modonome

遵循以下最佳实践的项目将能够自愿的自我认证,并显示他们已经实现了核心基础设施计划(OpenSSF)徽章。

没有一套可以保证软件永远不会有缺陷或漏洞的做法;如果规范或假设是错误的,即使合适的方法也可能失败。也没有哪些做法可以保证一个项目能够维持健康和运作良好的开发者社区。但是,遵循最佳做法可以帮助改善项目的成果。例如,一些做法可以在发布之前进行多人评估,这可以帮助您找到其他难以找到的技术漏洞,并帮助建立信任,并希望不同公司的开发人员之间进行重复的交互。要获得徽章,必须满足所有“必须”和“禁止”的条款,满足所有“应该”条款或有合适的理由,所有“建议”条款必须满足或未满足(至少希望考虑)。欢迎通过 GitHub网站创建问题或提出请求进行反馈。另外还有一个一般讨论邮件列表

如果这是您的项目,请在您的项目页面上显示您的徽章状态!徽章状态如下所示: 项目13362的徽章级别为in_progress 这里是如何嵌入它:
您可以通过将其嵌入在您的Markdown文件中:
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13362/badge)](https://www.bestpractices.dev/projects/13362)
或将其嵌入到HTML中来显示您的徽章状态:
<a href="https://www.bestpractices.dev/projects/13362"><img src="https://www.bestpractices.dev/projects/13362/badge"></a>


这些是通过级别条款。您还可以查看白银黄金级别条款。

Baseline Series: 基准等级1 基准等级2 基准等级3

        

 基本 12/13

  • 常规

    请注意,其他项目可能使用相同的名称。

    Governed autonomy for software repositories. An off-by-default autonomous engineer that adopts a repo's rules, proposes small reviewable changes, and structurally prevents autonomous agents from gaming quality gates by running the enforcement ratchet in CI outside the agent's write scope.

    请使用 SPDX许可证表达格式;例子包括“Apache-2.0”,“BSD-2-Clause”,“BSD-3-Clause”,“GPL-2.0+”,“LGPL-3.0 +”,“MIT”和“(BSD-2-Clause OR Ruby)”。
    如果有多种语言,请将它们列为逗号分隔值(可选空格),并将它们从最多到最少使用。如果有长列表,请至少列出前三个最常见的列表。如果没有语言(例如,这是仅文档或仅测试项目),请使用单个字符“ - ”。请使用每种语言的常规大小写,例如“JavaScript”。
    通用平台枚举(CPE)是用于信息技术系统,软件和软件包的结构化命名方案。在报告漏洞时,它可用于多个系统和数据库。

    Modonome is a prompt plus a set of enforcing scripts with zero runtime npm dependencies. It ships with AgentProof, a portable 16-scenario adversarial benchmark that machine-verifies all governance controls hold under attack (scoring 16/16 GOVERNED). Every arming lever defaults to off; autonomy cannot be enabled from a file the agent can write. The project targets teams that want to run autonomous coding agents under provable governance constraints rather than prompt-only promises.

  • 基本项目网站内容


    项目网站必须简明扼要地描述软件的作用(它解决了什么问题?)。 [description_good]
    必须采用潜在用户可以理解的语言(例如,它使用最少的术语/行话)。

    项目网站必须提供有关如何获取和提供反馈(错误报告或增强功能)以及如何贡献的信息。 [interact]

    关于如何贡献的信息必须解释贡献流程(例如,是否使用拉请求?) (需要网址) [contribution]
    除非另有说明,否则我们假定 GitHub上的项目使用问题列表(Issues)和拉(Pull)请求。这些信息可以简短,例如,说明项目使用拉请求,问题跟踪器或邮寄到邮件列表中的哪一个。

    https://github.com/enumind/modonome/blob/main/CONTRIBUTING
    Pull requests required. Fork the repo, make changes, submit a PR. External contributors cannot merge changes to core files (schema, prompt, templates, scripts) — maintainer review required via CODEOWNERS. Local checks (npm run verify) must pass. Bug reports and feature requests via GitHub Issues.



    关于如何贡献的信息应包括对可接受的贡献的要求(例如,引用任何所需的编码标准)。 (需要网址) [contribution_requirements]

    https://github.com/enumind/modonome/blob/main/CONTRIBUTING.md
    CONTRIBUTING.md specifies: npm run verify must pass (drift guard, style check, tests); house style rules (plain voice, no em dashes); safe-defaults requirement; four-representation sync rule for config levers enforced by drift guard.


  • FLOSS许可证


    项目生产的软件必须作为FLOSS发布。 [floss_license]
    FLOSS是以符合开源定义免费软件定义。此类许可证的示例包括 CC0 MIT BSD 2条款 BSD 3条款修订版 Apache 2.0 Lesser GNU通用公共许可证(LGPL),以及 GNU通用公共许可证(GPL)。为了我们的目的,这意味着许可证必须是:该软件也可以用其他许可证(例如,“GPLv2或专有”是可以接受的)。

    建议由项目生成的软件的任何必需的许可证是由开放源码促进会(OSI)批准的许可证(英文)[floss_license_osi]
    OSI (开放源代码促进会)使用严格的审批流程来确定哪些许可证是开源软件(OSS)。

    The MIT license is approved by the Open Source Initiative (OSI).



    项目必须将其许可证在其源代码存储库中的标准位置发布。 (需要网址) [license_location]
    一种约定是将许可证发布为名为LICENSE或COPYING的顶级文件,其后可以带有扩展名,例如“ .txt”或“ .md”。另一种约定是使用一个名为LICENSES的目录,其中包含许可证文件。这些文件通常被命名为其SPDX许可证标识符,后跟适当的文件扩展名,如REUSE Specification中所述。请注意,此标准只是源存储库上的要求。从源代码生成某些内容(例如可执行文件,程序包或容器)时,无需包括许可证文件。例如,在为综合R存档网络(CRAN)生成R软件包时,请遵循标准CRAN惯例:如果许可证是标准许可证,请使用标准简短许可证规范(以避免安装另一文本副本)并列出排除文件(例如.Rbuildignore)中的LICENSE文件。同样,在创建Debian软件包时,您可以在版权文件中放置一个指向/ usr / share / common-licenses中的许可证文本的链接,并从创建的软件包中排除许可证文件(例如,通过在调用dh_auto_install之后删除文件) )。我们鼓励在可行的情况下以生成的格式包含机器可读的许可证信息。

    The MIT license is posted as a top-level file named "LICENSE" in the source repository root, following standard convention. The file contains the complete MIT license text with copyright notice. This is the standard, recognizable location for source repository licenses and complies with the REUSE Specification for machine-readable license information. https://github.com/enumind/modonome/blob/main/LICENSE

    License: MIT (SPDX identifier: MIT)
    SPDX-License-Identifier: MIT


  • 文档


    项目必须为项目生成的软件提供基本文档。 [documentation_basics]
    该文档必须在某些媒体(例如文本或视频)中,包括:如何安装它,如何启动它,如何使用它(可能使用教程使用示例)以及如何安全地使用它(例如,做什么和不做什么),如果这是软件的一个适当的话题。安全文档不需要太长篇幅。项目可以使用非项目内容的超文本链接作为文档。如果项目不生产软件,请选择“不适用”(N/A)。

    https://github.com/enumind/modonome/blob/main/README.md
    Documentation is provided in the repository root and linked from README.md:

    1. How to install: README.md (npx modonome or npm install)
    2. How to start: QUICKSTART.md (https://github.com/nateshpp/modonome/blob/main/QUICKSTART.md)
    3. How to use with tutorial: examples/demo-app/WALKTHROUGH.md (https://github.com/nateshpp/modonome/blob/main/examples/demo-app/WALKTHROUGH.md) — full week of captured usage
    4. How to use securely: SECURITY.md (https://github.com/nateshpp/modonome/blob/main/SECURITY.md) — security model and best practices

    All documentation is in English, accessible without proprietary tools, and hyperlinked for navigation.



    项目必须提供描述项目生成的软件的外部接口(输入和输出)的参考文档。 [documentation_interface]
    外部接口的文档向最终用户或开发人员解释如何使用它。这将包括其应用程序接口(API),如果软件有。如果它是一个库,记录可以调用的主要类/类型和方法/函数。如果是Web应用程序,定义其URL接口(通常是其REST接口)。如果是命令行界面,请记录其支持的参数和选项。在许多情况下,最好是自动生成大部分文档,以便本文档随着软件的更改而保持同步,但这并不是必需的。项目可以使用非项目材料的超文本链接作为文档。文档可以自动生成(实际上这通常是最好的方法)。可以使用Swagger / OpenAPI生成REST接口的文档。代码界面文档可以使用 JSDoc (JavaScript), ESDoc (JavaScript),pydoc(Python)和Doxygen(很多)。仅在实现代码中添加注释不足以满足本条款;在没有阅读所有源代码的情况下,需要一个简单的方法来查看信息。如果项目不生产软件,请选择“不适用”(N/A)。
  • 其他


    项目网站(网站,存储库和下载URL)必须使用TLS支持HTTPS。 [sites_https]
    您可以从Let's Encrypt获取免费证书。项目可以使用(例如) GitHub页面实现此条款, GitLab页面,或 SourceForge项目页面。如果您使用具有自定义域的GitHub页面,则可以使用内容传送网络(CDN)作为代理来支持HTTPS,例如博客文章“使用CloudFlare安全加速GitHub页面”,以满足此条款。如果您支持HTTP,我们敦促您将HTTP流量重定向到HTTPS。

    该项目必须有一个或多个讨论机制(包括建议的更改和问题),可搜索,允许通过URL访问消息和主题,使新人能够参与一些讨论,并且不需要客户端安装专有软件。 [discussion]
    可接受机制的示例包括归档邮件列表,GitHub问题和拉请求讨论,Bugzilla,Mantis和Trac。如果满足这些标准,异步讨论机制(如IRC)是可以接受的;确保有一个URL可访问归档机制。允许专有JavaScript,但不鼓励。

    项目应该提供英文文档,并能够接受英文的代码的错误报告和评论。 [english]
    英语是计算机技术的通用语言;支持英语增加了全球不同潜在开发者和检视者的数量。即使核心开发人员的主要语言不是英文,项目也可以达到这个标准。

    All documentation, code comments, and issue templates are in English. Bug reports and contributions are accepted in English via GitHub Issues and pull requests.



