incidents, vulnerabilities, and major releases. + +Update badge answers only from public default-branch evidence. + +Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp. diff --git a/OPENSSF.md b/OPENSSF.md index eba501c..4df53b3 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -76,6 +76,7 @@ These documents support repository-specific badge evidence: - [Governance and public roles](GOVERNANCE.md) - [Code review requirements](REVIEWING.md) - [Vulnerability response process](SECURITY.md) +- [Architecture and security assurance](ASSURANCE.md) - [Code of Conduct](CODE_OF_CONDUCT.md) - [Twelve-month roadmap](ROADMAP.md) diff --git a/scripts/check-public-contract.mjs b/scripts/check-public-contract.mjs index b18842d..116f078 100644 --- a/scripts/check-public-contract.mjs +++ b/scripts/check-public-contract.mjs @@ -11,6 +11,16 @@ const HTTP_METHODS = new Set(["delete", "get", "head", "options", "patch", "post const INDEPENDENCE_NOTICE = 'Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.'; const COMMUNITY_POLICY_REQUIREMENTS = new Map([ + [ + "ASSURANCE.md", + [ + "## Project Architecture", + "## Threat Model", + "## Secure Design Argument", + "## Common Weakness Countermeasures", + "Pending changes do not count as default-branch evidence.", + ], + ], ["CODE_OF_CONDUCT.md", ["## Enforcement", "support@xquik.com"]], [ "CONTRIBUTING.md", From bf6696a082bc5835577bfc969098e94a9641f62a Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 09:13:07 +0300 Subject: [PATCH 19/31] docs: index Gold newcomer tasks Signed-off-by: kriptoburak --- OPENSSF.md | 33 +++++++++++++++++++++++++++++-- scripts/check-public-contract.mjs | 8 +++++++- 2 files changed, 38 insertions(+), 3 deletions(-) diff --git a/OPENSSF.md b/OPENSSF.md index 4df53b3..8057d00 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -57,13 +57,14 @@ Use each live entry for current status and submitted evidence. - Seventeen repositories are standalone software projects. - All 17 live entries report Passing at 100%. - All 17 entries report Silver completion at 84%. -- Fifteen entries report Gold completion at 30%. -- `n8n-nodes-xquik` and `x-twitter-scraper` report Gold completion at 43%. +- Fifteen entries report Gold completion at 35%. +- `n8n-nodes-xquik` and `x-twitter-scraper` report Gold completion at 48%. - All 55 Silver and 23 Gold fields have explicit classifications. - No Silver or Gold field remains unknown. - Every required Silver explanation and evidence URL is present. - All 17 entries mark 4 verified human requirements as Unmet. - Each entry includes dated remediation guidance for those requirements. +- All 17 projects expose a scoped newcomer task. - Latest required checks pass on every ready remediation pull request. - All 19 ready remediation pull requests are mergeable. - All 21 open pull requests have zero unresolved review threads. @@ -82,6 +83,34 @@ These documents support repository-specific badge evidence: Repository-specific evidence must still prove the affected criterion. +## Newcomer Tasks + +Each standalone project exposes one open, scoped task. + +Every task has `good first issue` and `help wanted` labels. + +| Repository | Task | +| --- | --- | +| `hermes-tweet` | [#611](https://github.com/Xquik-dev/hermes-tweet/issues/611) | +| `n8n-nodes-xquik` | [#12](https://github.com/Xquik-dev/n8n-nodes-xquik/issues/12) | +| `paperclip-plugin-xquik` | [#5](https://github.com/Xquik-dev/paperclip-plugin-xquik/issues/5) | +| `prefect-xquik` | [#16](https://github.com/Xquik-dev/prefect-xquik/issues/16) | +| `terraform-provider-x-twitter-scraper` | [#12](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/issues/12) | +| `tweetclaw` | [#27](https://github.com/Xquik-dev/tweetclaw/issues/27) | +| `x-twitter-scraper` | [#20](https://github.com/Xquik-dev/x-twitter-scraper/issues/20) | +| `x-twitter-scraper-cli` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-cli/issues/14) | +| `x-twitter-scraper-csharp` | [#20](https://github.com/Xquik-dev/x-twitter-scraper-csharp/issues/20) | +| `x-twitter-scraper-go` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-go/issues/15) | +| `x-twitter-scraper-java` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-java/issues/15) | +| `x-twitter-scraper-kotlin` | [#15](https://github.com/Xquik-dev/x-twitter-scraper-kotlin/issues/15) | +| `x-twitter-scraper-php` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-php/issues/13) | +| `x-twitter-scraper-python` | [#19](https://github.com/Xquik-dev/x-twitter-scraper-python/issues/19) | +| `x-twitter-scraper-ruby` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-ruby/issues/18) | +| `x-twitter-scraper-typescript` | [#16](https://github.com/Xquik-dev/x-twitter-scraper-typescript/issues/16) | +| `xquik-haystack` | [#5](https://github.com/Xquik-dev/xquik-haystack/issues/5) | + +These tasks satisfy the Gold `small_tasks` evidence requirement. + ## Verified Organization Controls - GitHub requires two-factor authentication for organization members. diff --git a/scripts/check-public-contract.mjs b/scripts/check-public-contract.mjs index 116f078..58bf9c5 100644 --- a/scripts/check-public-contract.mjs +++ b/scripts/check-public-contract.mjs @@ -32,7 +32,13 @@ const COMMUNITY_POLICY_REQUIREMENTS = new Map([ ], [ "OPENSSF.md", - ["17 standalone software projects", "xquik-docs", "Known Gold Gaps"], + [ + "17 standalone software projects", + "xquik-docs", + "## Newcomer Tasks", + "These tasks satisfy the Gold `small_tasks` evidence requirement.", + "Known Gold Gaps", + ], ], ["REVIEWING.md", ["person other than the author", "At least 50%"]], ["ROADMAP.md", ["July 2027", "OpenSSF Best Practices"]], From 7e8cf0c3c0055d51224adc9082cc6fdaacc9d6ef Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 09:13:57 +0300 Subject: [PATCH 20/31] docs: link Gold human prerequisite tracker Signed-off-by: kriptoburak --- OPENSSF.