[HackTuah]

The badge

Trinity holds the OpenSSF Best Practices silver badge, awarded 2026-09-23. From the badge project's own API:

badge level: silver | passing 100 | silver 100 | gold 30
achieved_silver_at: 2026-09-23T20:12:16Z

README.md and docs/09-standards-register.md say silver where they said passing. Both also say what is not met, because a sheet with nothing on it survives a spot check less well than one that says where the holes are:

• at silver: bus_factor and accessibility_best_practices (both SHOULD) and version_tags_signed (SUGGESTED);
• at passing: the three suggested criteria already recorded.

The register gains a gold row as well, at 30% and not held, naming what is met and what is outstanding. Three of the outstanding ones — bus_factor, contributors_unassociated, two_person_review — need people other than the author in the git history and cannot be bought with code.

Two gold criteria, closed here

copyright_per_file and license_per_file are both MUST at gold, and the tree was five files short of each: two HEEx templates and the three Rust files of the desktop shell. None of the five had been noticed by anyone reading the tree — which is the argument for a test rather than for a fix.

test/spdx_headers_test.exs takes its population from git ls-files, so a source file added without a header fails by existing. It checks for the SPDX tag rather than a particular line, since SPDX defines the tag and not the comment syntax it sits in, and it also asserts that the licence each file names is the project's own — a file carrying the right shape of line and the wrong licence is worse than a file carrying none.

Evidence

mix gate exit 0; 579 passed, 18 excluded; coverage 80.31%.

$ git ls-files '*.ex' '*.exs' '*.heex' '*.rs' | wc -l
422 Elixir + 3 Rust
  without a copyright line: 0
  without a licence line:   0