docs(scorecard): the verdict-of-record is asvs-scorecard.toml, not a dated prose assessment - #159
Merged
Merged
Conversation
…dated prose assessment This file named ASVS-L3-RESCORE-2026-07-31 as "the current verdict-of-record" and told the reader not to grade off any earlier assessment. ADR 0156 retired that lineage: verdicts and evidence anchors live in docs/security/asvs-scorecard.toml, rendered to ASVS-CURRENT.md and drift-gated in CI. A prose file cannot be the record when the record is machine-checked. The correction is small; the reason it matters is that the very next bullet in this same file documents this file being wrong about its own pointer once already -- it says ASVS-L3-ASSESSMENT-2026-07-16 "previously called it the current canonical verdict-of-record" and that this was wrong by 2026-07-31. So a dated prose pointer has now gone stale here twice. Naming the structured source is what stops a third. Prose entries are kept, demoted to provenance rather than deleted, so a reader following an old citation still lands somewhere that explains why it is not the record.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One line changed, plus one added. The reason it is worth a PR is what the file already says about itself.
The defect
docs/Secure_Build_Scorecard_MEFOR.md:123namesASVS-L3-RESCORE-2026-07-31as "the current verdict-of-record" and instructs the reader not to grade off any earlier assessment.ADR 0156 retired that lineage. Verdicts and evidence anchors live in
docs/security/asvs-scorecard.toml, rendered toASVS-CURRENT.mdand drift-gated in CI. A prose file cannot be the record once the record is machine-checked.Why this one is not cosmetic
The very next bullet in the same file documents this file getting the same thing wrong before.
:124reads:So a dated prose pointer has gone stale here, in this file, twice — and the file is self-aware about the first instance while committing the second immediately above it. Naming the structured source is what stops a third.
This is the same class as the 15 unresolvable vault citations and the reported ~95 stale posture claims: a pointer that nothing checks, in a document nothing couples to the thing it points at.
What changed
asvs-scorecard.tomlas the record, with ADR 0156 cited.Scope discipline
ADR 0152 deliberately untouched. It carries the same retired-lineage citation, but PR #156 already contains an ADR 0152 amendment from its author (
a2a50f3d). Adding a second amendment from a different region would duplicate a decision that is not mine to record twice — it belongs with #156.Docs only. Pre-commit leak guard and secret scan Passed; no
--no-verify.🤖 Generated with Claude Code