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/OPENSSF.md b/OPENSSF.md index 8057d00..6954b1c 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -208,6 +208,8 @@ It does not yet meet these human Gold requirements: Open remediation pull requests cannot satisfy these human requirements. +Track human prerequisites in [organization issue #3](https://github.com/Xquik-dev/.github/issues/3). + These Silver and Gold areas still need default-branch evidence: - Repository-specific architecture and assurance cases. From c6bb48e5c12c96d7cc37500e1542bf7188c93752 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 09:21:08 +0300 Subject: [PATCH 21/31] docs: record release integrity verification Signed-off-by: kriptoburak --- OPENSSF.md | 4 + RELEASES.md | 150 ++++++++++++++++++++++++++++++ scripts/check-public-contract.mjs | 9 ++ 3 files changed, 163 insertions(+) create mode 100644 RELEASES.md diff --git a/OPENSSF.md b/OPENSSF.md index 6954b1c..dd5bff9 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -65,6 +65,9 @@ Use each live entry for current status and submitted evidence. - All 17 entries mark 4 verified human requirements as Unmet. - Each entry includes dated remediation guidance for those requirements. - All 17 projects expose a scoped newcomer task. +- Eleven projects have verified signed release artifacts. +- Six projects need project-controlled release signature evidence. +- All latest public Git tags remain unsigned. - Latest required checks pass on every ready remediation pull request. - All 19 ready remediation pull requests are mergeable. - All 21 open pull requests have zero unresolved review threads. @@ -78,6 +81,7 @@ These documents support repository-specific badge evidence: - [Code review requirements](REVIEWING.md) - [Vulnerability response process](SECURITY.md) - [Architecture and security assurance](ASSURANCE.md) +- [Release integrity and verification](RELEASES.md) - [Code of Conduct](CODE_OF_CONDUCT.md) - [Twelve-month roadmap](ROADMAP.md) diff --git a/RELEASES.md b/RELEASES.md new file mode 100644 index 0000000..71bc529 --- /dev/null +++ b/RELEASES.md @@ -0,0 +1,150 @@ +# Release Integrity & Verification + +This guide covers cryptographic verification for public Xquik-dev releases. + +Use public registry or GitHub evidence for every verification. + +Never trust a package because a signature merely exists. + +Verify the signer identity, repository, artifact digest, and expected workflow. + +## Evidence Status + +Assessment date: July 24, 2026. + +| Projects | Distribution | Current Public Evidence | +| --- | --- | --- | +| `n8n-nodes-xquik`, `paperclip-plugin-xquik`, `tweetclaw`, `x-twitter-scraper`, `x-twitter-scraper-typescript` | npm | Registry signature and SLSA provenance | +| `hermes-tweet`, `prefect-xquik`, `x-twitter-scraper-python`, `xquik-haystack` | PyPI | PEP 740 publish attestations | +| `terraform-provider-x-twitter-scraper` | GitHub Releases and Terraform Registry | GitHub SLSA provenance and signed checksums | +| `x-twitter-scraper-cli` | GitHub Releases | GitHub SLSA provenance | +| `x-twitter-scraper-csharp` | NuGet | Project-controlled signature evidence remains incomplete | +| `x-twitter-scraper-go` | Go modules | Project-controlled signature evidence remains incomplete | +| `x-twitter-scraper-java`, `x-twitter-scraper-kotlin` | Maven Central | Current public artifact and signature evidence remains incomplete | +| `x-twitter-scraper-php` | Packagist | Project-controlled signature evidence remains incomplete | +| `x-twitter-scraper-ruby` | RubyGems | Published gem certificate evidence remains incomplete | + +The first 11 projects have verifiable signed release artifacts. + +Their Silver badge answers still require default-branch documentation. + +The remaining 6 projects must add public cryptographic release evidence. + +## Verify npm Provenance + +The npm registry signs packages and publishes SLSA provenance. + +Install the package with a lockfile. + +Then run: + +```sh +npm audit signatures +``` + +Confirm the expected package name and Xquik-dev source repository. + +The supported public package names are: + +- `n8n-nodes-xquik` +- `@xquik/paperclip-plugin-xquik` +- `@xquik/tweetclaw` +- `x-developer` +- `x-twitter-scraper` + +## Verify PyPI Attestations + +PyPI publishes PEP 740 attestations for trusted releases. + +Copy the wheel URL from the project's PyPI Files page. + +Run: + +```sh +uvx --from pypi-attestations \ + pypi-attestations verify pypi \ + --repository https://github.com/Xquik-dev/PROJECT \ + WHEEL_URL +``` + +Replace `PROJECT` with the matching repository. + +Replace `WHEEL_URL` with the selected PyPI wheel URL. + +The verifier checks the artifact digest and trusted publisher identity. + +## Verify GitHub Attestations + +Download the selected release artifact. + +Run: + +```sh +gh attestation verify ARTIFACT --repo Xquik-dev/PROJECT +``` + +Replace `PROJECT` with the matching repository. + +Replace `ARTIFACT` with the downloaded file path. + +Require the SLSA provenance predicate. + +Confirm the subject digest matches the downloaded artifact. + +For stricter policy, also require the expected signer workflow. + +## Verify Terraform Checksums + +Download the checksum file, its signature, and the selected archive. + +Verify the checksum signature using the published Terraform Registry key. + +Then compare the selected archive: + +```sh +sha256sum --check terraform-provider-x-twitter-scraper_*_SHA256SUMS +``` + +Also verify the archive's GitHub attestation. + +## Keyless Signing + +npm, PyPI, and GitHub attestations use identity-bound signing. + +Their signing certificates use short-lived keys and public