Tutorial: Standards adoption manifest

This node's per-standard record of what is actually adopted — the artifact whose absence blocks a summary claim. One row per hub standard. It exists so that no Standards adopted ✅ can be written without a backing row, and so a future post-mortem (or the hub's report-review spot-check) can diff a claim against reality cheaply. Governed by the hub standards checklists-are-contracts and the notes system; read by the release gate in git-workflow.md. The canonical, project-agnostic template lives in the read-only hub clone at assets/references/fairyfox.io/hub/templates/notes-skeleton/reference/adoption-manifest.md.

Seeded 2026-08-02 against hub 1.6.1 / 2d614f0 (adopting the 0.20.2 → 1.6.1 version span — the standards-changelog entries across it are 0.21.0 → 1.6.0). First full compliance pass run 2026-08-02 — each standard's ## Verify was walked and the result recorded below (date + result). Rows that passed are implemented; rows with an open remainder are gap(<due>) with the specific finding named. The pass is not all-green: see the headline findings under Compliance audit result below.

Date-accuracy note. The earlier adoption commits/report/session in this effort were mis-dated 2026-07-25 (anchored on the hub commit date); the real date was 2026-08-02. Git commit timestamps are authoritative; this manifest and all later artifacts use the correct 2026-08-02.

The rules (do not soften)

• copied-only is not adopted. A file landing in notes/reference/ is copied-only. A row flips to implemented only when that standard's ## Verify table has been run and its result recorded here (date + per-row pass).
• No summary claim without a row. status.md Health, the registry adopts_hub flag, and any process report's "adopted X" must be backed by a row here. A bare Standards adopted ✅ is banned wording (checklists-are-contracts).
• A partial names its remainder. Every not-yet-adopted standard is a gap row with a due marker — the remainder lives here, owned and dated, never only in prose.

State vocabulary

implemented (Verify run + recorded) · copied-only (file present, Verify not run) · gap(<due>) (not adopted / open remainder; when it will be) · N-A(<reason>) (does not apply to this project's kind — say why).

Manifest

Adopted @ = the hub VERSION/commit the row was last reconciled against. Last Verify = date + result. Evidence = a link/path to the proof.

Compliance audit result (2026-08-02)

26 of 30 applicable standards implemented (34 rows − 4 N-A = 30 applicable; 4 non-implemented: mandate-ledger, docs-site, supply-chain, docker); the rest are honest, dated gaps. Updated 2026-08-02 (Scorecard remediation): ship-contract moved gap → implemented — the Scorecard Vulnerabilities check was remediated (see finding 1). The audit walked every standard's ## Verify (checklists-are-contracts). Headline findings, in priority order:

1. ship-contract — OpenSSF Scorecard 6.7 < 7.0 → REMEDIATED 2026-08-02 (projected ~7.4). The dominant lever, Vulnerabilities (was 0), is now cleared and verified with osv-scanner v2.4.0 = "No issues found" — the exact tool Scorecard's Vulnerabilities check runs. What was done: fixable advisories fixed (root/web npm audit fix; mobile postcss/brace-expansion pinned via overrides), and the genuine-no-fix ones documented + filtered via osv-scanner.toml next to each manifest (the Scorecard-sanctioned mechanism, checks.md#vulnerabilities): 17 unmaintained Tauri-v2-Linux gtk3-rs/glib/proc-macro/unic Rust crates (no upstream fix; confirmed cargo audit) + 1 build-time-only Expo uuid advisory. Vulnerabilities 0 → 10 (weight High) lifts 6.7 to ~7.4. The public api.securityscorecards.dev score refreshes on OSSF's weekly rescan — the fix is verified now via osv-scanner; confirm the public number after the next scan. The still-structural checks (Code-Review 0, Branch-Protection 4, Contributors 3 — all require a second maintainer/org) remain low but no longer block the floor.
2. supply-chain-hardening — partial. Strong on SAST/token-permissions/dangerous-workflow/update- tool; releases are signed but carry no provenance (Scorecard Signed-Releases 8) and Pinned-Dependencies is 4 (npm commands unpinned). Attach provenance + address vulns.
3. docs-site — partial (browser-gated). Vendored chrome 2.2.1 vs master 2.3.0 + the 1.4.0 visual requirements; needs a preview session.
4. docker — gap. No committed Dockerfile for the Linux-only test loop.
5. mandate-ledger — copied-only. No multi-part directive has triggered a ledger yet.

Resolved during the audit: repo-hygiene branch litter — 5 stale Dependabot branches pruned; the remote now carries only main and dev.

Open gaps (owned + dated)

• gap: ship-contract Scorecard ≥ 7.0. RESOLVED 2026-08-02 — Vulnerabilities cleared (osv-scanner verified), projected ~7.4; confirm the public score on OSSF's next weekly rescan.
• gap: supply-chain release provenance (optional). Attach the SLSA provenance attestation as a .intoto.jsonl release asset (currently it lives in the GitHub attestations API; releases already carry cosign .sigstore.json signatures, so Signed-Releases is 8/10). Improves over the 5-release window. Due: a future release-workflow pass. Not a floor-blocker.
• gap: docs-site visual adoption + chrome 2.2.1 → 2.3.0 (browser-gated). Due: next docs-site preview session.
• gap: docker path. A committed Dockerfile/compose.yaml for the Linux-only test loop. Due: next adopt pass.
• gap: mandate-ledger exercise. The note is adopted + wired, but no multi-part owner directive has yet triggered a notes/plans/<date>-mandate.md, so its Verify is unexercised. Due: the next genuinely multi-clause owner directive.

User exceptions (dated)

None. No badge, README link, or other default-required item has been dropped on a user-granted exception; every canonical badge and required README cross-link is present.

Verify (is it being followed?)

The per-manifest slice the compliance audit aggregates — report done/partial/missing: