security: prepare OpenSSF Silver release

.bestpractices.json

@@ -78,7 +78,7 @@
   "warnings_status": "Met",
   "warnings_justification": "CI runs pinned ShellCheck 0.11.0 over shipped shell and CodeQL security-and-quality over Python: https://github.com/cdeust/session-optimizer/tree/main/.github/workflows",
   "warnings_fixed_status": "Met",
-  "warnings_fixed_justification": "ShellCheck and CodeQL are blocking workflow jobs; ShellCheck returns no finding at the configured default severity on the current tree.",
+  "warnings_fixed_justification": "ShellCheck is a blocking CI gate. CodeQL security-and-quality runs on every pull request and main push; the first full-main findings were fixed in PR #18 and the current open CodeQL alert list is empty: https://github.com/cdeust/session-optimizer/pull/18",
   "know_secure_design_status": "Met",
   "know_secure_design_justification": "SECURITY.md and docs/ASSURANCE-CASE.md define the protected assets, threats, trust boundaries, secure-design principles, controls, and explicit limits: https://github.com/cdeust/session-optimizer/blob/main/docs/ASSURANCE-CASE.md",
   "know_common_errors_status": "Met",
@@ -94,8 +94,8 @@
   "static_analysis_often_status": "Met",
   "static_analysis_often_justification": "Static analysis runs per pull request and main push, plus CodeQL's weekly schedule.",
 