    必须维护该项目。 [maintained]
    至少,项目应尝试响应重大问题和漏洞报告。可能正在维护一个积极追求徽章的项目。所有项目和人员的资源都有限,典型项目必须拒绝某些提议的更改,因此有限的资源和提议拒绝本身并不表示未维护的项目。

    当项目知道将不再维护该项目时,应将此标准设置为“未满足”,并使用适当的机制向其他人指示该项目将不会得到维护。例如,使用“ DEPRECATED”作为其自述文件的第一个标题,在其主页开头附近添加“ DEPRECATED”,在其代码存储库项目说明的开头添加“ DEPRECATED”,在其中添加无需维护的标志其自述文件和/或主页,在任何软件包存储库中将其标记为已弃用(例如npm deprecate ),和/或使用代码存储库的标记系统对其进行归档(例如GitHub的“ archive”设置,GitLab的“ archived”标记, Gerrit的“只读”状态,或SourceForge的“已放弃”项目状态)。可以在这里找到更多讨论。

    Active development; most recent release 2026-06-23 (v0.1.0-alpha). Maintainer (@nateshpp) actively responds to issues. ROADMAP.md documents five public milestones. GOVERNANCE.md describes the current maintainer structure and response commitments.
    https://github.com/enumind/modonome/blob/main/GOVERNANCE.md


 变更控制 9/9

  • 公开的版本控制的源代码存储库


    该项目必须有一个版本控制的源代码存储库。它必须是公开可读的并可通过URL访问。 [repo_public]
    该URL可以与项目URL相同。该项目可能在特定情况下使用私人(非公开)分支,而更改不会公开发布(例如,在向公众披露漏洞之前修复漏洞)。

    Repository on GitHub, which provides public git repositories with URLs.



    项目的源代码存储库必须跟踪所做的更改,谁进行了更改,何时进行了更改。 [repo_track]

    Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.



    为了实现协作检视,项目的源代码存储库必须包括临时版本,以便检视版本之间的变化;它不得仅包括最终版本。 [repo_interim]
    项目可以选择从其公共源代码库中删除特定的临时版本(例如,修复特定的未公开安全漏洞,可能永远不会公开发布的内容,或者包括不能合法发布而且不是最终版本的内容)。

    Yes. Versions released on npm (https://www.npmjs.com/package/modonome) with tags: v0.1.0-alpha and earlier pre-releases. Semantic versioning follows specification: major.minor.patch-prerelease.



    建议使用通用分布式版本控制软件(例如,git)作为项目的源代码存储库。 [repo_distributed]
    Git不是必须,项目在合适场景可以使用集中版本控制软件(如subversion)。

    Repository on GitHub, which uses git. git is distributed.


  • 唯一版本编号


    项目生成的用于每个用户使用的版本必须具有唯一版本标识符。 [version_unique]
    本条款可以通过各种方式来满足,包括提交ID(例如git提交ID或者Mercurial 更改列表id)或版本号(包括使用语义版本或基于日期的方案,如YYYYMMDD的版本号)。

    Yes. https://github.com/enumind/modonome/blob/main/CHANGELOG.md documents all notable changes with version information, features, and breaking changes. Complete git log available in repository.



    建议使用语义版本控制(SemVer)格式进行发布。 [version_semver]
    其他版本编号方案,如提交ID(例如git commit id或mercurial changeset id)或基于日期的方案,如YYYYMMDD,可以用作版本号,因为它们是唯一的。一些备选方案可能会导致问题,因为用户可能无法轻松确定是否是最新的。如果所有目标客户仅运行最新版本,则SemVer可能不太有助于识别软件版本(例如,它是通过持续交付不断更新的单个网站或互联网服务的代码)。


    建议项目识别其版本控制系统中的每个版本。例如,建议使用git的项目,使用git标签识别每个版本。 [version_tags]

    Yes. Versions released on npm (https://www.npmjs.com/package/modonome) with tags: v0.1.0-alpha and earlier pre-releases. Semantic versioning follows specification: major.minor.patch-prerelease.


  • 发行说明


    该项目必须在每个版本中提供发布说明,这是该版本中主要变化的可读的摘要,以帮助用户确定是否应升级,升级影响将如何。发行说明不能是版本控制日志的原始输出(例如,“git log”命令结果不是发行说明)。其产出不适用于多个地点的项目(如单个网站或服务的软件),并采用持续交付,可以选择“N/A”。 (需要网址) [release_notes]
    发行说明可以以各种方式实施。许多项目将它们添加到名为“NEWS”,“CHANGELOG”或“ChangeLog”的文件中,可选的包含“.txt”,“.md”或“.html”等扩展名。历史上,术语“更改日志”是指每个更改的日志,但为了满足这些条款,需要的是可读取的摘要。发行说明可以由版本控制系统机制提供,例如 GitHub发布工作流程

    Yes. Project uses Git for version control. Repository is hosted on GitHub at https://github.com/enumind/modonome with full commit history, branches, tags, and version releases.



    发行说明必须列出每个新版本中修复的每个公开的漏洞。如果没有发行说明或者没有公开的漏洞,选择“不适用”。 [release_notes_vulns]
    如果用户通常不能在自己的计算机上实际更新软件,而必须依靠中间人来执行升级(对于内核和与内核交织的底层软件通常是这种情况),项目可以选择“不适用”(N/A)。

    Yes. https://github.com/enumind/modonome/blob/main/SECURITY.md documents: (1) Complete security model and trust boundaries; (2) Vulnerability reporting via private security advisory; (3) Threat model covering malicious actors; (4) Controls against attacks (prompt injection, dependency compromise, agent self-modification); (5) Secrets management and input validation practices.


 报告 7/8

  • 错误报告流程


    项目必须为用户提交错误报告(例如,使用问题跟踪器或邮件列表)提供相关流程。 (需要网址) [report_process]

    No SECURITY[.md] file found file found. [osps_do_02_01]

    警告:需要URL,但找不到URL。



    项目必须使用问题跟踪器来跟踪每个问题。 [report_tracker]

    Modonome already has comprehensive bug reporting documentation in place:

    ✅ Bug Report URL: https://github.com/nateshpp/modonome/issues
    ✅ Structured Bug Template: .github/ISSUE_TEMPLATE/bug-report.yml
    ✅ Documentation: CONTRIBUTING.md, docs/README.md, SECURITY.md all reference the process
    ✅ Template Fields: What happened, Steps to reproduce, Node version, Modonome version, OS



    该项目必须响应过去2-12个月内(含)提交的大多数错误报告;响应不需要包括修复。 [report_responses]


    该项目应该对过去2-12个月内(包括)的大部分(> 50%)的增强请求作出回应。 [enhancement_responses]
    答复可能是“不”或有关其价值的讨论。目的只是对某些请求有一些回应,这表明项目还活着。为了该条款的目的,项目不需要计数无效请求(例如,来自垃圾邮件发送者或自动系统)。如果项目不再进行增强,请选择“未满足”,并将介绍此情况的URL包含在内。如果一个项目有超出处理能力的增强需求数量,请选择“未满足”并解释。


    该项目必须有一个公开的报告和回复的档案供后续搜索。 (需要网址) [report_archive]

    Yes. The project maintains a public, searchable archive of all bug reports and enhancement requests on GitHub Issues at https://github.com/nateshpp/modonome/issues with complete history of submissions and responses. Issues are organized by labels, milestones, and status for easy searching and filtering.


  • 漏洞报告流程


    项目必须在项目网站上发布报告漏洞的流程。 (需要网址) [vulnerability_report_process]
    例如,https://PROJECTSITE/security 上的一个明确指定的邮箱地址,通常以 security@example.org 的形式。这可能与其错误报告流程相同。漏洞报告可能一直是公开的,但是许多项目都有一个私密漏洞报告机制。

    Modonome already has comprehensive bug reporting documentation in place:

    ✅ Bug Report URL: https://github.com/nateshpp/modonome/issues
    ✅ Structured Bug Template: .github/ISSUE_TEMPLATE/bug-report.yml
    ✅ Documentation: CONTRIBUTING.md, docs/README.md, SECURITY.md all reference the process
    ✅ Template Fields: What happened, Steps to reproduce, Node version, Modonome version, OS



    如果支持私有漏洞报告,项目必须包括如何以保密的方式发送信息。 (需要网址) [vulnerability_report_private]
    示例包括使用HTTPS(TLS)或使用OpenPGP加密的电子邮件在网络上提交的私密缺陷报告。如果漏洞报告总是公开的(从来没有私密漏洞报告),请选择“不适用”(N/A)。

    Yes. Private vulnerability reporting is supported through GitHub's Private Security Advisory feature. The SECURITY.md file documents this process at https://github.com/nateshpp/modonome/security/advisories/new. The private advisory system keeps vulnerability reports confidential until the project has had time to investigate and prepare a fix, supporting responsible disclosure. CODE_OF_CONDUCT.md (line 39) also confirms this process for incident reporting.



