docs: record OpenSSF regression, release, and review evidence

[kriptoburak]

Summary

• Record six-month regression-test evidence for all 17 projects.
• Record default-branch debug-information preservation across every build surface.
• Document signed-release verification for all 17 projects.
• Record exact-head two-person review evidence for all 17 projects.
• Add weekly public-contract and review-inventory verification.
• Add scheduled consumer verification for C#, Go, and PHP artifacts.
• Keep human-only Silver and Gold criteria explicitly unmet.

Current Result

• Fifteen projects meet the six-month regression ratio.
• Two projects have no qualifying fixes and use N/A.
• All 17 projects meet the current 50% two-person-review threshold.
• All 17 projects have default-branch debug-preservation evidence.
• Terraform #14 and CLI #16 merged through protected, independently reviewed pull requests.
• All 17 projects expose verifiable signed release artifacts.
• Every live BadgeApp entry remains Passing at 100% and Silver at 98%.
• Gold completion ranges from 65% to 78%.
• Human continuity, contributor, and security-review gaps remain open.
• Important version tags remain unsigned and explicitly considered.

Verification

The review verifier audits every public repository inventory change.
It counts direct commits as unreviewed.
It requires a known author and exact-head approval from another human.
It ignores bot, stale, dismissed, and pending reviews.

The consumer workflow verifies each latest canonical artifact.
It enforces the exact repository and signer workflow.
It rejects provenance from self-hosted runners.

Validation

• The public-contract check covered all 19 repositories.
• It matched 127 REST operations.
• It matched 119 MCP operations.
• It matched 118 JSON or text operations.
• The review verifier passed all 17 standalone projects.
• The Ruby 0.5.5 Sigstore bundle matched its release workflow and artifact.
• The Java 0.6.0 JAR matched its documented SHA-256 digest and OpenPGP signature.
• The Kotlin 0.5.3 release matched all 15 OpenPGP signatures.
• Node syntax and diff checks passed.
• Simplification and maintainability reviews found no blocker.

Review Notes

Commit a42e2986a97e387d6bfb7e73a10c49e78536ccd6 is the final evidence head for this review cycle.
Please review this exact head after required checks complete.

Signed-off-by: kriptoburak kriptoburak@users.noreply.github.com

Note

Summary

• Record six-month regression-test evidence for all 17 projects.
• Record default-branch debug-information preservation across every build surface.
• Document signed-release verification for all 17 projects.
• Record exact-head two-person review evidence for all 17 projects.
• Add weekly public-contract and review-inventory verification.
• Add scheduled consumer verification for C#, Go, and PHP artifacts.
• Keep human-only Silver and Gold criteria explicitly unmet.

Current Result

• Fifteen projects meet the six-month regression ratio.
• Two projects have no qualifying fixes and use N/A.
• All 17 projects meet the current 50% two-person-review threshold.
• All 17 projects have default-branch debug-preservation evidence.
• Terraform #14 and CLI #16 merged through protected, independently reviewed pull requests.
• All 17 projects expose verifiable signed release artifacts.
• Every live BadgeApp entry remains Passing at 100% and Silver at 98%.
• Gold completion ranges from 65% to 78%.
• Human continuity, contributor, and security-review gaps remain open.
• Important version tags remain unsigned and explicitly considered.

Verification

The review verifier audits every public repository inventory change.
It counts direct commits as unreviewed.
It requires a known author and exact-head approval from another human.
It ignores bot, stale, dismissed, and pending reviews.

The consumer workflow verifies each latest canonical artifact.
It enforces the exact repository and signer workflow.
It rejects provenance from self-hosted runners.

Validation

• The public-contract check covered all 19 repositories.
• It matched 127 REST operations.
• It matched 119 MCP operations.
• It matched 118 JSON or text operations.
• The review verifier passed all 17 standalone projects.
• The Ruby 0.5.5 Sigstore bundle matched its release workflow and artifact.
• The Java 0.6.0 JAR matched its documented SHA-256 digest and OpenPGP signature.
• The Kotlin 0.5.3 release matched all 15 OpenPGP signatures.
• Node syntax and diff checks passed.
• Simplification and maintainability reviews found no blocker.