-  "achieve_passing_status": "Unmet",
-  "achieve_passing_justification": "The project has not yet been registered with OpenSSF Best Practices and therefore does not claim a Passing badge. This dossier is preparation, not a badge.",
+  "achieve_passing_status": "Met",
+  "achieve_passing_justification": "OpenSSF Best Practices project 13938 officially earned Passing on 2026-08-03: https://www.bestpractices.dev/projects/13938",
   "dco_status": "Unmet",
   "dco_justification": "No DCO sign-off or CLA is required. GOVERNANCE.md records that adopting either requires a public governance change: https://github.com/cdeust/session-optimizer/blob/main/GOVERNANCE.md#contribution-licensing",
   "governance_status": "Met",
@@ -106,12 +106,28 @@
   "roles_responsibilities_justification": "GOVERNANCE.md identifies maintainer, contributor, and security-reporter responsibilities and states which roles do not yet exist: https://github.com/cdeust/session-optimizer/blob/main/GOVERNANCE.md#roles-and-responsibilities",
   "access_continuity_status": "Met",
   "access_continuity_justification": "GOVERNANCE.md documents the credential-free succession path: the complete source, history, tests, marketplace manifests, release workflow, and documentation are public under MIT. A successor can fork, enable and manage Issues, accept pull requests, and publish an attested tagged release under the fork's own GitHub OIDC identity within a week, without any original key, token, domain, private dependency, or legal assignment. Users install from the continuation repository. @cdeust remains the only administrator of the original repository, so the bus factor is honestly 1 and identity transfer is weaker than with a second maintainer, but the project results and the three required operational capabilities can continue: https://github.com/cdeust/session-optimizer/blob/main/GOVERNANCE.md#continuity-of-access",
+  "bus_factor_status": "Unmet",
+  "bus_factor_justification": "@cdeust remains the only maintainer and administrator of the original repository, so the bus factor is honestly 1. The independent fork-based continuity path satisfies operational succession but does not turn one maintainer into two: https://github.com/cdeust/session-optimizer/blob/main/GOVERNANCE.md#current-limit",
+  "documentation_architecture_status": "Met",
+  "documentation_architecture_justification": "docs/ARCHITECTURE.md identifies the three components, portable and host-specific boundaries, local data, runtime flow, and release flow: https://github.com/cdeust/session-optimizer/blob/main/docs/ARCHITECTURE.md",
+  "documentation_security_status": "Met",
+  "documentation_security_justification": "SECURITY.md and docs/ASSURANCE-CASE.md state the expected protections, explicit non-goals, trust boundaries, threats, controls, and residual limits: https://github.com/cdeust/session-optimizer/blob/main/SECURITY.md#security-boundaries",
+  "documentation_quick_start_status": "Met",
+  "documentation_quick_start_justification": "README.md starts with the marketplace command, one-line installs for all three packages, and a direct link to the portable Codex/Gemini procedure: https://github.com/cdeust/session-optimizer#readme",
+  "documentation_achievements_status": "Met",
+  "documentation_achievements_justification": "README.md displays and links the live OpenSSF Best Practices badge immediately beside CI, CodeQL, and Scorecard: https://github.com/cdeust/session-optimizer#readme",
+  "accessibility_best_practices_status": "Met",
+  "accessibility_best_practices_justification": "The project interfaces are text-first; every statusline value has a word label and does not rely on color alone, the banner has alternative text, and contribution happens through GitHub's keyboard-accessible issue and pull-request interfaces.",
+  "internationalization_status": "Unmet",
+  "internationalization_justification": "A French statusline guide is provided, but executable messages and the complete documentation set are not yet backed by a localization mechanism.",
+  "sites_password_security_status": "N/A",
+  "sites_password_security_justification": "The project operates no authentication site. Repository, issue, documentation, and download authentication is provided by GitHub rather than stored by project software.",
   "documentation_roadmap_status": "Met",
   "documentation_roadmap_justification": "docs/ROADMAP.md covers August 2026 through July 2027 in four dated phases and states explicit non-goals: https://github.com/cdeust/session-optimizer/blob/main/docs/ROADMAP.md",
   "documentation_current_status": "Met",
   "documentation_current_justification": "CONTRIBUTING.md requires documentation to change with behavior, and this foundation reconciles the repository introduction, architecture, host boundaries, privacy, security, and current measured test evidence.",
   "test_statement_coverage80_status": "Met",
-  "test_statement_coverage80_justification": "Measured 2026-08-03 with coverage.py 7.15.2 and pytest 9.1.1 over the shipped Python surface declared in pyproject.toml: 712 statements, 42 missed, 94 percent, 50 tests passing. CI enforces fail_under = 80 and subprocess coverage captures the hook entry points: https://github.com/cdeust/session-optimizer/blob/main/pyproject.toml",
+  "test_statement_coverage80_justification": "Measured by CI on 2026-08-03 with coverage.py 7.15.2 and pytest 9.1.1 over the shipped Python surface declared in pyproject.toml: 715 statements, 45 missed, 94 percent, 50 tests passing. CI enforces fail_under = 80 and subprocess coverage captures the hook entry points: https://github.com/cdeust/session-optimizer/blob/main/pyproject.toml",
   "test_policy_mandated_status": "Met",
   "test_policy_mandated_justification": "CONTRIBUTING.md makes tests mandatory for behavior changes, regression tests mandatory for fixes, enumerates required boundary/failure coverage, and states that coverage does not replace assertions: https://github.com/cdeust/session-optimizer/blob/main/CONTRIBUTING.md#testing-policy",
   "implement_secure_design_status": "Met",
@@ -125,5 +141,53 @@
   "hardening_status": "Unmet",
   "hardening_justification": "The project has no HTTP response surface and compiles no native binary, so the web-header and compiler-hardening examples for this criterion do not apply directly. Existing bounded reads, least privilege, and fail-closed artifact checks are real controls but are not relabeled as this criterion.",
   "assurance_case_status": "Met",
-  "assurance_case_justification": "docs/ASSURANCE-CASE.md contains the four required parts as separately identified sections: threat model, five concrete trust boundaries, implemented secure-design principles, and a common-weakness table that states each control's limit: https://github.com/cdeust/session-optimizer/blob/main/docs/ASSURANCE-CASE.md"
+  "assurance_case_justification": "docs/ASSURANCE-CASE.md contains the four required parts as separately identified sections: threat model, five concrete trust boundaries, implemented secure-design principles, and a common-weakness table that states each control's limit: https://github.com/cdeust/session-optimizer/blob/main/docs/ASSURANCE-CASE.md",
+  "maintenance_or_update_status": "Met",
+  "maintenance_or_update_justification": "Only the latest release receives security fixes, and README.md provides a four-step migration path from the widely used v1.x layout to the independently installable v2 packages: https://github.com/cdeust/session-optimizer#migrating-from-session-optimizer-v1x",
+  "vulnerability_report_credit_status": "N/A",
+  "vulnerability_report_credit_justification": "No vulnerability was resolved in the last 12 months. SECURITY.md commits to credit future reporters unless they request anonymity: https://github.com/cdeust/session-optimizer/blob/main/SECURITY.md#reporting-a-vulnerability",
+  "vulnerability_response_process_status": "Met",
+  "vulnerability_response_process_justification": "SECURITY.md documents private intake, reproduction and scoping, private remediation, regression testing, coordinated disclosure, affected-version notes, and reporter credit: https://github.com/cdeust/session-optimizer/blob/main/SECURITY.md#reporting-a-vulnerability",
+  "coding_standards_status": "Met",
+  "coding_standards_justification": "CONTRIBUTING.md requires Python to follow PEP 8 plus the selected Ruff rules and shell to follow the Google Shell Style Guide where applicable: https://github.com/cdeust/session-optimizer/blob/main/CONTRIBUTING.md#style-and-compatibility",
+  "coding_standards_enforced_status": "Met",
+  "coding_standards_enforced_justification": "CI installs Ruff from the hash-locked toolchain and blocks on ruff check; it separately installs checksum-verified ShellCheck 0.11.0 and blocks on every shipped shell source and shell test: https://github.com/cdeust/session-optimizer/blob/main/.github/workflows/ci.yml",
+  "build_standard_variables_status": "N/A",
+  "build_standard_variables_justification": "The project generates no native binary and invokes no compiler or linker.",
+  "build_preserve_debug_status": "N/A",
+  "build_preserve_debug_justification": "Python and shell sources are distributed directly; there is no compiler or stripping installation step.",
+  "build_non_recursive_status": "N/A",
+  "build_non_recursive_justification": "The project has no recursive native build system and no cross-dependent compiled subdirectories.",
+  "build_repeatable_status": "N/A",
+  "build_repeatable_justification": "The shipped project results are the tracked Python, shell, JSON, and skill source files used directly rather than generated compiled output.",
+  "installation_common_status": "Met",
+  "installation_common_justification": "Claude packages use the host marketplace install convention; Codex and Gemini use the documented Agent Skills directory convention: https://github.com/cdeust/session-optimizer#readme",
+  "installation_standard_variables_status": "N/A",
+  "installation_standard_variables_justification": "The project does not install into a system prefix. Host marketplaces select their own managed locations, while portable Agent Skills are copied to host-defined user directories.",
+  "installation_development_quick_status": "Met",
+  "installation_development_quick_justification": "CONTRIBUTING.md gives the standard venv creation, activation, hash-locked pip install, and complete local test commands: https://github.com/cdeust/session-optimizer/blob/main/CONTRIBUTING.md#development-setup",
+  "external_dependencies_status": "Met",
+  "external_dependencies_justification": "Direct Python tools are pinned in requirements-dev.txt and fully hash-locked in requirements-dev.lock; Actions are full-SHA pinned and the ShellCheck artifact version and checksum are in CI: https://github.com/cdeust/session-optimizer/blob/main/requirements-dev.lock",
+  "dependency_monitoring_status": "Met",
+  "dependency_monitoring_justification": "Dependabot checks pip and GitHub Actions weekly, GitHub vulnerability alerts and automated security fixes are enabled, and the open Dependabot alert API returned zero on 2026-08-03: https://github.com/cdeust/session-optimizer/blob/main/.github/dependabot.yml",
+  "updateable_reused_components_status": "Met",
+  "updateable_reused_components_justification": "Every non-system development component is identified in the hash lock or full-SHA workflow, and Dependabot proposes reviewable updates for both supported ecosystems.",
+  "interfaces_current_status": "Met",
+  "interfaces_current_justification": "Weekly dependency updates, CodeQL security-and-quality analysis, Ruff, ShellCheck, and behavior tests detect obsolete or unsupported interfaces; no current check reports a deprecated project API.",
+  "automated_integration_testing_status": "Met",
+  "automated_integration_testing_justification": "CI runs the full Python, shell, lint, coverage, and manifest-validation suite on every pull request and every push to main and publishes the job result: https://github.com/cdeust/session-optimizer/actions/workflows/ci.yml",
+  "regression_tests_added50_status": "Met",
+  "regression_tests_added50_justification": "CONTRIBUTING.md mandates a pre-fix-failing regression test for every defect; the last-six-month bug fixes recorded in CHANGELOG.md have automated Python or shell coverage in tests/: https://github.com/cdeust/session-optimizer/blob/main/CONTRIBUTING.md#testing-policy",
+  "crypto_algorithm_agility_status": "Unmet",
+  "crypto_algorithm_agility_justification": "Release-integrity manifests intentionally specify SHA-256 and do not currently offer an alternative digest algorithm. This SHOULD criterion is recorded honestly.",
+  "crypto_credential_agility_status": "N/A",
+  "crypto_credential_agility_justification": "The runtime never processes an authentication credential or private cryptographic key; the release workflow uses GitHub OIDC without a repository signing secret.",
+  "crypto_tls12_status": "N/A",
+  "crypto_tls12_justification": "The shipped runtime intentionally performs no network request and implements no TLS client or server: https://github.com/cdeust/session-optimizer/blob/main/PRIVACY.md",
+  "crypto_certificate_verification_status": "N/A",
+  "crypto_certificate_verification_justification": "The shipped runtime does not use TLS.",
+  "crypto_verification_private_status": "N/A",
+  "crypto_verification_private_justification": "The shipped runtime neither uses TLS nor sends HTTP headers or private network information.",
+  "version_tags_signed_status": "Unmet",
+  "version_tags_signed_justification": "Historical important tags are not all cryptographically signed. The release workflow attests release artifacts using GitHub OIDC, but this SUGGESTED tag-specific criterion remains unmet."
 }