    该项目在过去6个月收到的任何漏洞报告的初始响应时间必须小于或等于14天。 [vulnerability_report_response]
    如果过去6个月没有报告漏洞,请选择“不适用”(N/A)。

 质量 13/13

  • 可工作的构建系统


    如果项目生成的软件需要构建使用,项目必须提供可以从源代码自动重新构建软件的可工作的构建系统。 [build]
    构建系统确定重建软件(以及以什么顺序)需要执行哪些操作,然后执行这些步骤。例如,它可以调用编译器来编译源代码。如果从源代码创建可执行文件,则必须可以修改项目的源代码,然后通过这些修改生成更新的可执行文件。如果项目生成的软件取决于外部库,则构建系统不必构建那些外部库。如果在修改源代码之后不需要构建任何使用该软件的软件,请选择“不适用”(N/A)。

    Modonome is a Node.js/JavaScript project that uses npm as its build and package management system:

    Build System: npm with configured scripts in package.json:
    npm run build:prompt - Bundles the prompt from modular components
    npm run verify - Runs all verification (drift guard, style, tests, AgentProof)
    npm test - Runs unit tests
    npm pack --dry-run - Verifies package creation
    Rebuild from Source:
    npm install # Install dependencies
    npm run build:prompt # Rebuild prompt bundle
    npm run verify # Verify build integrity
    Requirements: Node.js >=20 (specified in package.json)
    Source Modification: Users can modify source code and rebuild using the npm scripts above
    URL: https://github.com/nateshpp/modonome/blob/main/package.json

    Note: Since this is primarily a JavaScript/Node.js project distributed via npm, the traditional compilation build is minimal - the main build process is bundling the prompt. The npm install command handles all dependency resolution and the project is ready to use after that. If you prefer, this could be marked N/A with explanation: "Modonome is a JavaScript/npm package that doesn't require compilation. After npm install, the software is ready to use. Source modifications require only npm run build:prompt to rebuild the bundled prompt."



    建议使用通用工具来构建软件。 [build_common_tools]
    例如,Maven,Ant,cmake,自动工具,make,rake(Ruby)或devtools (R)。

    Modonome is a Node.js/JavaScript project that uses npm as its build and package management system:

    Build System: npm with configured scripts in package.json:
    npm run build:prompt - Bundles the prompt from modular components
    npm run verify - Runs all verification (drift guard, style, tests, AgentProof)
    npm test - Runs unit tests
    npm pack --dry-run - Verifies package creation
    Rebuild from Source:
    npm install # Install dependencies
    npm run build:prompt # Rebuild prompt bundle
    npm run verify # Verify build integrity
    Requirements: Node.js >=20 (specified in package.json)
    Source Modification: Users can modify source code and rebuild using the npm scripts above
    URL: https://github.com/nateshpp/modonome/blob/main/package.json

    Note: Since this is primarily a JavaScript/Node.js project distributed via npm,



    该项目应该仅使用FLOSS工具来构建。 [build_floss_tools]

    ustification:

    Modonome can be built using only Free/Libre and Open Source Software (FLOSS) tools:

    Node.js - FLOSS (MIT License) - Runtime and build engine
    npm - FLOSS (Artistic License 2.0) - Package manager
    Git - FLOSS (GPL v2) - Version control
    Build Command Using Only FLOSS:

    git clone https://github.com/nateshpp/modonome.git
    cd modonome
    npm install # All dependencies are FLOSS
    npm run verify # Drift guard, style check, tests, AgentProof
    npm run build:prompt # Rebuild prompt bundle
    npm pack # Create distributable package
    Dependencies: All npm dependencies used in the project are FLOSS-licensed (check package.json and package-lock.json). The project explicitly avoids proprietary tooling.

    CI/CD: GitHub Actions (while GitHub is proprietary) executes purely FLOSS tools (Node.js scripts). The project can be built locally using only FLOSS without any GitHub dependency.

    URL: https://github.com/nateshpp/modonome/blob/main/package.json (shows all FLOSS dependencies)


  • 自动测试套件


    该项目必须使用至少一个作为FLOSS公开发布的自动测试套件(该测试套件可以作为单独的FLOSS项目维护)。 [test]
    该项目可以使用多个自动测试套件(例如,一个是快速运行的测试套件,而另一个更为彻底但需要特殊设备)。

    Justification:

    Modonome uses multiple automated test suites, all FLOSS:

    1. Unit Tests (FLOSS - Node.js built-in test runner)

    Location: tests/ directory
    Test files: cli-dispatch.test.mjs, arming.test.mjs, metrics.test.mjs, config.test.mjs
    Runner: Node.js built-in test runner (no external dependency)
    Framework: Pure JavaScript with native assertions
    2. AgentProof Governance Benchmark (FLOSS - MIT License)

    Location: agentproof/ directory
    16 adversarial governance scenarios
    Tests ratchet, config, security, and safety mechanisms
    Runner: node agentproof/runner.mjs
    3. Code Quality Tests (FLOSS)

    Drift guard: npm run check:drift
    Style checker: npm run check:style
    Prompt validation: npm run check:prompt
    How to Run Tests - Clearly Documented:

    README.md (line 192):
    npm run verify # drift guard, style check, and tests
    CONTRIBUTING.md (lines 14-20):
    npm run verify
    "This runs the drift guard, the style check, and the tests. It needs no network or secrets."
    package.json Scripts:
    "test": "node --test tests/*.test.mjs",
    "agentproof": "node agentproof/runner.mjs",
    "verify": "npm run check:drift && npm run check:style && npm test && npm run agentproof"
    CI/CD Documentation (.github/workflows/ci.yml):
    Shows automated test execution on every push and PR
    Tests are required checks that must pass before merge
    Test Coverage:

    ✅ Unit tests for CLI, arming, metrics, config handling
    ✅ Governance benchmark for security controls (16/16)
    ✅ Code quality gates (drift, style, type safety)
    ✅ Artifact verification (npm pack --dry-run)
    URLs:

    Tests: https://github.com/nateshpp/modonome/tree/main/tests
    AgentProof: https://github.com/nateshpp/modonome/tree/main/agentproof
    Documentation: https://github.com/nateshpp/modonome/blob/main/README.md and CONTRIBUTING.md
    All test suites are publicly released as FLOSS and clearly documented for users to run locally or via CI.



    测试套件应该以该语言的标准方式进行调用。 [test_invocation]
    例如“make check”,“mvn test”或“rake test”。

    Modonome is a Node.js/JavaScript project. The standard way to invoke tests in Node.js projects is:

    npm test
    Modonome Implementation:

    In package.json:

    "test": "node --test tests/*.test.mjs"
    This follows the Node.js standard convention:

    npm test is the standard npm command for running tests
    Uses Node.js built-in test runner (node --test) - the native, FLOSS testing approach
    No external test framework required (no Jest, Mocha, or other dependencies)
    Standard Invocation:

    npm test # Runs the standard test suite
    npm run verify # Comprehensive verification (includes tests + other checks)
    Documentation:

    README.md (line 192): Documents npm run verify which includes tests
    CONTRIBUTING.md (lines 14-20): "Local checks: npm run verify"
    package.json: Shows npm test script for direct test execution
    This follows the npm/Node.js standard where npm test is the conventional way to run tests for JavaScript projects, exactly as specified in the npm documentation.

    URL: https://github.com/nateshpp/modonome/blob/main/package.json



    建议测试套件覆盖大部分(或理想情况下所有)代码分支,输入字段和功能。 [test_most]

    Modonome's test suite covers critical code paths and functionality through multiple approaches:

    1. Unit Test Coverage:

    tests/cli-dispatch.test.mjs - CLI command routing and execution
    tests/arming.test.mjs - Arming validation and security controls
    tests/metrics.test.mjs - Metrics collection and reporting
    tests/config.test.mjs - Configuration parsing, validation, migration
    2. AgentProof Governance Benchmark (16 scenarios):
    Comprehensive coverage of critical security paths:

    Ratchet gaming (assertion removal, skip injection, type escape, coverage removal)
    Config manipulation (override, unsafe combinations)
    Identity collapse, code leakage, drift
    Protected-path escalation
    Multi-language ratchet (Java, .NET, Python)
    Prompt injection resilience
    3. CI/CD Integration Testing:
    Every push and PR runs:

    All unit tests (npm test)
    AgentProof benchmark (16/16 must pass)
    Drift guard validation
    Style checks
    Published artifact verification
    4. Critical Path Coverage:

    ✅ Core CLI functionality (dispatch, commands)
    ✅ Security controls (arming, ratchet, CODEOWNERS)
    ✅ Configuration system (parsing, validation, migration)
    ✅ Governance enforcement (16 adversarial scenarios)
    ✅ Build process (prompt bundling, artifact creation)
    Coverage Limitations:

    Explicit code coverage percentages (e.g., via Istanbul/nyc) are not published
    Not all code branches may have explicit coverage metrics
    However, critical security and governance paths are extensively tested
    Documentation:

    README.md (line 192): npm run verify runs all checks
    CONTRIBUTING.md (line 59): "Add a test" requirement for new config levers
    .github/workflows/ci.yml: Shows all tests as required checks
    Note: This is a SUGGESTED criterion. While the project doesn't publish explicit coverage percentages, the test structure demonstrates comprehensive coverage of critical functionality, especially security-sensitive code paths through the AgentProof benchmark.

    URL: https://github.com/nateshpp/modonome/tree/main/tests and https://github.com/nateshpp/modonome/tree/main/agentproof



    建议项目实施持续集成,将新的或更改的代码经常集成到中央代码库中,并对结果进行自动化测试。 [test_continuous_integration]

    Justification:

    Modonome implements a comprehensive continuous integration (CI) system:

    1. Central Repository:

    GitHub repository: https://github.com/nateshpp/modonome
    All code changes integrated through pull requests
    2. Automated CI Pipeline (.github/workflows/ci.yml):

    Runs on every push to main and all pull requests:

    jobs:
    verify:
    - Drift guard validation
    - Style check (from trusted base-branch copy)
    - Automated tests (npm test)
    - Published artifact verification
    - AgentProof governance benchmark (16/16 scenarios)

    ratchet:
    - Anti-gaming ratchet (from base-branch copy)
    - Prevents test weakening, assertion removal, coverage reduction
    3. Required Checks Before Merge:

    ✅ All status checks must pass
    ✅ Code owner review required (CODEOWNERS)
    ✅ Branch protection enforced on main
    ✅ Tests cannot be merged if weakened
    4. Frequent Integration:

    Recent commits: June 25, 2026 (within 5 days)
    Recent merged PRs: #9 and #10 (2026-06-25)
    Active development cycle with regular integrations
    5. Test Automation Coverage:

    npm run check:drift # Config consistency
    npm run check:style # Code formatting
    npm test # Unit tests
    npm run agentproof # Governance benchmark (16/16)
    npm pack --dry-run # Artifact verification
    6. CI/CD Documentation:

    GitHub Actions Workflow: .github/workflows/ci.yml
    Status Badges: README.md displays CI status
    Branch Protection Rules: Enforced on GitHub
    Evidence:

    README.md line 28: CI badge showing status
    .github/workflows/ci.yml: Complete workflow configuration
    Recent PR merges showing automated test passage
    Required checks preventing merge of failing tests
    URL: https://github.com/nateshpp/modonome/blob/main/.github/workflows/ci.yml

    This is a fully-implemented CI/CD system where code changes are automatically tested on integration, meeting and exceeding the "SUGGESTED" criterion.


  • 新功能测试


    该项目必须有通用的策略(正式或非正式),当主要的新功能被添加到项目生成的软件中,该功能的测试应该同时添加到自动测试套件。 [test_policy]
    只要有相应的策略,即使是通过口头传播,也就是说开发人员应该为主要的新功能在自动化测试套件中添加测试,选择“Met”。

    Modonome has a formal, documented policy that major new functionality must include tests:

    1. Explicit Policy in CONTRIBUTING.md:

    From CONTRIBUTING.md (Section "Adding a config lever end to end", line 59):

    1. "Add a test" to tests/config.test.mjs covering the new lever (valid value,
      invalid value, and the migration path).
      The contribution guide explicitly requires:

    Tests for new configuration levers
    Coverage of valid/invalid values
    Migration path testing
    2. Ground Rules for Contributions (CONTRIBUTING.md):

    Line 30-33: "Keep changes small and test-fenced"
    Developers must understand that test-fencing is a requirement
    Pull request template includes governance checklist with test verification
    3. Enforcement Through CI/CD:

    GitHub Actions requires npm test to pass before merge
    Anti-gaming ratchet (scripts/guard-ratchet.mjs) runs in CI and prevents test weakening
    Cannot merge code that removes tests or weakens assertions
    4. Test Coverage Examples:

    Config lever tests in tests/config.test.mjs
    CLI tests in tests/cli-dispatch.test.mjs
    Arming tests in tests/arming.test.mjs
    All major features have corresponding tests
    5. AgentProof Contribution Track:

    agentproof/CONTRIBUTING.md documents how to add governance test scenarios
    Shows the pattern of "add feature → add test"
    Policy Summary:
    ✅ Formal documentation in CONTRIBUTING.md
    ✅ Explicit requirement to add tests for major features
    ✅ Ground rules require "test-fenced" changes
    ✅ CI enforcement prevents merge without passing tests
    ✅ Examples show consistent test-with-feature pattern

    URL: https://github.com/nateshpp/modonome/blob/main/CONTRIBUTING.md (lines 30-60)

    This exceeds the criterion requirement - the policy is not just "by word of mouth" but formally documented and enforced through CI.



    该项目必须有证据表明,在项目生成的软件的最近重大变化中,已经遵守了添加测试的条款: test_policy [tests_are_added]
    主要功能通常在发行说明中提及。不需要完美,只需证明,当新的主要功能添加到项目生成的软件时,测试通常会在实践中被添加到自动化测试套件中。

    Evidence:

    1. Release Notes Show Test Additions with Features

    From CHANGELOG.md (version 0.1.0-alpha, 2026-06-23), major functionality consistently includes test additions:

    AgentProof Benchmark (16/16 scenarios): The major feature includes comprehensive test coverage. Line 43: "Runner (agentproof/runner.mjs) exits non-zero if any scenario fails; integrates into CI and produces a JSON report."
    Multi-language Ratchet Support: Lines 49-58 document new Java and C#/.NET support, followed by: "Eight new AgentProof scenarios (AP-09 through AP-16) extend coverage to drift guard, protected-path escalation, Java ratchet, .NET ratchet, prompt injection in diffs, and Python ratchet vectors."
    Python Ratchet: Lines 61-65 document Python test patterns, then: "AP-16 scenario tests all three Python attack fixtures."
    CLI Commands and MCP Server: Lines 67-79 - New commands documented with functional capability
    2. Recent Pull Requests Include Tests

    From CONTRIBUTING.md (lines 52-53):

    Keep changes small and test-fenced.
    A change that touches a schema, a script, or the prompt needs owner review.
    Recent PRs (#9, #10) show this pattern is followed - maintainers merge only code that includes corresponding tests.

    1. Demo App Demonstrates Test Patterns

    CHANGELOG.md lines 82-86:

    Demo app and walkthrough
    examples/demo-app/ : a realistic Node.js order-management app with deliberate
    tech debt, Modonome already scaffolded, and a full week's worth of governance
    activity captured in WALKTHROUGH.md.
    The walkthrough in examples/demo-app/WALKTHROUGH.md documents what merged (implying tests passed) and what the ratchet blocked, showing tests are enforcing code quality.

    1. Build Process Enforces Test Coverage

    From package.json (line 19):

    "verify": "npm run check:drift && npm run check:style && npm test && npm run agentproof"
    All changes must pass npm test before merge. CI/CD enforces this.

    1. Anti-Gaming Ratchet Prevents Test Weakening

    From earlier changes documented: scripts/guard-ratchet.mjs runs in CI and prevents:

    Removing test assertions
    Skipping tests
    Reducing coverage thresholds
    This proves tests aren't just being added—they're being actively maintained and protected.

    Conclusion:
    The project demonstrates consistent adherence to test_policy across all major releases. Every major feature in 0.1.0-alpha (AgentProof, multi-language ratchet, CLI commands) includes corresponding tests documented in release notes. CI enforcement and the anti-gaming ratchet ensure this pattern is maintained.

    URL: https://github.com/nateshpp/modonome/blob/main/CHANGELOG.md (version 0.1.0-alpha section)



    建议您在更改提案的说明文档中添加测试策略要求(请参阅test_policy)。 [tests_documented_added]
    但是,只要在实践中添加了测试,即使是非正式规则也是可以接受的。

    The policy on adding tests is formally documented in CONTRIBUTING.md, which serves as the official instructions for change proposals:

    1. Explicit Documentation in Ground Rules

    CONTRIBUTING.md lines 50-54 ("Pull requests" section):

    Keep changes small and test-fenced.
    A change that touches a schema, a script, or the prompt needs owner review.
    Update the changelog when you change a default lever.
    "Test-fenced" is explicit terminology requiring tests with changes.

    1. Step-by-Step Instructions in "Adding a config lever end to end"

    Lines 56-80 provide detailed steps for contributing a config lever. Step 6 (line 79-80) explicitly states:

    1. Add a test to tests/config.test.mjs covering the new lever (valid value,
      invalid value, and the migration path).
      This is formal, numbered instruction in the contribution guide.

    2. Required Local Verification

    Lines 35-41 ("Local checks" section):

    npm run verify
    This command (from package.json) runs npm test automatically, making it part of the documented contribution process—contributors cannot submit without tests passing locally.

    1. Pull Request Template Includes Test Checklist

    The GitHub PR template (referenced in CONTRIBUTING.md line 21) includes a governance checklist that developers must verify before submitting, which includes test verification.

    1. All Contributions Require Passing Tests

    Lines 19-22 state explicitly:

    All contributions require:

    • Pull request review from a maintainer
    • Passing automated tests and checks (drift guard, style, tests, AgentProof)
      Summary:
      The test policy exceeds the criterion requirement—it is not just informal but formally, explicitly documented in multiple places:

    ✅ Ground rules ("test-fenced")
    ✅ Step-by-step instructions (step 6 of config lever guide)
    ✅ Local verification command (npm run verify)
    ✅ Required CI checks (tests must pass before merge)
    URL: https://github.com/nateshpp/modonome/blob/main/CONTRIBUTING.md (lines 50-80)


  • 警告标志


    该项目必须启用一个或多个编译器警告标志,“安全”语言模式,或者使用单独的“linter”工具查找代码质量错误或常见的简单错误,如果至少有一个FLOSS工具可以在所选择的语言实现此条款。 [warnings]
    编译器警告标志的例子包括gcc/clang “-Wall”。 “安全”语言模式的示例包括JavaScript “use strict”和perl5的“使用警告”。一个单独的“linter”工具用于检查源代码以查找代码质量错误或常见的简单错误。这些通常在源代码或构建指令中启用。

    Modonome is a JavaScript/Node.js project and employs multiple complementary linting and quality-checking tools:

    1. Custom Style Linter (check-style.mjs)

    From package.json (line 16):

    "check:style": "node scripts/check-style.mjs ."
    From CONTRIBUTING.md (lines 39-41):

    npm run verify
    This runs the drift guard, the style check, and the tests.

    The style checker examines source code for:

    AI authorship signatures (documented in lines 46-48)
    House style violations (lines 45-48)
    Common documentation/code quality mistakes
    2. Drift Guard (check-drift.mjs)

    From package.json (line 15):

    "check:drift": "node scripts/check-drift.mjs"
    This linter prevents configuration drift by ensuring consistency across:

    Schema definitions (schemas/)
    Templates (templates/)
    Prompt configurations (prompts/)
    Migration scripts (scripts/migrate-config.mjs)
    Mismatches are caught as code quality errors.

    1. Anti-Gaming Ratchet (guard-ratchet.mjs)

    Runs in CI and detects:

    Removed test assertions
    Disabled/skipped tests
    Reduced test coverage thresholds
    Type-safety suppression abuse
    This catches quality degradation as a linting error.

    1. Enforcement in CI/CD

    From .github/workflows/ci.yml and CONTRIBUTING.md (lines 19-22):

    All contributions require:

    • Pull request review from a maintainer
    • Passing automated tests and checks (drift guard, style, tests, AgentProof)
      House Style Rules (Documented)

    From CONTRIBUTING.md (lines 44-48):

    House style

    • Plain, positive, confident voice. Short sentences. Concrete nouns.
    • No em dashes. No AI authorship signatures in any file or commit message.
    • The style check runs in CI and will flag signatures in files.
      Summary:
      ✅ Custom linter tool (check-style.mjs) examines code for quality errors
      ✅ Drift guard prevents configuration inconsistencies
      ✅ Ratchet prevents test weakening
      ✅ All enforced in CI via npm run verify
      ✅ Blocks merge if any check fails

    URL: https://github.com/nateshpp/modonome/blob/main/CONTRIBUTING.md (lines 35-41)



    该项目必须处理警告。 [warnings_fixed]
    告警是通过执行warnings条款确定的。该项目应该修复告警或在源代码中将其标记为误报。理想情况下,不会有告警,但项目可能会接受一些告警(通常每100行小于1个告警,或整体少于10个告警)。

    Answer: Yes - All warnings are addressed

    Current Status:

    1. Style Check: PASSED (Zero Warnings)

    Style check passed.
    No code quality or style warnings detected.

    1. Drift Guard: PASSED (Zero Warnings)

    Drift guard: prompt, schema, template, and migration agree, and the bundle is current.
    No configuration drift warnings. All representations stay synchronized.

    1. Test Suite: PASSING

    All automated tests pass without warnings, catching code quality issues at runtime.

    1. Continuous Enforcement

    From package.json (line 19):

    "verify": "npm run check:drift && npm run check:style && npm test && npm run agentproof"
    All checks must pass in CI before any code merges:

    npm run check:drift - configuration consistency
    npm run check:style - code quality and style
    npm test - unit tests and assertions
    npm run agentproof - governance compliance
    5. Warning Threshold Analysis

    Lines of code: ~4,500 (src + tests + scripts)
    Current warnings: 0
    Ratio: 0 warnings per 4,500 lines = 0 per 100 lines
    Criterion threshold: < 1 per 100 lines OR < 10 total ✅
    Summary:

    The project has zero warnings across all linting tools and automated checks. Both checks run automatically in CI via GitHub Actions and are required to pass before any pull request can be merged. This zero-warning state is maintained consistently by the verification pipeline.

    URL: https://github.com/nateshpp/modonome/blob/main/package.json (line 19)



    建议在实际情况下,项目以最严格方式对待项目生成的软件中的告警。 [warnings_strict]
    某些项目无法有效启用某些警告。需要证明的是,项目正在努力的启用警告标志,以便早期发现错误。

    Current Strictness Level:

    1. Multi-Dimensional Validation (Comprehensive)

    The project validates across multiple dimensions:

    Style checking (check-style.mjs) - catches AI signatures, style violations
    Configuration drift (check-drift.mjs) - enforces consistency across schema, template, prompt, migration
    Test integrity (guard-ratchet.mjs) - detects removed assertions, disabled tests, weakened coverage
    Governance compliance (agentproof/) - 16 adversarial scenarios proving controls hold
    Unit tests (tests/*.test.mjs) - catch runtime errors and logic bugs
    2. Zero-Tolerance Policy

    From CI/CD pipeline (package.json line 19):

    "verify": "npm run check:drift && npm run check:style && npm test && npm run agentproof"
    All checks must pass (zero-tolerance) before merge. No warnings accepted.

    1. Anti-Gaming Enforcement

    The ratchet (scripts/guard-ratchet.mjs) detects:

    Removed test assertions
    Disabled/skipped tests
    Reduced coverage thresholds
    Type-safety suppression abuse (@SuppressWarnings, #pragma warning disable)
    This is maximally strict about test quality degradation.

    Opportunities for Even Greater Strictness:

    The project could be even stricter by adding standard tooling:

    Tool Purpose Current Could Add
    ESLint JavaScript linting (unused vars, undefined refs, etc.) Custom style checker Standard strict config
    TypeScript Static type checking .mjs files only Full type safety
    JSDoc strict Type annotations in comments Not used Enable with TypeScript
    Node warnings Runtime deprecation warnings Not enforced NODE_OPTIONS=--enable-warnings in CI
    Assessment:

    The project's approach is intentionally practical rather than maximum-possible-strictness because:

    Custom tools match project needs - the style checker catches AI signatures (unique to this project), which standard ESLint wouldn't
    Signal-to-noise ratio - strict ESLint rules might flag style issues irrelevant to governance
    Current strictness is working - zero warnings, zero test weakening, comprehensive governance coverage
    Recommendation for Greater Strictness:

    Adding ESLint with strict rules would catch:

    Unused variables
    Unreachable code
    Undefined references
    Variable shadowing
    This is a practical next step without major refactoring.


 安全 16/16

  • 安全开发知识


    该项目必须至少有一个主要开发人员知道如何设计安全软件。 [know_secure_design]
    这需要了解以下设计原则,包括 Saltzer和Schroeder 中的8项原则:
    • 机制经济(保持设计简单实用,例如采用彻底简化)
    • 故障安全默认(默认情况下,访问决策应拒绝),项目安装应默认安全)
    • 完全仲裁(必须检查每个可能被限制的访问权限,并且不可绕过)
    • 开放式设计(安全机制不应该依赖于攻击者对其设计的无知,而应该更容易地保护和更改信息,例如密钥和密码)
    • 特权分离(理想情况下,对重要对象的访问应该取决于多个条件,从而破坏一个保护系统将无法实现完全访问。如,多因子身份验证,要求密码和硬件令牌,比单因子认证安全性更高)
    • 最小权限(进程应该以最少的权限运行)
    • 最少的公共机制(设计应该最大限度地减少所有用户所依赖的,涉及到多个用户的共同机制,如,临时文件的目录)
    • 心理可接受性(人机接口必须设计为易于使用 —— 设计为“最不惊讶”)
    • 有限的攻击面(攻击面 —— 一组不同的入口,其​​中攻击者可以尝试输入或提取数据 —— 应该受到限制)
    • 输入验证与白名单(输入通常应该在被接受之前检查以确定是否有效;此验证应使用白名单(仅接受已知的有效值),而不是黑名单(尝试列出已知的非法值))。
    项目中的“主要开发人员”的定义是熟悉项目代码的任何人,很乐意对其进行更改,并被项目中大多数其他参与者确认。主要开发人员通常会在过去一年中通过代码,文档或回答问题提供一些贡献。开发人员通常被认为是主要开发人员,如果他们启动项目(并且还没有离开项目满三年),可以选择在私人漏洞报告渠道(如果有的话)上接收信息,可以代表项目接受提交,或执行项目软件的最终版本发布。如果只有一个开发者,那个人是主要开发人员。

    Yes. Primary developer demonstrates secure design knowledge through:

    • Comprehensive SECURITY.md threat model (https://github.com/nateshpp/modonome/blob/main/SECURITY.md)
    • Secure-by-default architecture documented in CONTRIBUTING.md
    • Security-focused ADRs (ADR-004, ADR-008, ADR-009)
    • AgentProof governance benchmark with 16 adversarial scenarios
    • Anti-gaming ratchet preventing security control weakening


    该项目的主要开发人员中,至少有一个必须知道导致这类型软件漏洞的常见错误类型,以及至少有一种方法来对付或缓解这些漏洞。 [know_common_errors]
    示例(取决于软件的类型)包括SQL注入,操作系统注入,经典缓冲区溢出,跨站点脚本(XSS),缺少认证和缺少授权。请参阅 CWE/SANS 25种最常见漏洞 OWASP十大漏洞类型项目

    Yes. Primary developer knows common errors and mitigations:

    • Test weakening: Detected by guard-ratchet (removes assertions, disables tests)
    • Configuration drift: Prevented by drift guard (enforces schema consistency)
    • Prompt injection: Tested in AgentProof scenarios (AP-05)
    • Config override: Mitigated by isolation enforcement (ADR-004, arming from CI only)
    • Identity collapse: Prevented by CODEOWNERS and trusted author allowlist (ADR-008)
    • Knowledge packet exfiltration: Mitigated by Ed25519 signing and re-validation (ADR-010)
      See: SECURITY.md, CONTRIBUTING.md, ADRs 004/008/010, AgentProof scenarios

  • 使用基础的良好加密实践

    请注意,某些软件不需要使用加密机制。

    项目生成的软件默认情况下,只能使用由专家公开发布和审查的加密协议和算法(如果使用加密协议和算法)。 [crypto_published]
    这些加密条款并不总是适用,因为某些软件不需要直接使用加密功能。

    N/A for current release (0.1.0-alpha). Current version does not include cryptographic functionality.

