What changed
The core has held the OpenSSF Best Practices passing badge for months. The five companion crates now hold it too, each at 100% of the passing criteria. Their READMEs carry the badge beside the Scorecard one.
Answered from evidence, not copied
The quick way to fill in five self-certifications is to copy the core's and change the name. That would have been wrong. The core's answers cite its own test count, its own release, its own documents, and several of those statements are simply untrue of a companion crate.
Every criterion was answered from the crate it describes: its own test count, the number of checks that report on its default branch, the number of issues it has closed, its own interface documentation, and its own build file. Where a crate genuinely differs, the answer says so. The command-line tools have no Makefile, so their build criterion points at the manifest and the build script. The serde-yaml shim has no coverage gate of its own, by design, because it is a thin re-export layer over a core that is gated at 95%, and its answer says exactly that rather than claiming a number it does not have.
A self-certification is a public claim. It is worth only as much as its weakest sentence.
Upgrading
Bump every noyalib crate you use to 0.0.40. No public API changed
shape.