Review Notes

Commit a42e2986a97e387d6bfb7e73a10c49e78536ccd6 is the final evidence head for this review cycle.
Please review this exact head after required checks complete.

Signed-off-by: kriptoburak kriptoburak@users.noreply.github.com

Changes since #7 opened

• Updated OpenSSF debug-information evidence status for terraform-provider-x-twitter-scraper and x-twitter-scraper-cli from Pending to Met, replacing evidence links to reference release configuration and debug verification checks instead of pending PRs, and updated OpenSSF audit completion percentages to 98% for Silver and 65%-78% for Gold, noting all 17 projects now have default-branch debug-preservation evidence with Terraform and CLI verification merged [a906c18]
• Updated release verification instructions with Ruby gem version 0.5.5 having SHA-256 digest 6dfdcabd408a330d80ef87f4e650aca0004ba8a0eb8b49cb92e06a97a7cf5502, Java Maven artifacts to version 0.6.0 with JAR SHA-256 17aaf5366ab6ad65869e5fb4f92acb2351bb08e0a12a0d4fcab6de8875193916, and Kotlin version 0.5.3, expanded audit results with verified Java and Kotlin artifact counts, updated Java release verification workflow run link, and revised tag ruleset note to state rulesets currently allow tag creation [a906c18]
• Refreshed review evidence with updated commit counts and ratios for all 17 repositories with result date of July 25, 2026 [a906c18]
• Inserted new contributor guidance section titled Grow With a Project advising contributors to read roadmaps, submit focused PRs, avoid metric inflation, and link merged work in the OpenSSF human evidence tracker [a906c18]
• Updated snapshot and audit dates from July 24, 2026 to July 25, 2026 across documentation files [a906c18]
• Updated release verification evidence with new Kotlin version, publishing key fingerprint, workflow run identifiers, and verification context wording [a42e298]
• Updated code review statistics across eight packages showing increased review counts and improved review-to-commit ratios [a42e298]

[kriptoburak]

GitHub Actions validated commit 86dd9f8ea3c7e27b663025ac316b45e9ae804345.

• Public contract and review audit passed.
• It inventoried all 19 public repositories.
• It verified all 17 standalone project review ratios.
• Release attestation verification passed for C#, Go, and PHP.

This is still not the final review head. Terraform #14 and CLI #16 remain pending.

[kriptoburak]

Commit 3df49ca3a39eb009d28c0394871d22956af0cb39 records the repository-description anti-spam pass.

• All 19 descriptions retain an accurate task and integration surface.
• Every description retains Not affiliated with X Corp.
• Opening sentences now contain 9 to 14 words.
• Description lengths now range from 94 to 140 characters.
• Topics remain supported, repository-specific, and within GitHub limits.
• The updated public-contract run passed all 19 repositories.

[furkanerday]

Blocking evidence-ordering issue: BUILD_DEBUG.md:13 says pending changes do not count as default-branch evidence, while BUILD_DEBUG.md:23 and BUILD_DEBUG.md:26 still mark Terraform #14 and CLI #16 as Pending. The PR description also says this is not the final review head and asks reviewers to wait for those evidence updates. Merge the prerequisite changes, update the default-branch evidence and stale PR description, and request re-review at a new signed-off head. Approving this head would endorse an explicitly incomplete evidence record.

[kriptoburak]

Commit a42e2986a97e387d6bfb7e73a10c49e78536ccd6 refreshes the exact-head review ledger and public release evidence. The live verifier reports all 17 projects above 50%. Kotlin v0.5.3 published after protected PR #16; all 15 Maven artifacts validate against fingerprint 6965E561C0ACEE32060AB961D2037E4157E62A59, and the root JAR SHA-256 is 6e083f62f50231bbce09b99c6c6fe5b8f5ade1babaefac8220d80897df93cdf1. Public-contract, review-inventory, Actionlint, diff, simplification, and maintainability checks pass. @furkanerday please review this exact head.