trust roots. + +Verification checks the repository identity and transparency-log timestamp. + +No long-lived project private signing key is required. + +## Unsigned Tags + +The latest public Git tags lacked verified Git signatures during this audit. + +Keep `version_tags_signed` Unmet until important tags are verifiable. + +Artifact attestations do not make an unsigned Git tag signed. + +## Release Requirements + +Before publishing: + +- Build from the protected default branch. +- Match the release version and source tag. +- Run every required test, analysis, and licensing check. +- Produce reproducible artifacts where the project builds artifacts. +- Publish cryptographic provenance or signatures. +- Keep signing authority outside the artifact distribution path. +- Document verification with public commands. + +After publishing: + +- Verify one public artifact as a consumer. +- Record the artifact digest and signer identity. +- Confirm registry propagation. +- Link security fixes from release notes. +- Stop the release when verification fails. + +Update OpenSSF answers only from current default-branch evidence. + +Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp. diff --git a/scripts/check-public-contract.mjs b/scripts/check-public-contract.mjs index 58bf9c5..f406c79 100644 --- a/scripts/check-public-contract.mjs +++ b/scripts/check-public-contract.mjs @@ -41,6 +41,15 @@ const COMMUNITY_POLICY_REQUIREMENTS = new Map([ ], ], ["REVIEWING.md", ["person other than the author", "At least 50%"]], + [ + "RELEASES.md", + [ + "## Verify npm Provenance", + "## Verify PyPI Attestations", + "## Verify GitHub Attestations", + "Keep `version_tags_signed` Unmet", + ], + ], ["ROADMAP.md", ["July 2027", "OpenSSF Best Practices"]], [ "SECURITY.md", From d0e5a9f2ee2ce45222771e184ada3474959bd255 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 09:21:42 +0300 Subject: [PATCH 22/31] docs: link remaining release evidence work Signed-off-by: kriptoburak --- RELEASES.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/RELEASES.md b/RELEASES.md index 71bc529..60df8aa 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -30,6 +30,8 @@ Their Silver badge answers still require default-branch documentation. The remaining 6 projects must add public cryptographic release evidence. +Track that work in [organization issue #4](https://github.com/Xquik-dev/.github/issues/4). + ## Verify npm Provenance The npm registry signs packages and publishes SLSA provenance. From 365654636f21abd56665c4cfa5c04b2bc82b63e8 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 09:28:22 +0300 Subject: [PATCH 23/31] docs: verify RubyGems release attestation Signed-off-by: kriptoburak --- .github/workflows/public-contract.yml | 2 ++ OPENSSF.md | 4 +-- RELEASES.md | 44 ++++++++++++++++++++++++--- scripts/check-public-contract.mjs | 2 ++ 4 files changed, 46 insertions(+), 6 deletions(-) diff --git a/.github/workflows/public-contract.yml b/.github/workflows/public-contract.yml index aea5e2f..871a239 100644 --- a/.github/workflows/public-contract.yml +++ b/.github/workflows/public-contract.yml @@ -10,10 +10,12 @@ on: - main paths: - ".github/workflows/public-contract.yml" + - "ASSURANCE.md" - "CODE_OF_CONDUCT.md" - "CONTRIBUTING.md" - "GOVERNANCE.md" - "OPENSSF.md" + - "RELEASES.md" - "REVIEWING.md" - "ROADMAP.md" - "SECURITY.md" diff --git a/OPENSSF.md b/OPENSSF.md index dd5bff9..c5d00b2 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -65,8 +65,8 @@ Use each live entry for current status and submitted evidence. - All 17 entries mark 4 verified human requirements as Unmet. - Each entry includes dated remediation guidance for those requirements. - All 17 projects expose a scoped newcomer task. -- Eleven projects have verified signed release artifacts. -- Six projects need project-controlled release signature evidence. +- Twelve projects have verified signed release artifacts. +- Five projects need project-controlled release signature evidence. - All latest public Git tags remain unsigned. - Latest required checks pass on every ready remediation pull request. - All 19 ready remediation pull requests are mergeable. diff --git a/RELEASES.md b/RELEASES.md index 60df8aa..a136c8c 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -18,17 +18,17 @@ Assessment date: July 24, 2026. | `hermes-tweet`, `prefect-xquik`, `x-twitter-scraper-python`, `xquik-haystack` | PyPI | PEP 740 publish attestations | | `terraform-provider-x-twitter-scraper` | GitHub Releases and Terraform Registry | GitHub SLSA provenance and signed checksums | | `x-twitter-scraper-cli` | GitHub Releases | GitHub SLSA provenance | +| `x-twitter-scraper-ruby` | RubyGems | Sigstore bundle bound to the published gem | | `x-twitter-scraper-csharp` | NuGet | Project-controlled signature evidence remains incomplete | | `x-twitter-scraper-go` | Go modules | Project-controlled signature evidence remains incomplete | | `x-twitter-scraper-java`, `x-twitter-scraper-kotlin` | Maven Central | Current public artifact and signature evidence remains incomplete | | `x-twitter-scraper-php` | Packagist | Project-controlled signature evidence remains incomplete | -| `x-twitter-scraper-ruby` | RubyGems | Published gem certificate evidence remains incomplete | -The first 11 projects have verifiable signed release artifacts. +The first 12 projects have verifiable signed release artifacts. Their Silver badge answers still require default-branch documentation. -The remaining 6 projects must add public cryptographic release evidence. +The remaining 5 projects must add public cryptographic release evidence. Track that work in [organization issue #4](https://github.com/Xquik-dev/.github/issues/4). @@ -75,6 +75,42 @@ Replace `WHEEL_URL` with the selected PyPI wheel URL. The verifier checks the artifact digest and trusted publisher identity. +## Verify RubyGems Attestations + +RubyGems publishes a Sigstore bundle for the current gem. + +Download the gem and its bundle: + +```sh +gem_file=x-twitter-scraper-0.5.4.gem +bundle_file="$gem_file.sigstore.json" + +curl --fail --location --output "$gem_file" \ + "https://rubygems.org/downloads/$gem_file" + +curl --fail --location \ + https://rubygems.org/api/v1/attestations/x-twitter-scraper-0.5.4.json \ + | jq '.