OSPS-LE-01.01 is classified as Level 1 but OSPS Baseline defines it as Level 2

[justaugustus]

Description

The openssf-baseline framework tags OSPS-LE-01.01 as maturity Level 1. In the OSPS Baseline version darnit targets (2025.10.10), OSPS-LE-01.01 applies at maturity-2. As a result, a Level 1 audit over-scopes by evaluating an OSPS Level 2 control, and darnit's per-level counts disagree with the Baseline (and with darnit's own docs).

Steps to Reproduce

1. Run a Level 1 (or full) audit and inspect the level assigned to OSPS-LE-01.01 (it appears at L1).
2. Compare per-level counts: darnit produces L1=25, L2=17, L3=20.
3. Compare against OSPS Baseline 2025-10-10 (ossf/security-baseline -> baseline/OSPS-LE.yaml), where OSPS-LE-01.01 has applicability: [maturity-2, maturity-3], giving L1=24, L2=18, L3=20.

Expected Behavior

OSPS-LE-01.01 is a Level 2 control; per-level counts are L1=24, L2=18, L3=20, matching both the OSPS Baseline and docs/USAGE_GUIDE.md:137-139.

Actual Behavior

packages/darnit-baseline/openssf-baseline.toml:1543 tags it tags = { level = 1, domain = "LE", legal = true, license = true }, producing L1=25, L2=17, L3=20. A Level 1 audit therefore evaluates LE-01.01 (DCO/sign-off), which OSPS places at Level 2.

Note: docs/USAGE_GUIDE.md:137-139 already states the correct 24/18/20 split — so the docs are correct and the TOML is the source of the discrepancy.

Environment

• darnit version: main @ 86f9cfa
• Python version: 3.12 (uv-managed)
• OS: any

Additional Context

Suggested fix: change openssf-baseline.toml:1543 level = 1 -> level = 2; leave the docs unchanged. Consider a regression test asserting darnit's per-level counts equal the upstream OSPS Baseline for the pinned spec version (spec_version = "OSPS v2025.10.10", openssf-baseline.toml:12).