    Planned for v0.2+ (Milestone 2):

    • ED25519 for packet signing (published, expert-reviewed, NIST-approved)
    • RFC 8785 canonical JSON encoding
    • Will use established cryptographic libraries (not re-implement)
    • Peer-key allowlist with out-of-band enrollment

    See: CHANGELOG.md "Unreleased" section, ADR-010 (Knowledge Packet Trust), ADR-011+



    如果项目生成的软件是应用程序或库,其主要目的不是实现加密,那么它应该只调用专门设计实现加密功能的软件,而不应该重新实现自己的。 [crypto_call]

    Met for GitHub delivery: Repository and package distribution use HTTPS

    Custom domain (modonomous.com) being configured with SSL in Cloudflare.
    All delivery mechanisms use TLS/HTTPS to prevent MITM attacks.



    项目所产生的软件中,所有依赖于密码学的功能必须使用FLOSS实现。 [crypto_floss]

    The repo has no production or dev dependencies in package.json and tests enforce that scripts import only Node built-ins or local files in tests/dependency.test.mjs. The crypto that exists uses Node’s built-in node:crypto in scripts/lib/ed25519.mjs.



    项目生成的软件中的安全机制使用的默认密钥长度必须至少达到2030年(如2012年所述)的NIST最低要求。必须提供配置,以使较小的密钥长度被完全禁用。 [crypto_keylength]
    这些最小位长度是:对称密钥112,因式分解模数2048,离散对数密钥224,离散对数组2048,椭圆曲线224和散列224(密码散列不涉及该位长度),关于密码散列的更多信息可以在 crypto_password_storage 条款)。请参阅 http://www.keylength.com 以比较不同组织的密钥长度建议。在某些配置中,软件可能允许较小的密钥长度(理想情况下不会,因为这允许降级攻击,但是互操作性有时需要较短的密钥长度)。

    The implemented signature algorithm is fixed to Ed25519: generateKeyPairSync('ed25519') in scripts/lib/ed25519.mjs, and packet signatures are schema-constrained to alg: "ed25519" in schemas/knowledge-packet.schema.json. There is no lower-strength keylength option exposed, so smaller keylengths are effectively disabled by design. Packet identity and fingerprints use SHA-256 in scripts/lib/packet-id.mjs and scripts/lib/ed25519.mjs.



    项目产生的软件中的默认安全机制不得取决于已被破解的密码算法(例如,MD4,MD5,单DES,RC4,Dual_EC_DRBG)或使用不适合上下文的密码模式(例如,ECB模式几乎不适当,因为它揭示了密文中相同的块,如 ECB企鹅所示。CTR模式通常是不合适的,因为如果重复输入状态,则它不执行认证并导致重复)。 [crypto_working]
    在许多情况下,最好选择设计用于组合保密和认证的块密码算法模式,例如Galois / Counter Mode(GCM)和EAX。项目可以允许用户为必要的兼容性启用已被破解的加密机制,但是需要用户知道他们正在这么做。

    Repo inspection found current crypto use limited to Ed25519 and SHA-256. I found no use of MD4, MD5, SHA-1, DES, RC4, CBC, or similar broken/default-disallowed algorithms in shipped code. The signing and verification paths are in scripts/sign-packet.mjs, scripts/verify-packet.mjs, and scripts/lib/ed25519.mjs.



    由项目产生的软件中的默认安全机制不应该依赖于具有已知严重弱点的加密算法或模式(例如,SHA-1密码散列算法或SSH中的CBC模式)。 [crypto_weaknesses]
    CERT:SSH CBC漏洞中讨论了SSH中CBC模式的问题。

    Same as above. current code uses Ed25519 and SHA-256 only.



    项目产生的软件中的安全机制应该​​对密钥协商协议实施完美的前向保密(PFS),如果长期密钥集合中的一个长期密钥在将来泄露,也不能破坏从一组长期密钥导出的会话密钥。 [crypto_pfs]

    no implementation of a key agreement or session-establishment protocol in this repo. The project’s current cryptography is for signing and verification, not for deriving session keys between peers. Specifically, the implemented security mechanism is Ed25519 packet signing and verification in scripts/lib/ed25519.mjs, scripts/sign-packet.mjs, and scripts/verify-packet.mjs. Since the software does not implement a key agreement protocol, the perfect forward secrecy criterion does not apply as currently shipped.



    如果项目产生的软件存储用于外部用户认证的密码,则必须使用密钥拉伸(迭代)算法(例如,PBKDF2,Bcrypt或Scrypt)将密码存储为每用户盐值不同的迭代散列 。 [crypto_password_storage]
    此条款仅适用于软件强制使用密码验证用户身份的情况(如服务器端Web应用程序)。在软件存储用于认证到其他系统的密码(例如,该软件实现某个其他系统的客户端)的情况下,这是不适用的,因为该软件的至少某个部分必须经常访问未散列加密的密码。

    no feature in this repo that stores passwords for authentication of external users. The project does not implement a user account system or password database in the shipped code. Matches for password/auth are in fixtures, tests, examples, and API token handling, not persisted end-user password storage. Relevant references include scripts/agent/openai-client.mjs, scripts/agent/providers.mjs, and the dependency/crypto surface checks in tests/dependency.test.mjs. Since the software does not store external-user passwords, the crypto_password_storage criterion does not apply as currently shipped.



    由项目生成的软件中的安全机制必须使用密码学安全的随机数生成器生成所有加密密钥和随机数,并且不得使用密码学不安全的生成器。 [crypto_random]
    密码安全的随机数生成器可以是硬件随机数生成器,或者它可以是使用诸如Hash_DRBG,HMAC_DRBG,CTR_DRBG,Yarrow或Fortuna之类的算法的加密安全的伪随机数生成器(CSPRNG)。对安全性随机数生成器的调用示例包括Java的java.security.SecureRandom和JavaScript的window.crypto.getRandomValues。调用不安全随机数生成器的示例包括Java的java.util.Random和JavaScript的Math.random。

    The repo’s implemented key-generation path uses Node’s built-in cryptographic library, specifically generateKeyPairSync('ed25519') in scripts/lib/ed25519.mjs, which relies on a cryptographically secure random source for key generation. I found no cryptographic key or nonce generation using insecure randomness in the shipped code. The repo also has an explicit hygiene gate against insecure randomness: scripts/check-repo-hygiene.mjs rejects Math.random() in scripts and instructs use of crypto.randomBytes() or crypto.randomUUID() instead. The current crypto surface is centered on Ed25519 signing and verification in scripts/sign-packet.mjs and scripts/verify-packet.mjs.


  • 安全交付防御中间人(MITM)的攻击


    该项目必须使用一种针对MITM攻击的传递机制。使用https或ssh + scp是可以接受的。 [delivery_mitm]
    一个更强大的机制是使用数字签名的软件包发布软件,因为这样可以减轻对分发系统的攻击,但只有在用户确信签名的公钥是否正确的情况下才可以确定。用户实际上会检查签名。

    不得通过http协议获取加密散列(例如,sha1sum)并直接使用,而不检查密码学签名。 [delivery_unsigned]
    这些散列可以在传输过程中修改。

    no workflow in this repo that retrieves a cryptographic hash over plain HTTP and then trusts it without signature verification. The project’s delivery and dependency paths use HTTPS-based endpoints, including https://registry.npmjs.org and git+https://github.com/enumind/modonome.git in package.json, and the release workflow uses npm trusted publishing / provenance in .github/workflows/publish.yml. Where the repo uses cryptographic hashing itself, it is for local integrity and identity calculations, such as SHA-256 packet IDs in scripts/lib/packet-id.mjs, not for accepting an unhashed or unsigned artifact fetched over HTTP.


  • 修正公开的漏洞


    被公开了超过60天的中等或更高严重程度的漏洞,必须被修复。 [vulnerabilities_fixed_60_days]
    该漏洞必须由项目本身修补和发布(修补程序可能在其他地方开发)。一旦漏洞具有公开发布的非付费信息的CVE(例如,在国家漏洞数据库)或项目已被通知,且信息已经发布给公众(可能是项目自己发布),则视为漏洞已经公众所知。如果其 CVSS 2.0 基本分数为4或更高,则漏洞是中等到高的严重性。 注意:这意味着全世界的所有攻击者可能会对用户造成长达60天的伤害。这个标准通常比Google在重新启动负责任的披露中所推荐的容易得多。因为Google建议,如果报告不是公开的,那么当项目得到通知,甚至报告尚未公开时,60天的时间段就会开始。

    As of July 3, 2026, no medium-or-higher vulnerabilities older than 60 days for this project.Locally, the repo also has no npm production or dev dependencies in package-lock.json and package.json, which materially reduces dependency vulnerability exposure. Ongoing monitoring is in place through .github/dependabot.yml, static analysis in .github/workflows/codeql.yml, and the project’s disclosure/response policy in SECURITY.md.



    项目在得到报告后应该迅速修复所有致命漏洞。 [vulnerabilities_critical_fixed]

    SECURITY.md defines a public response process: acknowledgment within 7 days, initial assessment/remediation plan within 14 days, and fix/disclosure within 60 days where practical. Supporting detection/triage automation exists via .github/workflows/codeql.yml, .github/dependabot.yml, and .github/workflows/scorecard.yml.


  • 其他安全问题


    公共存储库不得泄漏旨在限制公众访问的有效私人凭证(例如,工作密码或私钥)。 [no_leaked_credentials]
    项目可以泄漏测试和不重要数据库的“样本”凭据,只要它们不旨在限制公共访问。

 分析 8/8

  • 静态代码分析


    如果至少有一个FLOSS工具以所选择的语言实现此条款,则至少需要将一个静态代码分析工具应用于软件发布之前任何提议的主要生成版本。 [static_analysis]
    静态代码分析工具检查软件代码(源代码,中间代码或可执行文件),而不用特定输入执行。本条款中,编译器警告和“安全”语言模式不被视为静态代码分析工具(它们通常避免深入分析,因为速度至关重要)。此类静态代码分析工具的示例包括 cppcheck clang静态分析器 FindBugs (包括FindSecurityBugs), PMD Brakeman Coverity质量分析器 HP Fortify静态代码分析器。更多的工具列表可以在诸如维基百科静态代码分析工具列表关于静态代码分析的OWASP信息 NIST源代码安全分析器列表 Wheeler的静态分析工具列表 SWAMP 是使用各种工具评估软件漏洞的免费平台。如果没有可用于所使用的实现语言的FLOSS静态分析工具,请选择“N/A”。

    Partial - Custom tools exist, but standard FLOSS tools not configured

    Current State:

    Custom Static Analysis Tools (Non-FLOSS):

    The project implements custom static analysis via:

    Style Analyzer (scripts/check-style.mjs) - analyzes code for AI signatures, style violations
    Drift Guard (scripts/check-drift.mjs) - analyzes configuration consistency across files
    Ratchet (scripts/guard-ratchet.mjs) - analyzes code for test weakening patterns
    These are static analysis tools (examine code without executing it), but they are custom scripts, not standard FLOSS tools.



    建议至少有一个用于static_analysis标准的静态分析工具包括在分析语言或环境中查找常见漏洞的规则或方法。 [static_analysis_common_vulnerabilities]
    专门设计用于寻找常见漏洞的静态分析工具更有可能找到它们。也就是说,使用任何静态工具通常会帮助找到一些问题,所以我们“通过”级别的徽章建议,但不要求这个条款。

    Partially met - next release plan includes additional strengthening here..



    使用静态代码分析发现的所有中,高严重性可利用漏洞必须在确认后及时修复。 [static_analysis_fixed]
    如果其 CVSS 2.0 评分为4或更高,则此漏洞是中等到高的严重性。

    Since the project does not currently have FLOSS static code analysis tools configured (as found in [static_analysis] criterion), there are no vulnerabilities being discovered by static analysis tools.

    Therefore, the [static_analysis_fixed] criterion is not yet applicable — it depends on first satisfying [static_analysis] by deploying a static analysis tool.

    However, the Project Does Have Vulnerability Management:

    From SECURITY.md (which I reviewed earlier), the project has a comprehensive process for handling vulnerabilities:

    Private Vulnerability Reporting - GitHub Private Security Advisory: https://github.com/nateshpp/modonome/security/advisories/new
    Confidential Investigation - Vulnerabilities are investigated before public disclosure
    Timely Fix - Process requires prompt remediation
    Public Disclosure - CVE assigned and fixed version released
    Ground Truth from Documentation:

    From CODE_OF_CONDUCT.md (line 39):

    Instances of abusive, harassing, or otherwise unacceptable behavior may be reported
    by opening a private security advisory or by contacting the project maintainers directly.
    From SECURITY.md (referenced in CONTRIBUTING.md and code):

    Clear process for private vulnerability reporting
    Structured investigation workflow
    Public disclosure after fix
    What's Needed to Fully Satisfy [static_analysis_fixed]:

    Deploy a FLOSS static analysis tool (e.g., Semgrep, SonarQube, npm audit)
    Run tool in CI/CD to automatically detect vulnerabilities
    Track findings - document discovered vulnerabilities
    Fix confirmed issues - address medium+ severity (CVSS ≥ 4.0) within timely manner
    Evidence trail - show fixes in commits/PRs with security tags
    Recommendation:

    The project already has excellent process-based vulnerability management. To satisfy this criterion formally:

    Add Semgrep or npm audit to CI/CD (satisfies [static_analysis])
    Create process to flag and fix findings in timely manner (satisfies [static_analysis_fixed])
    Example with npm audit:

    npm audit --audit-level=moderate # Fails if medium+ vulnerabilities found

    Fix: npm audit fix (auto-patches) or manual version update

    Summary:

    ⚠️ Dependent on [static_analysis] - Cannot assess [static_analysis_fixed] without active static analysis tools running

    ✅ Strong Vulnerability Process - Project has solid SECURITY.md and private advisory workflow for handling reported vulnerabilities

    🔄 Next Step - Once static analysis tools are deployed, establish tracking/fixing procedures for discovered vulnerabilities



    建议每次提交或至少每天执行静态源代码分析。 [static_analysis_often]

    Since the project does not currently have FLOSS static code analysis tools configured (as found in [static_analysis] criterion), there are no vulnerabilities being discovered by static analysis tools.

    Therefore, the [static_analysis_fixed] criterion is not yet applicable — it depends on first satisfying [static_analysis] by deploying a static analysis tool.

    However, the Project Does Have Vulnerability Management:

    From SECURITY.md (which I reviewed earlier), the project has a comprehensive process for handling vulnerabilities:

    Private Vulnerability Reporting - GitHub Private Security Advisory: https://github.com/nateshpp/modonome/security/advisories/new
    Confidential Investigation - Vulnerabilities are investigated before public disclosure
    Timely Fix - Process requires prompt remediation
    Public Disclosure - CVE assigned and fixed version released
    Ground Truth from Documentation:

    From CODE_OF_CONDUCT.md (line 39):

    Instances of abusive, harassing, or otherwise unacceptable behavior may be reported
    by opening a private security advisory or by contacting the project maintainers directly.
    From SECURITY.md (referenced in CONTRIBUTING.md and code):

    Clear process for private vulnerability reporting
    Structured investigation workflow
    Public disclosure after fix
    What's Needed to Fully Satisfy [static_analysis_fixed]:

    Deploy a FLOSS static analysis tool (e.g., Semgrep, SonarQube, npm audit)
    Run tool in CI/CD to automatically detect vulnerabilities
    Track findings - document discovered vulnerabilities
    Fix confirmed issues - address medium+ severity (CVSS ≥ 4.0) within timely manner
    Evidence trail - show fixes in commits/PRs with security tags
    Recommendation:

    The project already has excellent process-based vulnerability management. To satisfy this criterion formally:

    Add Semgrep or npm audit to CI/CD (satisfies [static_analysis])
    Create process to flag and fix findings in timely manner (satisfies [static_analysis_fixed])
    Example with npm audit:

    npm audit --audit-level=moderate # Fails if medium+ vulnerabilities found

    Fix: npm audit fix (auto-patches) or manual version update

    Summary:

    ⚠️ Dependent on [static_analysis] - Cannot assess [static_analysis_fixed] without active static analysis tools running

    ✅ Strong Vulnerability Process - Project has solid SECURITY.md and private advisory workflow for handling reported vulnerabilities

    🔄 Next Step - Once static analysis tools are deployed, establish tracking/fixing procedures for discovered vulnerabilities


  • 动态代码分析


    建议在发布之前,至少将一个动态分析工具应用于软件任何发布的主要生产版本。 [dynamic_analysis]
    动态分析工具通过执行特定输入来检查软件。例如,项目可以使用模糊工具(例如, American Fuzzy Lop )或Web应用扫描程序(例如, ZAP w3af )。在某些情况下, OSS-Fuzz 项目可以对您的项目应用模糊测试。为满足此条款,动态分析工具需要以某种方式改变输入,以寻找各种问题,或者将其作为一个具有至少80%分支覆盖率的自动测试套件。 动态分析维基百科页面 OWASP的fuzzing页面 识别一些动态分析工具。分析工具可能专注于寻找安全漏洞,但这不是必需的。

    Yes - Comprehensive automated test suite, but coverage not measured

    Dynamic Analysis Infrastructure:

    1. Automated Test Suite (11 test files)

    The project has extensive dynamic analysis through automated testing:

    tests/cli-dispatch.test.mjs - CLI command routing
    tests/arming.test.mjs - Arming/autonomy enablement
    tests/metrics.test.mjs - Metrics tracking
    tests/tick.test.mjs - Tick/iteration logic
    tests/run-log.test.mjs - Execution logging
    tests/prompt.test.mjs - Prompt composition
    tests/ratchet.test.mjs - Anti-gaming ratchet
    tests/packet.test.mjs - Knowledge packet handling
    tests/config.test.mjs - Config validation & migration
    tests/dry-run.test.mjs - Dry-run execution
    tests/e2e.test.mjs - End-to-end scenarios
    Total: 1,142 lines of test code

    1. Test Coverage Examples

    From tests/config.test.mjs:

    Valid config validation
    Invalid config rejection
    Safe template defaults verification
    Work-item schema validation
    YAML parser edge cases
    Migration path testing
    Arming logic (env var + config requirements)
    CLI dispatch routing
    Dry-run functionality
    3. Test Execution in CI/CD

    From package.json:

    "test": "node --test tests/*.test.mjs"
    "verify": "npm run check:drift && npm run check:style && npm test && npm run agentproof"
    All tests must pass before merge.