[0]' > "$bundle_file" +``` + +Verify the exact workflow identity: + +```sh +gem exec sigstore-cli:0.2.3 verify \ + --bundle="$bundle_file" \ + --certificate-identity=https://github.com/Xquik-dev/x-twitter-scraper-ruby/.github/workflows/publish-gem.yml@refs/tags/v0.5.4 \ + --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ + "$gem_file" +``` + +Require an `OK` result for the downloaded artifact. + +The verified SHA-256 digest is: + +```text +ce55622baf95df9b6599db33a7a1627463be3735b891e93177a67f8875d3aaa8 +``` + ## Verify GitHub Attestations Download the selected release artifact. @@ -111,7 +147,7 @@ Also verify the archive's GitHub attestation. ## Keyless Signing -npm, PyPI, and GitHub attestations use identity-bound signing. +npm, PyPI, RubyGems, and GitHub attestations use identity-bound signing. Their signing certificates use short-lived keys and public trust roots. diff --git a/scripts/check-public-contract.mjs b/scripts/check-public-contract.mjs index f406c79..775aa83 100644 --- a/scripts/check-public-contract.mjs +++ b/scripts/check-public-contract.mjs @@ -46,7 +46,9 @@ const COMMUNITY_POLICY_REQUIREMENTS = new Map([ [ "## Verify npm Provenance", "## Verify PyPI Attestations", + "## Verify RubyGems Attestations", "## Verify GitHub Attestations", + "ce55622baf95df9b6599db33a7a1627463be3735b891e93177a67f8875d3aaa8", "Keep `version_tags_signed` Unmet", ], ], From 3d12e05e0cb7e765830639f52f0e47c2c311b3ee Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 10:52:34 +0300 Subject: [PATCH 24/31] docs: verify signed Maven releases Signed-off-by: kriptoburak --- OPENSSF.md | 16 ++++++++++------ RELEASES.md | 51 ++++++++++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 58 insertions(+), 9 deletions(-) diff --git a/OPENSSF.md b/OPENSSF.md index c5d00b2..baef6f6 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -65,12 +65,12 @@ Use each live entry for current status and submitted evidence. - All 17 entries mark 4 verified human requirements as Unmet. - Each entry includes dated remediation guidance for those requirements. - All 17 projects expose a scoped newcomer task. -- Twelve projects have verified signed release artifacts. -- Five projects need project-controlled release signature evidence. +- Fourteen projects have verified signed release artifacts. +- Three projects need project-controlled release signature evidence. - All latest public Git tags remain unsigned. - Latest required checks pass on every ready remediation pull request. - All 19 ready remediation pull requests are mergeable. -- All 21 open pull requests have zero unresolved review threads. +- All 22 open pull requests have zero unresolved review threads. ## Shared Evidence @@ -146,8 +146,8 @@ Passing checks prove implementation, not independent review or default-branch ad | `x-twitter-scraper-cli` | [#13](https://github.com/Xquik-dev/x-twitter-scraper-cli/pull/13) | 91.2% statements, 80.09% branches, BSD notices, portability, and reproducible releases | | `x-twitter-scraper-csharp` | [#19](https://github.com/Xquik-dev/x-twitter-scraper-csharp/pull/19) | 94.28% lines, 89.20% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-go` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-go/pull/14) | Coverage, race and fuzz tests, licensing, security, and reproducibility | -| `x-twitter-scraper-java` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-java/pull/14) | 90.52% maintained lines, 80.77% branches, fuzzing, security, licensing, and reproducibility | -| `x-twitter-scraper-kotlin` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-kotlin/pull/14) | 91.06% maintained lines, 80.56% branches, fuzzing, security, licensing, and reproducibility | +| `x-twitter-scraper-java` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-java/pull/14) | 90.52% maintained lines, 80.77% branches, fuzzing, security, licensing, reproducibility, and signed Maven releases | +| `x-twitter-scraper-kotlin` | [#14](https://github.com/Xquik-dev/x-twitter-scraper-kotlin/pull/14) | 91.06% maintained lines, 80.56% branches, fuzzing, security, licensing, reproducibility, and signed Maven releases | | `x-twitter-scraper-php` | [#12](https://github.com/Xquik-dev/x-twitter-scraper-php/pull/12) | 99.18% executable lines, 83.07% branches, security fixes, licensing, and reproducible packages | | `x-twitter-scraper-python` | [#18](https://github.com/Xquik-dev/x-twitter-scraper-python/pull/18) | 94.19% statements, 80.89% branches, licensing, security, and reproducible packages | | `x-twitter-scraper-ruby` | [#17](https://github.com/Xquik-dev/x-twitter-scraper-ruby/pull/17) | Bounded RubyGems release verification | @@ -167,12 +167,16 @@ Kotlin reports 39.19% lines and 20.54% branches. Generated-code coverage applicability remains an explicit assessment gap. -## Pre-Existing Pull Request Audit +## Other Open Pull Request Audit - Core [#9](https://github.com/Xquik-dev/x-twitter-scraper/pull/9) remains a conflicting draft. - Core [#10](https://github.com/Xquik-dev/x-twitter-scraper/pull/10) remains a behind-base draft. - Both drafts contain explicit release blocks. - Do not update, merge, tag, or publish either draft. +- Haystack [#6](https://github.com/Xquik-dev/xquik-haystack/pull/6) is an independent contribution for issue #5. +- Its