docs: record discussions and listing submission

Author: parousia8888

docs/V0.5.4_ENGINEERING_PLAN.md

@@ -41,8 +41,8 @@ opens a lower-friction support channel and submits the one currently eligible cu
 | G2 | Real-world regression corpus | One deterministic command executes structured cases for report rendering, pnpm workspace inheritance, nested templates, moved-condition retest and benign numeric SVG review; generated JSON/Markdown records provenance and limits | completed |
 | G3 | First-trial and v0.5.4 candidate surfaces | Main-branch first trial is unpinned; CI/release/trusted install examples stay pinned; candidate version surfaces agree on 0.5.4 while published release state remains 0.5.3 | completed |
 | G4 | Focused and final verification | New focused tests pass, generated artifacts are byte-current, one bounded complete-suite pass and Skill Creator validation pass | completed |
-| G5 | Authorized external actions | Discussions is enabled and verified; awesome-devsecops rules are rechecked and a factual v0.5.3 PR is submitted if still eligible | in progress |
-| G6 | Release approval checkpoint | Candidate commits and external evidence are pushed; exact release operations and residual risks are presented to the author | pending |
+| G5 | Authorized external actions | Discussions is enabled and verified; awesome-devsecops rules are rechecked and a factual v0.5.3 PR is submitted if still eligible | completed |
+| G6 | Release approval checkpoint | Candidate commits and external evidence are pushed; exact release operations and residual risks are presented to the author | in progress |
 | G7 | Public v0.5.4 release | Signed tag/assets, GitHub Release, npm provenance, `v1` consumer verification and release-state update | blocked on explicit approval |
 
 ## G0 - Scope and baseline
@@ -229,6 +229,21 @@ awesome-devsecops:
 - Record PR URL, head commit, review state and any maintainer requirement. A submitted PR is not an
   accepted listing.
 
+Completion record (2026-08-16):
+
+- Enabled GitHub Discussions and read back `has_discussions: true`; recorded the verified
+  repository timestamp and Discussions URL without creating synthetic questions or testimonials.
+- Rechecked awesome-devsecops at current default-branch commit
+  `1704e442a30ca21caeb05e8721eb26855129c86b`: the repository is not archived, its free/open-source
+  scope and empty `CONTRIBUTING.md` are unchanged, and recent accepted additions use one README
+  line under the relevant category.
+- Forked the repository, added one alphabetical `Tools > Testing` link and opened
+  [`devsecops/awesome-devsecops#172`](https://github.com/devsecops/awesome-devsecops/pull/172).
+  The PR is OPEN at head `b24339b5ac2e16cda9eca5e92ecd847493bd38bc`, changes one file/one
+  line and describes only public v0.5.3 facts.
+- Source metadata records `submitted_pending_review` and `accepted: false`; submission is not
+  represented as an accepted listing, usage proof or maintainer endorsement.
+
 ## G6 - Candidate handoff
 
 Before asking for release approval, report:

docs/adoption/listings.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "reviewedAt": "2026-08-16T11:35:40Z",
+  "reviewedAt": "2026-08-16T12:47:09Z",
   "projectFacts": {
     "repository": "https://github.com/parousia8888/web-app-security-skill",
     "firstDefaultBranchCommit": "b52288fd52af9f23195e75d6bb845f6ac2d3e8b9",
@@ -37,11 +37,21 @@
       "repository": "https://github.com/devsecops/awesome-devsecops",
       "policyCommit": "1704e442a30ca21caeb05e8721eb26855129c86b",
       "policyPaths": ["README.md", "CONTRIBUTING.md"],
-      "submissionMethod": "owner_review_required",
-      "status": "eligible_on_documented_scope",
+      "submissionMethod": "pull_request",
+      "status": "submitted_pending_review",
       "unmetRules": [],
       "earliestAgeRecheckAt": null,
-      "notes": "The published scope accepts free or open-source capabilities that support DevSecOps, which the CLI and Action can satisfy. CONTRIBUTING.md is empty and gives no current submission format, so recheck repository practice before any owner-authorized pull request."
+      "notes": "The policy commit remains current and accepts free or open-source DevSecOps capabilities. CONTRIBUTING.md is empty; recent merged additions change one README list item. PR 172 adds one Testing entry and makes no accuracy, adoption or endorsement claim.",
+      "submission": {
+        "url": "https://github.com/devsecops/awesome-devsecops/pull/172",
+        "state": "open",
+        "createdAt": "2026-08-16T12:47:09Z",
+        "headCommit": "b24339b5ac2e16cda9eca5e92ecd847493bd38bc",
+        "upstreamBaseCommit": "1704e442a30ca21caeb05e8721eb26855129c86b",
+        "filesChanged": 1,
+        "linesAdded": 1,
+        "accepted": false
+      }
     },
     {
       "id": "static-analysis",

docs/github-metadata.json

@@ -8,6 +8,11 @@
   "description": "Scope, audit, harden, and retest web projects with AI coding agents and reproducible evidence.",
   "homepage": "https://github.com/parousia8888/web-app-security-skill/blob/main/docs/tutorial.md",
   "homepageDecision": "owner_decision_pending",
+  "discussions": {
+    "status": "enabled",
+    "verifiedAt": "2026-08-16T12:45:22Z",
+    "url": "https://github.com/parousia8888/web-app-security-skill/discussions"
+  },
   "socialPreview": {
     "asset": "docs/assets/social-preview.png",
     "metadata": "docs/assets/social-preview.json",