.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Session optimizer, split into three independently installable plugins: context-guard (Stop-hook context budget + memory-writer checkpoint subagent + subagent spend tracker), refine-gate (UserPromptSubmit prompt-binding gate + /refine skill), and statusline (multi-line status bar + install skill).",
-    "version": "2.1.1"
+    "version": "2.2.0"
   },
   "plugins": [
     {
       "name": "context-guard",
       "source": "./plugins/context-guard",
       "description": "Context-budget guard: a Stop hook enforces a per-model checkpoint protocol — at the WARN threshold it writes a mechanical checkpoint stub and delegates persistence to a budgeted memory-writer subagent as a reflection pause, at the hard cap it forces checkpoint-then-clear. A SubagentStop tracker surfaces true session spend (main thread + subagents). Default protocol uses only vanilla Claude Code; a scoped memory layer is detected at runtime when installed.",
-      "version": "2.0.0",
+      "version": "2.0.1",
       "author": {
         "name": "Clement Deust",
         "email": "admin@ai-architect.tools"
@@ -36,7 +36,7 @@
       "name": "refine-gate",
       "source": "./plugins/refine-gate",
       "description": "Prompt-binding gate: a UserPromptSubmit hook + /refine skill that resolve vague prompt references (\"the X solution\", \"like before\", \"still broken\") to concrete artifacts with evidence, then select an execution strategy from a research-backed table (15 strategies verified against 2024-2026 literature, counter-evidence included: intrinsic self-correction degrades reasoning arXiv:2310.01798; CoT marginal on reasoning models; multi-agent failure taxonomy MAST). Acceptance criteria must be external signals - tests, measurements, sources - never the model re-checking itself.",
-      "version": "2.0.0",
+      "version": "2.1.0",
       "author": {
         "name": "Clement Deust",
         "email": "admin@ai-architect.tools"
@@ -58,7 +58,7 @@
       "name": "statusline",
       "source": "./plugins/statusline",
       "description": "Multi-line status bar: a discrete heat-track context bar tied to per-model checkpoint thresholds (shared with context-guard), one deduplicated cost ledger that prices each session from its own transcript plus its subagents, 5h/7d rate-limit gauges with burn-rate pacing (the projection of usage at reset, not just the percentage), per-session telemetry (tok/s, compactions, prompt-cache countdown), and terminal-width fitting that drops the lowest-priority segments instead of letting the host truncate. Words, not emoji. Ships an install skill.",
-      "version": "2.1.1",
+      "version": "2.1.2",
       "author": {
         "name": "Clement Deust",
         "email": "admin@ai-architect.tools"

