This register tracks the Gold assessment for this repository.
The official entry is bestpractices.dev project 13738.
Assessment date: 2026-07-23.
This public Python SDK is active and released.
It is eligible for the OpenSSF Best Practices badge.
No OpenSSF-defined ineligibility applies.
| Area | Evidence |
|---|---|
| License | Apache-2.0 and REUSE 3.3 metadata |
| Contribution process | DCO sign-off and independent review rules |
| Governance | Public roles, decisions, releases, and continuity policy |
| Security reporting | Private reporting, response targets, boundaries, and threat model |
| Tests | Python 3.10 and 3.14 with Pydantic 1 and 2 |
| Statement coverage | ./scripts/coverage enforces 90% |
| Branch coverage | ./scripts/coverage enforces 80% |
| Static analysis | Ruff, Pyright, Mypy, and CodeQL security-extended queries |
| Dependency review | Dependabot and pinned pip-audit |
| Licensing gate | Pinned REUSE action checks every repository file |
| Reproducibility | 2 wheels and source archives must have identical bytes |
| CI | Pull requests and pushes run pinned, least-privilege workflows |
| Two-factor authentication | The Xquik-dev organization requires 2FA |
The current matrix covers 12,010 of 12,654 statements, or 94.91%.
It covers 1,149 of 1,418 branches, or 81.03%.
The matrix runs 3,029 Pydantic 2 tests.
It runs 3,016 Pydantic 1 tests.
Human and organizational evidence remains incomplete.
Do not claim Gold while any mandatory criterion remains unmet.
| Gold Requirement | Current Evidence | Required Action |
|---|---|---|
| Access continuity | Public evidence does not prove 2 release-capable maintainers | Grant and verify another maintainer's access |
| Bus factor | Git history shows one significant contributor | Add another significant contributor |
| Unassociated contributors | Fewer than 2 qualifying contributors are independent | Accept qualifying external contributions |
| Independent review | History does not prove 50% qualifying review coverage | Require and record independent reviews |
| Human security review | No completed review exists within 5 years | Commission and publish a scoped review |
Gold eligibility still requires review by a different human.
Run these evidence commands before releases:
./scripts/lint
./scripts/test
./scripts/coverage
./scripts/audit
uvx --from reuse==6.2.0 reuse lint
./scripts/check-reproducibleReassess the register before every major release.
Update bestpractices.dev only with public evidence.
Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.