security: establish OpenSSF foundation

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    commit-message:
+      prefix: "chore(deps)"

.github/workflows/ci.yml

@@ -5,20 +5,25 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install pytest
+        run: python -m pip install --require-hashes -r requirements-dev.lock
 
       # Pinned rather than taken from apt: the distro build is several releases
       # behind, and the two versions do not report the same findings — it raises
@@ -28,15 +33,19 @@ jobs:
       - name: Install shellcheck 0.11.0
         run: |
           v=v0.11.0
-          curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/${v}/shellcheck-${v}.linux.x86_64.tar.xz" \
-            | sudo tar -xJf - --strip-components=1 -C /usr/local/bin "shellcheck-${v}/shellcheck"
+          archive="shellcheck-${v}.linux.x86_64.tar.xz"
+          curl -fsSLO "https://github.com/koalaman/shellcheck/releases/download/${v}/${archive}"
+          echo "8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198  ${archive}" | sha256sum -c -
+          sudo tar -xJf "${archive}" --strip-components=1 -C /usr/local/bin "shellcheck-${v}/shellcheck"
           shellcheck --version
 
-      - name: Refine gate contract tests
-        run: pytest tests/test_refine_gate.py tests/test_portable_packaging.py -v
-
-      - name: Subagent tracker tests
-        run: pytest tests/test_subagent_usage.py -v
+      - name: Python suite and 80 percent coverage gate
+        run: |
+          coverage erase
+          coverage run -m pytest -q
+          coverage combine
+          coverage report
+          coverage xml
 
       - name: Statusline heat-track tests
         run: bash tests/statusline/test_heat_rgb.sh
@@ -49,6 +58,7 @@ jobs:
           shellcheck plugins/statusline/assets/statusline-command.sh
           shellcheck plugins/statusline/assets/statusline-lib/*.sh
           shellcheck plugins/statusline/assets/costs.sh
+          shellcheck tools/*.sh
           # The suites are shell too, and a checker that skips them lets the
           # code that guards the renderer rot unwatched.
           shellcheck tests/statusline/*.sh

.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        with:
+          languages: python
+          queries: security-and-quality
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        with:
+          category: "/language:python"

.github/workflows/release.yml

@@ -0,0 +1,91 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Test, attest, and publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Install hash-locked test dependencies
+        run: python -m pip install --require-hashes -r requirements-dev.lock
+
+      - name: Run Python suite and coverage gate
+        run: |
+          coverage erase
+          coverage run -m pytest -q
+          coverage combine
+          coverage report
+
+      - name: Run shell suites
+        run: |
+          bash tests/statusline/test_heat_rgb.sh
+          bash tests/statusline/test_fit_and_pace.sh
+
+      - name: Build and self-verify release bundle
+        run: |
+          bash tools/build-release-bundle.sh dist
+          bash tools/verify-release-bundle.sh \
+            dist/session-optimizer.tar.gz \
+            dist/session-optimizer.tar.gz.sha256 \
+            dist/EXECUTABLE-MANIFEST.sha256
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: |
+            dist/session-optimizer.tar.gz
+            dist/EXECUTABLE-MANIFEST.sha256
+            dist/session-optimizer.cdx.json
+
+      - name: Extract release notes
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v ver="$version" '
+            /^## \[/ {
+              if (in_section) exit
+              if (index($0, "[" ver "]")) { in_section = 1; next }
+            }
+            in_section { print }
+          ' CHANGELOG.md > release-notes.md
+          if [ ! -s release-notes.md ]; then
+            echo "No CHANGELOG entry found for $version." > release-notes.md
+          fi
+
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        with:
+          body_path: release-notes.md
+          draft: false
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          files: |
+            dist/session-optimizer.tar.gz
+            dist/session-optimizer.tar.gz.sha256
+            dist/EXECUTABLE-MANIFEST.sha256
+            dist/EXECUTABLE-MANIFEST.sha256.sha256
+            dist/session-optimizer.cdx.json
+            dist/session-optimizer.cdx.json.sha256
+          fail_on_unmatched_files: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/scorecard.yml

@@ -0,0 +1,38 @@
+name: OpenSSF Scorecard
+
+on:
+  schedule:
+    - cron: "0 7 * * 2"
+  branch_protection_rule:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload SARIF to code scanning
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -4,5 +4,6 @@ __pycache__/
 .claude/
 .pytest_cache/
 .coverage
+.coverage.*
 coverage.xml
 htmlcov/

CHANGELOG.md

@@ -12,12 +12,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - A skills-only Codex package for `refine-gate`, exposed through a repository
   marketplace at `.agents/plugins/marketplace.json`.
 - Gemini CLI installation through the existing portable Agent Skill.
+- OpenSSF Scorecard, CodeQL, Dependabot, and a hash-locked development
+  dependency set.
+- Security, contribution, conduct, governance, architecture, assurance-case,
+  Scorecard, and twelve-month roadmap documentation.
+- A release workflow that tests and self-verifies a source bundle, publishes
+  SHA-256 checksums, an executable manifest and CycloneDX SBOM, and creates
+  Sigstore build-provenance attestations.
+- Regression tests for context-guard hooks, prompt-refinement measurement,
+  statusline transcript handling, and release integrity.
 
 ### Changed
 
 - The `refine` skill now uses the portable Agent Skills frontmatter and
   host-neutral wording. Claude's `UserPromptSubmit` hook and plugin manifests
   are unchanged.
+- CI actions are pinned to full commit SHAs, workflow permissions are read-only
+  by default, ShellCheck is checksum-verified, and Python dependencies are
+  installed from the hashed lock file.
+- CI measures the shipped Python surface with coverage.py's subprocess support
+  and enforces an 80% floor; the initial complete measurement is 94%.
+- The repository introduction now leads with its portable Codex, Gemini CLI,
+  Claude, and Agent Skills surface while preserving explicit labels on
+  Claude-only integrations.
+
+### Fixed
+
+- The statusline transcript scanner now recognizes valid compaction records
+  whose JSON contains insignificant whitespace before confirming the parsed
+  marker values.
 
 ## [2.1.1] - 2026-07-26
 

CODE_OF_CONDUCT.md

@@ -0,0 +1,26 @@
+# Code of Conduct
+
+## Our pledge
+
+We pledge to make participation in this project respectful and harassment-free
+for everyone, regardless of identity, background, experience, or ability.
+
+## Expected behavior
+
+Be constructive, assume good faith while checking evidence, respect differing
+viewpoints, accept responsibility for mistakes, and focus criticism on the
+work rather than the person. Harassment, threats, discriminatory language,
+sexualized attention, deliberate intimidation, and disclosure of another
+person's private information are unacceptable.
+
+## Enforcement
+
+Report conduct concerns privately to `admin@ai-architect.tools`. The maintainer
+will investigate proportionately, protect reporter privacy where possible, and
+may edit or remove content, warn a participant, restrict participation, or ban
+a participant. If the maintainer is the subject of a complaint, reporters may
+use GitHub Support so the subject does not adjudicate the report.
+
+This policy applies in repository spaces and whenever someone officially
+represents the project. It is adapted from the
+[Contributor Covenant 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).