security: complete the stable-release governance gate

[Baskerville42]

Goal

Before publishing 1.0.0, the repository must have no open pull requests, no unresolved code-scanning alerts, and no undocumented Scorecard exceptions.

Required before 1.0.0

• Add at least one independent trusted reviewer to the organization.
• Update the main ruleset to require at least one approval.
• Require CODEOWNERS review and approval of the most recent push.
• Accumulate genuine reviewed changesets so the OpenSSF Code-Review check passes.
• Register the project with OpenSSF Best Practices and complete the questionnaire honestly.
• Add the earned OpenSSF Best Practices passing badge to the README and documentation.
• Remove the mutable publish-only npm CLI installation and use an exact official Node.js distribution with a bundled OIDC-capable npm CLI.
• Confirm the new-repository Maintained finding has disappeared after the 90-day observation window.
• Re-run CI, Security, CodeQL, dependency review, npm audit, and OpenSSF Scorecard on the exact stable-release commit.
• Confirm zero open pull requests and zero open code-scanning alerts immediately before creating the v1.0.0 tag.

Current accepted limitations

The organization now has an independent trusted reviewer: @nastyabon8 is an active organization member with write access to the repository. Recent dependency pull requests were reviewed and approved by both @Baskerville42 and @nastyabon8 before merge.

The active main ruleset requires two approvals, CODEOWNERS review, approval of the most recent push, pull requests, signed commits, linear history, resolved conversations, an up-to-date branch, and all configured status checks, with no bypass actors. The repository contains an active .github/CODEOWNERS file, so the CODEOWNERS requirement is effective.

The latest OpenSSF Scorecard result on commit 2c75a263e5318abdc79312d90ca08156f53e2294 still reports 0/13 approved changesets for Code-Review. Keep this gate open until Scorecard recognizes enough genuinely reviewed changesets and the corresponding code-scanning alert closes. The Maintained finding also remains open because the repository is still within its first 90 days.

The mutable publish-only npm CLI installation was removed in PR #8. The exact official Node.js 26.7.0 distribution now supplies its bundled OIDC-capable npm CLI.

Two remaining Scorecard npm findings refer to exact local tarballs created inside the same job; release artifacts are allow-listed and checksum verified. These are false positives rather than unpinned external dependencies.

There are currently zero open pull requests, but the final zero-PR/zero-alert checkbox is intentionally a point-in-time release gate and remains unchecked until immediately before the stable tag.

[Baskerville42]

Checklist revalidated on 2026-09-09.

Newly completed:

• independent trusted reviewer added: @nastyabon8 is an active organization member with write access;
• CODEOWNERS review and approval of the most recent push are enforced by the main ruleset, and .github/CODEOWNERS is present on main.

Still open by evidence:

• the latest Scorecard run on 2c75a263e5318abdc79312d90ca08156f53e2294 reports Code-Review as 0/13 approved changesets;
• Maintained remains open because the repository is less than 90 days old;
• the final CI/security rerun and zero-PR/zero-alert confirmation are point-in-time checks for the exact v1.0.0 release commit.

The issue body and accepted-limitations section have been updated to match the current repository state.