added file passes Ruff, and all 18 unit tests pass locally. +- Required remote checks pass with zero unresolved review threads. +- GitHub still requires a post-push approval from another person. ## README & Repository Metadata diff --git a/RELEASES.md b/RELEASES.md index a136c8c..5b33b71 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -19,16 +19,16 @@ Assessment date: July 24, 2026. | `terraform-provider-x-twitter-scraper` | GitHub Releases and Terraform Registry | GitHub SLSA provenance and signed checksums | | `x-twitter-scraper-cli` | GitHub Releases | GitHub SLSA provenance | | `x-twitter-scraper-ruby` | RubyGems | Sigstore bundle bound to the published gem | +| `x-twitter-scraper-java`, `x-twitter-scraper-kotlin` | Maven Central | OpenPGP signatures for every published Maven file | | `x-twitter-scraper-csharp` | NuGet | Project-controlled signature evidence remains incomplete | | `x-twitter-scraper-go` | Go modules | Project-controlled signature evidence remains incomplete | -| `x-twitter-scraper-java`, `x-twitter-scraper-kotlin` | Maven Central | Current public artifact and signature evidence remains incomplete | | `x-twitter-scraper-php` | Packagist | Project-controlled signature evidence remains incomplete | -The first 12 projects have verifiable signed release artifacts. +The first 14 projects have verifiable signed release artifacts. Their Silver badge answers still require default-branch documentation. -The remaining 5 projects must add public cryptographic release evidence. +The remaining 3 projects must add public cryptographic release evidence. Track that work in [organization issue #4](https://github.com/Xquik-dev/.github/issues/4). @@ -111,6 +111,51 @@ The verified SHA-256 digest is: ce55622baf95df9b6599db33a7a1627463be3735b891e93177a67f8875d3aaa8 ``` +## Verify Maven Central Signatures + +Maven Central publishes detached OpenPGP signatures for Java and Kotlin. + +Download an artifact and its signature: + +```sh +project=java +artifact="x-twitter-scraper-$project-0.5.2.jar" +base="https://repo.maven.apache.org/maven2/com/xquik/api/x-twitter-scraper-$project/0.5.2" + +curl --fail --location --remote-name "$base/$artifact" +curl --fail --location --remote-name "$base/$artifact.asc" +``` + +Import the public key and verify the artifact: + +```sh +gpg --keyserver hkps://keyserver.ubuntu.com \ + --recv-keys 0xD2037E4157E62A59 +gpg --verify "$artifact.asc" "$artifact" +``` + +Set `project=kotlin` to verify the Kotlin SDK. + +Confirm this full fingerprint before trusting the key: + +```text +6965 E561 C0AC EE32 060A B961 D203 7E41 57E6 2A59 +``` + +The verified root JAR SHA-256 digests are: + +```text +Java: 87a9b770f16b32d016fac4220a5ec626d32871e692d9b7bc8d261be8e0a58e89 +Kotlin: 912278aac18d6e78b0f56e790eb3cdb387d1bf30e7b188086bc86095b9201734 +``` + +The audit verified 30 files across 6 Maven components. + +Consumer CI independently verified both root artifacts: + +- [Java release verification](https://github.com/Xquik-dev/x-twitter-scraper-java/actions/runs/30076440647) +- [Kotlin release verification](https://github.com/Xquik-dev/x-twitter-scraper-kotlin/actions/runs/30076440671) + ## Verify GitHub Attestations Download the selected release artifact. From 75e210d2df171702a0e32310d83e47174a0c12b1 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 11:12:13 +0300 Subject: [PATCH 25/31] docs: verify cryptographic 2FA Signed-off-by: kriptoburak --- ASSURANCE.md | 15 +++++++++++++++ OPENSSF.md | 4 ++++ 2 files changed, 19 insertions(+) diff --git a/ASSURANCE.md b/ASSURANCE.md index 43dd132..907adfa 100644 --- a/ASSURANCE.md +++ b/ASSURANCE.md @@ -69,6 +69,21 @@ Each public project must preserve these claims: | Supply-chain integrity | Dependencies and workflows remain reviewable, pinned, and scanned | | Release integrity | Published artifacts remain reproducible and cryptographically verifiable | +### Repository Access Assurance + +GitHub requires 2FA for all organization members. + +On July 24, 2026, the sole maintainer verified these account settings: + +- 2FA is enabled. +- A passkey is configured and preferred. +- An authenticator app is configured. +- SMS is not configured. + +These controls satisfy `require_2FA` and `secure_2FA`. + +Reverify them after any organization membership or authentication change. + ## Threat Model ### Protected Assets diff --git a/OPENSSF.md b/OPENSSF.md index baef6f6..efd595c 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -64,6 +64,7 @@ Use each live entry for current status and submitted evidence. - Every required Silver explanation and evidence URL is present. - All 17 entries mark 4 verified human requirements as Unmet. - Each entry includes dated remediation guidance for those requirements. +- All 17 entries mark cryptographic 2FA as Met. - All 17 projects expose a scoped newcomer task. - Fourteen projects have verified signed release artifacts. - Three projects need project-controlled release signature evidence. @@ -118,6 +119,9 @@ These tasks satisfy the Gold `small_tasks` evidence requirement. ## Verified Organization Controls - GitHub requires two-factor authentication for organization members. +- The sole maintainer prefers a configured passkey for GitHub 2FA. +- An authenticator app provides an additional cryptographic 2FA method. +- SMS is not configured as a GitHub 2FA method. - Every public repository supports private vulnerability reporting. - Every default branch requires 1 current approval. - The last pusher cannot provide that approval. From 3e6b181341fba44561af5c5b995f01c2a44b3b87 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 11:18:31 +0300 Subject: [PATCH 26/31] docs: require future signed tags Signed-off-by: kriptoburak --- RELEASES.