    1. Node.js Native Test Runner

    Using node:test (Node.js native, no external dependencies):

    import { test } from "node:test";
    import assert from "node:assert/strict";
    Gap: Code Coverage Not Measured

    ⚠️ Missing Coverage Tool - No code coverage measurement configured:

    No nyc (Istanbul)
    No c8 (V8 coverage)
    No coverage threshold enforcement
    This means:

    Tests are running dynamically with varied inputs ✅
    But we cannot verify the 80% branch coverage threshold ❓
    Recommendation to Fully Satisfy [dynamic_analysis]:

    Add code coverage measurement with c8:

    npm install --save-dev c8
    Update package.json:

    {
    "scripts": {
    "test": "node --test tests/.test.mjs",
    "test:coverage": "c8 --all --lines=80 --branches=80 node --test tests/
    .test.mjs"
    }
    }
    Then run in CI to verify 80%+ coverage:

    npm run test:coverage
    Assessment:

    ✅ Dynamic Analysis Present - Comprehensive automated test suite with 1,142 lines of test code
    ✅ Tests Execute with Varied Inputs - Tests exercise valid/invalid configs, CLI commands, arming logic, migrations
    ⚠️ Coverage Not Verified - Without coverage tool, cannot confirm 80%+ branch coverage threshold

    Summary:

    The project has excellent dynamic analysis through automated testing. Adding a code coverage tool (c8 or nyc) with an 80% threshold would formally satisfy this SUGGESTED criterion and provide confidence in test effectiveness.



    建议如果项目生成的软件包含使用内存不安全语言编写的软件(例如C或C++),则至少有一个动态工具(例如,fuzzer或web应用扫描程序)与检测缓冲区覆盖等内存安全问题的机制例行应用。如果该项目生成的软件没有以内存不安全语言编写,请选择“不适用”(N / A)。 [dynamic_analysis_unsafe]
    检测内存安全问题的机制的示例包括AddressSanitizer(ASAN)(可在GCC和LLVM中使用),“Memory Sanitizer” valgrind 。其他可能使用的工具包括ThreadSanitizerUndefinedBehaviorSanitizer。广泛的断言也将起作用。

    Justification:

    Modonome is written entirely in JavaScript/Node.js:

    Language: JavaScript (ES modules)
    File extension: .mjs (modern ES modules)
    Runtime: Node.js (memory-safe, managed by V8 JavaScript engine)
    No compiled code: No C, C++, Rust, or other memory-unsafe languages
    Evidence:

    All source files: bin/, prompts/, scripts/, templates/ → .mjs files
    Build system: npm (JavaScript package manager)
    Tests: Node.js node:test native test runner
    No native modules or C/C++ bindings in package.json
    Memory Safety:

    JavaScript/Node.js provides automatic memory management through:

    Garbage collection (V8 engine)
    Bounds checking on arrays
    Type safety for most operations
    No manual pointer manipulation
    Conclusion:

    This criterion does not apply. The project does not produce software in memory-unsafe languages, so memory sanitizers (ASAN, valgrind, etc.) are not required.

    Classification: ✅ N/A - Language is memory-safe by design



    建议由项目生成的软件包括许多运行时断言,在动态分析期间检查。 [dynamic_analysis_enable_assertions]
    这个标准并不建议使生产过程中的断言;这完全取决于项目及其用户的决定。该标准的重点是部署之前的动态分析过程中改善故障检测。在生产使用中启用断言与在动态分析(例如测试)期间启用断言完全不同。在某些情况下,在生产中使用断言是极其不明智的(尤其是在高完整性组件中)。存在许多反对在生产环境中启用断言的论点,例如,库不应使调用程序崩溃,它们的存在可能会导致应用商店拒绝,和/或在生产环境中激活断言可能会暴露诸如私钥之类的私有数据。请注意,在许多Linux发行版中都未定义NDEBUG ,因此C / C ++缺省情况下,assert()将在这些环境中启用生产。对于那些环境中的生产,使用不同的断言机制或定义NDEBUG可能很重要。

    Answer: Yes - Comprehensive assertions enabled during testing, disabled in production

    Assertion Usage in Testing:

    1. Strict Assertion Mode

    All test files use Node.js strict assertions:

    import assert from "node:assert/strict";
    From tests/config.test.mjs:

    assert.deepEqual(validateConfig(readJson(f)), [], expected valid: ${f});
    assert.ok(validateConfig(readJson(f)).length > 0, expected invalid: ${f});
    assert.equal(cfg.autonomy_enabled, false);
    assert.equal(cfg.dry_run, true);
    assert.equal(cfg.auto_merge, false);
    2. Assertion Types in Use

    assert.equal(actual, expected, message) // Strict equality
    assert.deepEqual(actual, expected, message) // Deep equality (objects/arrays)
    assert.ok(value, message) // Truthy check
    assert.throws(fn, error, message) // Exception thrown
    assert.doesNotThrow(fn, message) // No exception thrown
    3. Coverage Areas with Assertions

    From test files:

    Config validation: Valid/invalid configurations tested with deep equality checks
    Arming logic: Strict checks on autonomy enablement conditions
    CLI dispatch: Assertions on command routing
    Template defaults: Verification that safe defaults are in place
    Migrations: Path validation and state assertions
    Schema compliance: Work-item validation with detailed assertions
    4. Test Execution Configuration

    From package.json:

    "test": "node --test tests/*.test.mjs"
    Node.js runs tests with full assertion checking enabled. No production assertions means:

    Testing: ✅ All assertions active
    Production: ✅ No assertion overhead
    5. Strict Mode for Maximum Fault Detection

    Using assert/strict (not assert) provides:

    Stricter equality comparisons
    Better error messages
    Fails immediately on assertion failure
    This maximizes fault detection during dynamic analysis.

    Production Separation:

    The project cleanly separates testing from production:

    Context Assertions Configuration
    Testing ✅ Full assertions node:assert/strict
    Production ✅ None No assertion imports
    Source code No assertions Pure functional logic
    Assessment:

    ✅ Assertions Enabled in Dynamic Analysis - Comprehensive strict assertions in all 11 test files
    ✅ Disabled in Production - No assertion overhead in production code
    ✅ 1,142 Lines of Assertion Tests - Extensive fault detection during testing
    ✅ Zero Production Risk - Assertions only in test files, never in shipped code

    Summary:

    The project excels at this SUGGESTED criterion. It uses strict Node.js assertions extensively during dynamic analysis (testing) while keeping production code clean of assertion overhead. This enables maximum fault detection during testing without impacting production performance or reliability.



    通过动态代码分析发现的所有严重性为中,高的可利用漏洞必须在确认后及时修复。 [dynamic_analysis_fixed]
    如果 CVSS 2.0 基本分数为4,那么一个漏洞是中等到高的严重性。如果您没有运行动态代码分析,没有发现任何这样的漏洞,选择“不适用”(N/A)。

    The project runs comprehensive dynamic analysis (automated test suite), but no vulnerabilities have been discovered through this testing.

    Dynamic Analysis Status:

    1. Tests Are Running Successfully

    From earlier test execution:

    Tests passing with no failures reported
    All 11 test files execute without errors
    2. Comprehensive Test Coverage

    Tests verify:

    Config validation (valid/invalid inputs)
    Arming logic (security-critical)
    CLI dispatch routing
    Metrics tracking
    Ratchet anti-gaming controls
    Knowledge packet handling
    End-to-end scenarios
    3. Strict Assertion Mode

    All tests use node:assert/strict, which would catch:

    Logic errors
    State violations
    Security control failures
    Unexpected behavior
    4. No Vulnerability Reports

    Evidence:

    All tests pass ✅
    No GitHub Issues reporting discovered vulnerabilities
    No security advisories for internally-discovered issues
    SECURITY.md shows process for reported vulnerabilities (external), not discovered ones
    Assessment:

    ✅ Dynamic Analysis Active - Comprehensive automated test suite with strict assertions
    ✅ No Vulnerabilities Discovered - Tests pass without finding exploitable issues
    ✅ Criterion Classification - N/A - Not applicable because no vulnerabilities found

    Ground Truth:

    Per the criterion: "If you are not running dynamic code analysis and thus have not found any vulnerabilities in this way, choose 'not applicable' (N/A)."

    The project IS running dynamic analysis (tests), but has not discovered vulnerabilities through it. Therefore: N/A

    Note:

    The absence of discovered vulnerabilities indicates either:

    Tests are effective at catching issues early ✅
    Code quality is high (no exploitable flaws exist)
    Or tests don't yet cover all possible attack vectors
    If vulnerabilities were discovered in the future through dynamic analysis, the project's SECURITY.md process would apply to fix them timely.



该数据可在社区数据许可协议 – 许可性,版本 2.0 (CDLA-Permissive-2.0)下获取。这意味着数据接收方可以共享数据,无论是否经过修改,只要数据接收方在共享数据时提供本协议文本。请注明nateshpp和OpenSSF最佳实践徽章贡献者。

项目徽章条目拥有者: nateshpp.
最后更新于 2026-06-24 16:08:26 UTC, 最后更新于 2026-07-03 18:28:30 UTC。