v0.3 is the first of seven gated phases. It is the one in progress. Later phases (wider inventory, a local agent, a console, response workflows, a mesh, then production commitments) wait until the v0.3 gate is met: five pilot sites for four weeks, and a published false-positive rate.
The loop to prove is small. Verified intelligence comes in. It is matched, on the organisation’s own machines, against WordPress sites and CI/CD lockfiles. A finding comes out with a confidence level, a KEV or EPSS signal when one was supplied locally, and a VEX statement when the owner has recorded that a finding does not apply.
v0.3 is read-only. It does not change a customer system, accept commands from a publisher, or upload an inventory unless a person has explicitly opted in. The existing scan-osv command remains that opt-in, and the new inventory and report commands do not call it.
| Piece | State |
|---|---|
| Trust specification | Written. TUF roles, expiry and the Sigstore pin are specified. No TUF client is linked in. |
| Finding specification | Written, and enforced by ogde report. |
| Threat model | Written from the v0.3 plan. |
| Data-source register | Started. No feed is redistributed yet. |
| Privacy review | Covers the fields this slice emits. |
ogde inventory |
Local CycloneDX from WordPress headers, composer.lock and package-lock.json. |
ogde report |
Confidence, conflict rule, EPSS threshold, VEX suppression, local audit file. |
python-tuf and sigstore-python are not dependencies. Adding them is a protected-zone change and needs the owner’s approval.The Ed25519 feed code stays. The plan keeps it as the test oracle for the future trust layer.
These are unresolved. This change does not pick them.
LICENSE is unchanged.ogde.org has DNS on Cloudflare and no records. site/README.md describes Cloudflare Pages and GitHub Pages. Neither is switched on.