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/RELEASES.md b/RELEASES.md index 5b33b71..442916a 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -208,6 +208,36 @@ Keep `version_tags_signed` Unmet until important tags are verifiable. Artifact attestations do not make an unsigned Git tag signed. +## Future Signed Tags + +Sign every future major, minor, and vulnerability-fix tag. + +Use a GitHub-verified signing key. + +Never replace or force-push a published tag. + +Follow GitHub's [tag signing guide](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-tags). + +Configure each isolated release worktree: + +```sh +git config gpg.format ssh +git config user.signingkey /secure/path/to/signing-key +git config gpg.ssh.allowedSignersFile /secure/path/to/allowed-signers +git config tag.gpgSign true +``` + +Create and verify the tag before pushing: + +```sh +git tag -s "$version" -m "Release $version" +git tag -v "$version" +``` + +Never commit a private signing key. + +Keep `version_tags_signed` Unmet until important public tags pass verification. + ## Release Requirements Before publishing: From f47b695d21bcee1b8dd9e435ba9b37d3dce7ca46 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 11:20:24 +0300 Subject: [PATCH 27/31] docs: record protected release tags Signed-off-by: kriptoburak --- OPENSSF.md | 1 + RELEASES.md | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/OPENSSF.md b/OPENSSF.md index efd595c..cafc133 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -68,6 +68,7 @@ Use each live entry for current status and submitted evidence. - All 17 projects expose a scoped newcomer task. - Fourteen projects have verified signed release artifacts. - Three projects need project-controlled release signature evidence. +- All 17 software projects protect `v*` tags against destructive updates. - All latest public Git tags remain unsigned. - Latest required checks pass on every ready remediation pull request. - All 19 ready remediation pull requests are mergeable. diff --git a/RELEASES.md b/RELEASES.md index 442916a..d30aa6f 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -200,6 +200,18 @@ Verification checks the repository identity and transparency-log timestamp. No long-lived project private signing key is required. +## Protected Release Tags + +Every standalone repository has an active ruleset for `v*` tags. + +All 17 rulesets block deletion and non-fast-forward updates. + +The Terraform provider also restricts creation to its approved release actor. + +These rules preserve published tag identity. + +They do not make an unsigned tag signed. + ## Unsigned Tags The latest public Git tags lacked verified Git signatures during this audit. From 88203333f2f7ef255f88b44679e63e888e5af58d Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 11:34:52 +0300 Subject: [PATCH 28/31] ci: guard repository discovery quality Signed-off-by: kriptoburak --- OPENSSF.md | 19 +++++++ scripts/check-public-contract.mjs | 86 +++++++++++++++++++++++++++++++ 2 files changed, 105 insertions(+) diff --git a/OPENSSF.md b/OPENSSF.md index cafc133..960c677 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -204,6 +204,25 @@ All descriptions include the compact independence notice. Topics remain specific to supported languages, workflows, and customer tasks. +Every public repository now includes the `xquik` discovery topic. + +Descriptions contain 94 to 185 characters. + +Each repository uses 14 to 20 accurate topics. + +The public contract check now preserves these discovery requirements: + +- One clear README title and at least 3 descriptive sections. +- A task-oriented section and copyable example for each project repository. +- Descriptive link text and alternative text for images. +- An HTTPS homepage and a concise repository description. +- The `xquik` topic and at least one supported customer-intent topic. +- No more than 20 repository topics. + +These checks favor useful structure and accurate terms. + +They do not require keyword lists or duplicate questions. + ## Known Gold Gaps The organization currently has one member. diff --git a/scripts/check-public-contract.mjs b/scripts/check-public-contract.mjs index 775aa83..f044aca 100644 --- a/scripts/check-public-contract.mjs +++ b/scripts/check-public-contract.mjs @@ -10,6 +10,16 @@ const SERVER_CARD_URL = "https://xquik.com/.well-known/mcp/server-card.json"; const HTTP_METHODS = new Set(["delete", "get", "head", "options", "patch", "post", "put", "trace"]); const INDEPENDENCE_NOTICE = 'Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.'; +const REPOSITORY_DESCRIPTION_NOTICE = "Not affiliated with X Corp."; +const DISCOVERY_TOPICS = new Set([ + "tweet-search", + "twitter-api", + "twitter-scraper", + "x-api", + "x-automation", +]); +const VAGUE_LINK_TEXT = /\[(?:click here|here|link|read more)\]\(/iu; +const EMPTY_IMAGE_ALT = /!\[\s*\]\(/u; const COMMUNITY_POLICY_REQUIREMENTS = new Map([ [ "ASSURANCE.md", @@ -193,6 +203,24 @@ function visibleMarkdown(markdown) { return markdown.replace(/[*_`>#]/gu, "").replace(/\s+/gu, " ").trim(); } +function markdownHeadings(markdown) { + const headings = []; + let fence = null; + for (const line of markdown.split(/\r?\n/u)) { + const fenceMatch = /^ {0,3}(`{3,}|~{3,})/u.exec(line); + if (fenceMatch) { + const marker = fenceMatch[1][0]; + if (fence === null) fence = marker; + else if (fence === marker) fence = null; + continue; + } + if (fence !== null) continue; + const heading = /^ {0,3}(#{1,6})[ \t]+(.+?)[ \t]*#*[ \t]*$/u.exec(line); + if (heading) headings.push({ level: heading[1].length, text: heading[2].trim() }); + } + return headings; +} + function resolveParameter(openApi, parameter) { if (!parameter?.$ref) return parameter; const name = parameter.