Mycorrhizal CRM

Every .github/workflows/*.yml has top-level permissions: contents: read (scorecard.yml uses read-all); jobs elevate narrowly. Enforced by zizmor.yml + Scorecard Token-Permissions.

Each release has a tag marked with Semantic Versioning (vZ.Y.X) and commits also carry unique Git SHAs. [version_unique]

https://github.com/DrewBrunning/mycorrhizal-crm/releases

Each tagged release publishes a GitHub Release with generated notes (created automatically by .github/workflows/docker-publish.yml on the release tag). Upgrade impact and breaking changes are covered by docs/upgrade-compatibility.md and docs/breaking-change-policy.md, and the supported-upgrade range is enforced in CI. (Optional improvement: add a one-paragraph human summary per release.) [release_notes]

Go modules+go.sum, Yarn+yarn.lock (--frozen-lockfile in Dockerfile), Gradle version catalog, FROM pinned by digest, Actions pinned by SHA, Dependabot per-ecosystem.

docs/security/release-verification.md: cosign keyless sigs on all images, SLSA provenance (GH attestation + buildkit in-toto), signed SBOMs, APK cosign bundle + provenance on the Release.

docs/dependency-upgrade-policy.md covers obtainment + tracking + upgrades

docs/development/architecture.md, backend.md, frontend.md, root Dockerfile, README-developer.md name Go (pinned in go.mod), Node/Yarn (engines), Vite, Playwright.

GOVERNANCE.md documents every sensitive resource and who holds it, in the
"Members with access to sensitive resources" table: GitHub repository admin,
main branch-protection/ruleset bypass, release-signing and Actions secrets
(release GitHub App key, Android SIGNING_* keystore), the production
deployment host, and the external project accounts (OpenSSF Best
Practices/Baseline, Codecov, Scorecard). All are currently held by the sole
maintainer; the file states it is updated in the same pull request that grants
or revokes any access.

https://github.com/DrewBrunning/mycorrhizal-crm/blob/main/GOVERNANCE.md#members-with-access-to-sensitive-resources

GOVERNANCE.md, "Roles and responsibilities", defines the two roles and their
duties. Maintainer (Drew Brunning, @DrewBrunning): review/merge authority,
cutting and signing releases, security-report triage per SECURITY.md,
dependency-update decisions per docs/dependency-upgrade-policy.md, and
repository administration. Contributor: PR/issue authors, responsible for the
contribution guide (tests, one concern per PR) and DCO sign-off. The file also
covers decision-making and how someone becomes a maintainer.

https://github.com/DrewBrunning/mycorrhizal-crm/blob/main/GOVERNANCE.md#roles-and-responsibilities

https://github.com/DrewBrunning/mycorrhizal-crm/blob/main/docs/development/contributing.md

The same document's "Code Style" and "Pull Requests" sections give the requirements for acceptable contributions: gofmt + existing controller/service patterns + user_id query scoping (backend); TypeScript strict mode, MUI, i18next for all strings, custom hooks for data fetching (frontend); one feature/fix per PR; no hands-off AI-generated PRs. CLAUDE.md adds the repo-wide conventions and the "hand-verify your tests" rule. [contribution_requirements]

The project uses the Developer Certificate of Origin (DCO 1.1). The verbatim
text is in the DCO file at the repository root. The .github/workflows/dco.yml
status check runs on every pull request and fails unless every non-merge
commit carries a Signed-off-by trailer matching its author or committer.
Contributors add it with git commit -s; instructions and the fix for an
unsigned branch (git rebase --signoff) are in
docs/development/contributing.md ("Sign your commits (DCO)"), surfaced via
.github/CONTRIBUTING.md and README.md.

https://github.com/DrewBrunning/mycorrhizal-crm/blob/main/DCO
https://github.com/DrewBrunning/mycorrhizal-crm/blob/main/.github/workflows/dco.yml

GitHub Actions runs the full test + analysis matrix on every push and PR to main, plus nightly. ~25 workflows under .github/workflows/. [test_continuous_integration]

GitHub Actions runs the full test + analysis matrix on every push and PR to main, plus nightly. ~25 workflows under .github/workflows/. [test_continuous_integration]

docs/development/architecture.md + docs/security/threat-model.md ("Trust boundaries", "Actors × trust boundaries", "Controls → threat mapping").

The external HTTP interface is documented in backend/openapi.yaml (OpenAPI 3) and docs/api-reference.md (https://drewbrunning.github.io/mycorrhizal-crm/api-reference.html), which describe the /api/v1 REST surface, auth model, and endpoints. CardDAV/CalDAV interfaces are documented in docs/carddav.md. The contract is pinned by a frozen baseline test (backend/internal/apibaseline). [documentation_interface]

docs/security/threat-model.md, asvs-l2.md, asvs-l2-verification-report.md (dated pass, 4 manual audits, exception register), plus pen-test engagement (issues #860/#871 → PR #886).

https://github.com/DrewBrunning/mycorrhizal-crm/blob/main/SECURITY.md

SECURITY.md publishes the process: report privately via GitHub Security Advisories, what to include, a 5-business-day acknowledgement target, and coordinated-disclosure handling. Also links the operator incident-response runbook. [vulnerability_report_process]

https://github.com/DrewBrunning/mycorrhizal-crm/security/advisories/new

Private reporting is via GitHub's private Security Advisory flow (HTTPS), as directed by SECURITY.md. [vulnerability_report_private]

The project is pre-1.0 and has had no publicly known run-time vulnerabilities (no CVE assigned against Mycorrhizal CRM's own code). This criterion applies only to the project's results, not dependencies, so there is nothing to enumerate. [release_notes_vulns]