scripts/check-adoption-contract.mjs

@@ -105,6 +105,17 @@ if (listings.projectFacts.hasMcpServer !== false || mcpListing?.status !== 'out_
   console.error('adoption contract: MCP registry must remain out of scope without an MCP server');
   failed = true;
 }
+const awesomeDevsecops = listings.candidates.find((item) => item.id === 'awesome-devsecops');
+if (awesomeDevsecops?.status !== 'submitted_pending_review'
+    || awesomeDevsecops.submissionMethod !== 'pull_request'
+    || awesomeDevsecops.submission?.state !== 'open'
+    || awesomeDevsecops.submission?.accepted !== false
+    || !/^https:\/\/github\.com\/devsecops\/awesome-devsecops\/pull\/\d+$/.test(
+      awesomeDevsecops.submission?.url || '',
+    )) {
+  console.error('adoption contract: awesome-devsecops submission state is incomplete or overstated');
+  failed = true;
+}
 for (const item of listings.candidates.filter((candidate) => candidate.repository)) {
   if (!/^[a-f0-9]{40}$/.test(item.policyCommit || '') || !item.policyPaths.length) {
     console.error(`adoption contract: ${item.id} policy review is not commit-pinned`);

scripts/check-p7-surfaces.mjs

@@ -44,6 +44,11 @@ function fail(message) {
 
 if (metadata.schemaVersion !== 1) fail('metadata schemaVersion must be 1');
 if (metadata.repository !== 'parousia8888/web-app-security-skill') fail('repository identity drifted');
+if (metadata.discussions?.status !== 'enabled'
+    || metadata.discussions.url !== `https://github.com/${metadata.repository}/discussions`
+    || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/.test(metadata.discussions.verifiedAt || '')) {
+  fail('Discussions metadata is not verified');
+}
 if (metadata.description !== metadata.promise?.en || metadata.description.length > 160) {
   fail('GitHub description must be the canonical short promise and fit the GitHub limit');
 }
@@ -117,14 +122,15 @@ for (const issue of metadata.roadmapIssues || []) {
 }
 
 if (live) {
-  const repoResult = spawnSync('gh', ['repo', 'view', metadata.repository, '--json', 'description,homepageUrl,repositoryTopics'], { encoding: 'utf8' });
+  const repoResult = spawnSync('gh', ['repo', 'view', metadata.repository, '--json', 'description,homepageUrl,repositoryTopics,hasDiscussionsEnabled'], { encoding: 'utf8' });
   if (repoResult.status !== 0) fail(repoResult.stderr || 'unable to read live GitHub metadata');
   else {
     const repo = JSON.parse(repoResult.stdout);
     const topics = (repo.repositoryTopics || []).map((item) => item.name).sort();
     if (repo.description !== metadata.description) fail('live GitHub description differs from source');
     if (repo.homepageUrl !== metadata.homepage) fail('live GitHub homepage differs from source');
     if (topics.join('\n') !== metadata.topics.join('\n')) fail('live GitHub topics differ from source');
+    if (repo.hasDiscussionsEnabled !== true) fail('live GitHub Discussions is not enabled');
   }
   const labelResult = spawnSync('gh', ['label', 'list', '--repo', metadata.repository, '--limit', '100', '--json', 'name,color,description'], { encoding: 'utf8' });
   if (labelResult.status !== 0) fail(labelResult.stderr || 'unable to read live GitHub labels');

test/adoption-discovery.test.mjs

@@ -26,7 +26,11 @@ const byId = Object.fromEntries(listings.candidates.map((item) => [item.id, item
 assert.equal(byId['awesome-claude-code'].status, 'ineligible');
 assert.deepEqual(byId['awesome-claude-code'].unmetRules, ['at_least_14_days_old_or_100_stars']);
 assert.equal(byId['awesome-agent-skills'].status, 'ineligible');
-assert.equal(byId['awesome-devsecops'].status, 'eligible_on_documented_scope');
+assert.equal(byId['awesome-devsecops'].status, 'submitted_pending_review');
+assert.equal(byId['awesome-devsecops'].submission.url,
+  'https://github.com/devsecops/awesome-devsecops/pull/172');
+assert.equal(byId['awesome-devsecops'].submission.state, 'open');
+assert.equal(byId['awesome-devsecops'].submission.accepted, false);
 assert.deepEqual(byId['static-analysis'].unmetRules,
   ['more_than_one_contributor', 'more_than_20_stars', 'at_least_three_months_old']);
 assert.equal(byId['mcp-registry'].status, 'out_of_scope');

test/p7-surfaces.test.mjs

@@ -21,6 +21,9 @@ for (const [script, expected] of [
 const evidence = readFileSync(join(ROOT, 'docs', 'launch-evidence.md'), 'utf8');
 const metadata = JSON.parse(readFileSync(join(ROOT, 'docs', 'github-metadata.json'), 'utf8'));
 const releaseState = JSON.parse(readFileSync(join(ROOT, 'docs', 'release-state.json'), 'utf8'));
+assert.equal(metadata.discussions.status, 'enabled');
+assert.equal(metadata.discussions.url,
+  'https://github.com/parousia8888/web-app-security-skill/discussions');
 assert.match(evidence, /OS command injection lead \(CWE-78\); SUSPECTED HIGH -> security fixed; functional passed/);
 assert.match(evidence, /43 findings across 5 fixed commits -> 11 useful leads; 27 expected benign; 1 unknown; 4 confirmed facts/);
 assert.doesNotMatch(evidence, /2 security HIGH|11 discoverability HIGH|13\s+(?:high|HIGH)/);