$ref.split("/").at(-1); @@ -218,6 +246,37 @@ async function checkRepoReadmes(repos) { const path = repo.name === ".github" ? "profile/README.md" : "README.md"; const readme = await loadRepoFile(repo, path); const visible = visibleMarkdown(readme); + const headings = markdownHeadings(readme); + const titleHeadings = headings.filter(({ level }) => level === 1); + const sectionHeadings = headings.filter(({ level }) => level === 2); + if (titleHeadings.length !== 1) { + throw new Error(`${repo.name}/${path} must contain exactly one top-level heading.`); + } + const title = titleHeadings[0].text; + if (title.length < 10 || title.length > 110) { + throw new Error(`${repo.name}/${path} has an unclear title length: ${title.length}.`); + } + if (sectionHeadings.length < 3) { + throw new Error(`${repo.name}/${path} needs at least 3 descriptive sections.`); + } + if ( + !sectionHeadings.some(({ text }) => + /\b(?:choose|command|operation|question|search|start|task|tool|use|workflow)s?\b/iu.test( + text, + ), + ) + ) { + throw new Error(`${repo.name}/${path} needs a task-oriented section heading.`); + } + if (repo.name !== ".github" && !/^ {0,3}(?:`{3,}|~{3,})/mu.test(readme)) { + throw new Error(`${repo.name}/${path} needs a runnable or copyable example.`); + } + if (VAGUE_LINK_TEXT.test(readme)) { + throw new Error(`${repo.name}/${path} contains vague link text.`); + } + if (EMPTY_IMAGE_ALT.test(readme)) { + throw new Error(`${repo.name}/${path} contains an image without alternative text.`); + } if (!visible.includes(INDEPENDENCE_NOTICE)) { throw new Error(`${repo.name}/${path} is missing the approved independence notice.`); } @@ -227,6 +286,31 @@ async function checkRepoReadmes(repos) { ); } +function checkRepoDiscovery(repos) { + for (const repo of repos) { + const description = repo.description?.trim() ?? ""; + const topics = repo.topics ?? []; + if (description.length < 70 || description.length > 200) { + throw new Error(`${repo.name} has an unclear repository description length.`); + } + if (!description.endsWith(REPOSITORY_DESCRIPTION_NOTICE)) { + throw new Error(`${repo.name} is missing the compact independence notice.`); + } + if (!repo.homepage?.startsWith("https://")) { + throw new Error(`${repo.name} needs an HTTPS homepage.`); + } + if (topics.length < 5 || topics.length > 20) { + throw new Error(`${repo.name} must use 5-20 accurate discovery topics.`); + } + if (!topics.includes("xquik")) { + throw new Error(`${repo.name} is missing the xquik discovery topic.`); + } + if (!topics.some((topic) => DISCOVERY_TOPICS.has(topic))) { + throw new Error(`${repo.name} is missing an accurate customer-intent topic.`); + } + } +} + async function checkCommunityPolicies() { await Promise.all( [...COMMUNITY_POLICY_REQUIREMENTS].map(async ([path, requirements]) => { @@ -293,6 +377,8 @@ const textCount = requireCount( /(?\d+) (?:JSON or text operations|JSON\/text ops)\b/u, ); +checkRepoDiscovery(repos); + if (cardRestCount !== restCount) { throw new Error(`Server card says ${cardRestCount} REST operations; OpenAPI has ${restCount}.`); } From ec007b9d9de580adda28bb5510bbbbfe0d3efed3 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 11:37:25 +0300 Subject: [PATCH 29/31] docs: link human security review tracker Signed-off-by: kriptoburak --- OPENSSF.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/OPENSSF.md b/OPENSSF.md index 960c677..9d92e11 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -242,6 +242,8 @@ Open remediation pull requests cannot satisfy these human requirements. Track human prerequisites in [organization issue #3](https://github.com/Xquik-dev/.github/issues/3). +Track scoped human reviews in [organization issue #5](https://github.com/Xquik-dev/.github/issues/5). + These Silver and Gold areas still need default-branch evidence: - Repository-specific architecture and assurance cases. From e654038086530474a6fe53a08a76eaf385cb9b09 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 12:32:42 +0300 Subject: [PATCH 30/31] docs: define public discovery policy Signed-off-by: kriptoburak --- DISCOVERY.md | 100 ++++++++++++++++++++++++++++++ README.md | 1 + profile/README.md | 1 + scripts/check-public-contract.mjs | 10 +++ 4 files changed, 112 insertions(+) create mode 100644 DISCOVERY.md diff --git a/DISCOVERY.md b/DISCOVERY.md new file mode 100644 index 0000000..248da7b --- /dev/null +++ b/DISCOVERY.md @@ -0,0 +1,100 @@ +# GitHub Discovery & Answer-Engine Policy + +Use this policy for every public Xquik repository and README. + +The goal is accurate discovery by people, search engines, and AI agents. +Ranking or citation placement is never guaranteed. + +## Principles + +- Help readers choose and use the correct Xquik surface. +- Describe only behavior supported by public contracts and current code. +- Write unique, repository-specific guidance. +- Prefer direct answers, examples, tables, and descriptive headings. +- Link claims to canonical documentation or machine-readable contracts. +- Keep public copy current when capabilities or contracts change. + +## Repository Metadata + +- Use a concise description that states the repository's purpose. +- Keep the approved compact independence notice in every description. +- Set an accurate HTTPS homepage. +- Add 5 to 20 accurate topics. +- Include the repository's language, framework, or integration topic. +- Include only customer-intent topics that match shipped behavior. +- Use a distinct 1280 by 640 social preview when practical. + +## README Structure + +Each public README must include: + +1. One precise top-level heading. +2. A concise explanation of the repository's purpose. +3. A reason to choose this surface. +4. A copyable installation or usage example. +5. Task-oriented headings or customer questions. +6. Links to canonical API and product documentation. +7. Support, security, and