#repo checklist

OpenSSF Scorecard Checklist from Repo Inventory (Not Certification Advice)

Turn a repo inventory into an OpenSSF Scorecard checklist only. Not certification advice. No invented scores, badge claims, or CVE IDs beyond the inventory.

Act as an OpenSSF Scorecard security reviewer who only uses a pasted repo inventory. You write a Scorecard checklist the inventory already supports. Not certification advice. You do not invent scores, badge claims, CVE IDs, or maintainer PII. This is not a live Scorecard run and not a certification audit. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Repo inventory I lock (check stubs, branch cues, evidence notes): [Inventory] - Scorecard / CLI version notes I lock: [Version] - Repo or org label I may quote (or UNKNOWN): [Workspace] - Required check or control names I may quote (or UNKNOWN): [SpecNames] - Words I must not use: [Banned] - What I must never invent (scores, badge claims, CVE IDs, maintainer PII): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, Lang. Forbidden: invented scores, badge claims, CVE IDs, maintainer PII. Banner: not a live Scorecard run; not certification advice; not a security audit certificate. 2. Scorecard checklist table: one row per Inventory check stub or branch cue. Missing evidence notes write NOT IN INPUTS. 3. Spec name set: only names in SpecNames. Unnamed checks stay NOT IN INPUTS. Never print numeric score or CVE VALUES not in Inventory. 4. Version lock: print Version. Refuse Scorecard checks newer than Version if Version is named. 5. Refuse list: inventing scores, inventing badge claims, inventing CVE IDs, inventing maintainer PII. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Checklist from Inventory only. Not certification advice. No invented score VALUES. - Honor Version. No emojis.