.github/workflows/ci.yml

@@ -47,6 +47,9 @@ jobs:
           coverage report
           coverage xml
 
+      - name: Enforce Python coding standard
+        run: ruff check plugins tests
+
       - name: Statusline heat-track tests
         run: bash tests/statusline/test_heat_rgb.sh
 

.github/workflows/release.yml

@@ -33,6 +33,7 @@ jobs:
 
       - name: Run Python suite and coverage gate
         run: |
+          ruff check plugins tests
           coverage erase
           coverage run -m pytest -q
           coverage combine

CHANGELOG.md

@@ -7,13 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.0] - 2026-08-03
+
 ### Added
 
 - A skills-only Codex package for `refine-gate`, exposed through a repository
   marketplace at `.agents/plugins/marketplace.json`.
 - Gemini CLI installation through the existing portable Agent Skill.
 - OpenSSF Scorecard, CodeQL, Dependabot, and a hash-locked development
   dependency set.
+- OpenSSF Best Practices Passing evidence and its repository badge.
 - Security, contribution, conduct, governance, architecture, assurance-case,
   Scorecard, and twelve-month roadmap documentation.
 - A release workflow that tests and self-verifies a source bundle, publishes
@@ -32,6 +35,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   installed from the hashed lock file.
 - CI measures the shipped Python surface with coverage.py's subprocess support
   and enforces an 80% floor; the initial complete measurement is 94%.
+- Python contributions now name PEP 8 plus Ruff's selected rules as the coding
+  standard, and CI enforces those rules from the hash-locked toolchain.
 - The repository introduction now leads with its portable Codex, Gemini CLI,
   Claude, and Agent Skills surface while preserving explicit labels on
   Claude-only integrations.