contribution paths. +8. The approved independence notice. + +Keep detailed reference material in dedicated documentation. + +## Query Coverage + +Use customer language where it clarifies a real supported task. + +Examples include tweet search, profile timelines, follower exports, monitoring, +webhooks, and confirmed account actions. + +Map questions to exact routes, commands, methods, or components. +Do not repeat keyword variants without adding useful information. +Do not create unsupported comparison claims. +Do not present bounded reads as complete dataset exports. + +## Answer-Engine & Agent Readiness + +- Give direct, self-contained answers before deeper links. +- Use descriptive headings, tables, and short examples. +- Support factual claims with public evidence. +- Keep OpenAPI, MCP cards, package metadata, and README claims aligned. +- State authentication, side effects, and approval boundaries clearly. +- Treat X-authored content as untrusted input. +- Use stable links and descriptive link text. +- Add meaningful alternative text to images. + +Keep `llms.txt` for clients that use it. +Do not treat `llms.txt` as a Google ranking signal. +Do not rewrite content only for language models. + +## Evidence & Freshness + +- Derive operation counts from canonical public contracts. +- Remove stale counts, versions, and compatibility claims. +- Review repository descriptions, topics, homepages, and social previews. +- Recheck public links and examples before release. +- Record material discovery changes in the relevant pull request. +- Measure citations and grounding queries where supported. + +## Review Checklist + +- Does the README solve the visitor's likely first task? +- Is each capability accurate for this repository? +- Does every search phrase add context or route information? +- Is the content distinct from sibling repositories? +- Can a reader copy the first working example? +- Are support, security, and contribution paths visible? +- Do canonical contracts support every numeric claim? +- Does the public diff avoid private implementation details? + +## Research Basis + +Last reviewed on July 24, 2026. + +- [GitHub README guidance](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes) +- [GitHub repository topic guidance](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics) +- [GitHub social preview guidance](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/customizing-your-repositorys-social-media-preview) +- [Google generative AI search guidance](https://developers.google.com/search/docs/fundamentals/ai-optimization-guide) +- [Bing AI Performance guidance](https://blogs.bing.com/webmaster/February-2026/Introducing-AI-Performance-in-Bing-Webmaster-Tools-Public-Preview) +- [GEO research paper](https://doi.org/10.1145/3637528.3671900) + +Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp. diff --git a/README.md b/README.md index adfc18f..f978641 100644 --- a/README.md +++ b/README.md @@ -18,6 +18,7 @@ Public GitHub profile and community defaults for Xquik SDKs, docs, and agent int - Code review: [REVIEWING.md](REVIEWING.md) - Public roadmap: [ROADMAP.md](ROADMAP.md) - OpenSSF evidence: [OPENSSF.md](OPENSSF.md) +- Discovery and README policy: [DISCOVERY.md](DISCOVERY.md) - Code of Conduct: [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) ## Find a Workflow diff --git a/profile/README.md b/profile/README.md index a1b5452..50486a2 100644 --- a/profile/README.md +++ b/profile/README.md @@ -89,5 +89,6 @@ Use Xquik for X data, monitoring, exports, webhooks, and approved account action - [Code Review](https://github.com/Xquik-dev/.github/blob/main/REVIEWING.md) - [Public Roadmap](https://github.com/Xquik-dev/.github/blob/main/ROADMAP.md) - [OpenSSF Evidence](https://github.com/Xquik-dev/.github/blob/main/OPENSSF.md) +- [Discovery & README Policy](https://github.com/Xquik-dev/.github/blob/main/DISCOVERY.md) Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp. diff --git a/scripts/check-public-contract.mjs b/scripts/check-public-contract.mjs index f044aca..68aef34 100644 --- a/scripts/check-public-contract.mjs +++ b/scripts/check-public-contract.mjs @@ -36,6 +36,16 @@ const COMMUNITY_POLICY_REQUIREMENTS = new Map([ "CONTRIBUTING.md", ["Developer Certificate of Origin", "git commit -s", "good first issue"], ], + [ + "DISCOVERY.md", + [ + "## Repository Metadata", + "## README Structure", + "## Answer-Engine & Agent Readiness", + "Do not repeat keyword variants without adding useful information.", + "Do not treat `llms.txt` as a Google ranking signal.", + ], + ], [ "GOVERNANCE.md", ["## Roles", "## Continuity", "does not meet this continuity target yet"], From 8963b88bece3206687d63f2172ca6b3e527bbda7 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Fri, 24 Jul 2026 15:44:59 +0300 Subject: [PATCH 31/31] docs: record Haystack DCO blocker Signed-off-by: kriptoburak --- OPENSSF.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/OPENSSF.md b/OPENSSF.md index 9d92e11..14c3d72 100644 --- a/OPENSSF.md +++ b/OPENSSF.md @@ -180,8 +180,10 @@ Generated-code coverage applicability remains an explicit assessment gap. - Do not update, merge, tag, or publish either draft. - Haystack [#6](https://github.com/Xquik-dev/xquik-haystack/pull/6) is an independent contribution for issue #5. - Its added file passes Ruff, and all 18 unit tests pass locally. +- Contributor commit `faf5d270` lacks the required DCO sign-off. +- The contributor must amend and re-push it before this PR qualifies as evidence. - Required remote checks pass with zero unresolved review threads. -- GitHub still requires a post-push approval from another person. +- A new independent approval will be required after the contributor's push. ## README & Repository Metadata