license switch agpl -> busl1, sprints work, new product advisories
This commit is contained in:
master
@@ -1,92 +1,92 @@
|
||||
# Stella Ops Project Governance
|
||||
*Lazy Consensus • Maintainer Charter • Transparent Veto*
|
||||
|
||||
> **Scope** – applies to **all** repositories under
|
||||
> `https://git.stella-ops.org/stella-ops/*` unless a sub‑project overrides it
|
||||
> with its own charter approved by the Core Maintainers.
|
||||
|
||||
---
|
||||
|
||||
## 1 · Decision‑making workflow 🗳️
|
||||
|
||||
| Stage | Default vote | Timer |
|
||||
|-------|--------------|-------|
|
||||
| **Docs / non‑code PR** | `+1` | **48 h** |
|
||||
| **Code / tests PR** | `+1` | **7 × 24 h** |
|
||||
| **Security‑sensitive / breaking API** | `+1` + explicit **`security‑LGTM`** | **7 × 24 h** |
|
||||
|
||||
**Lazy‑consensus** – silence = approval once the timer elapses.
|
||||
|
||||
* **Veto `‑1`** must include a concrete concern **and** a path to resolution.
|
||||
* After 3 unresolved vetoes the PR escalates to a **Maintainer Summit** call.
|
||||
|
||||
---
|
||||
|
||||
## 2 · Maintainer approval thresholds 👥
|
||||
|
||||
| Change class | Approvals required | Example |
|
||||
|--------------|-------------------|---------|
|
||||
| **Trivial** | 0 | Typos, comment fixes |
|
||||
| **Non‑trivial** | **2 Maintainers** | New API endpoint, feature flag |
|
||||
| **Security / breaking** | Lazy‑consensus **+ `security‑LGTM`** | JWT validation, crypto swap |
|
||||
|
||||
Approval is recorded via Git forge review or a signed commit trailer
|
||||
`Signed-off-by: <maintainer>`.
|
||||
|
||||
---
|
||||
|
||||
## 3 · Becoming (and staying) a Maintainer 🌱
|
||||
|
||||
1. **3 + months** of consistent, high‑quality contributions.
|
||||
2. **Nomination** by an existing Maintainer via issue.
|
||||
3. **7‑day vote** – needs ≥ **⅔ majority** “`+1`”.
|
||||
4. Sign `MAINTAINER_AGREEMENT.md` and enable **2FA**.
|
||||
5. Inactivity > 6 months → automatic emeritus status (can be re‑activated).
|
||||
|
||||
---
|
||||
|
||||
## 4 · Release authority & provenance 🔏
|
||||
|
||||
* Every tag is **co‑signed by at least one Security Maintainer**.
|
||||
* CI emits a **signed SPDX SBOM** + **Cosign provenance**.
|
||||
* Release cadence is fixed – see [Release Engineering Playbook](RELEASE_ENGINEERING_PLAYBOOK.md).
|
||||
* Security fixes may create out‑of‑band `x.y.z‑hotfix` tags.
|
||||
|
||||
---
|
||||
|
||||
## 5 · Escalation lanes 🚦
|
||||
|
||||
| Situation | Escalation |
|
||||
|-----------|------------|
|
||||
| Technical deadlock | **Maintainer Summit** (recorded & published) |
|
||||
| Security bug | Follow [Security Policy](SECURITY_POLICY.md) |
|
||||
|
||||
---
|
||||
|
||||
## 6 · Contribution etiquette 🤝
|
||||
|
||||
* Draft PRs early – CI linting & tests help you iterate.
|
||||
* “There are no stupid questions” – ask in **Matrix #dev**.
|
||||
* Keep commit messages in **imperative mood** (`Fix typo`, `Add SBOM cache`).
|
||||
* Run the `pre‑commit` hook locally before pushing.
|
||||
|
||||
---
|
||||
|
||||
## 7 · Licence reminder 📜
|
||||
|
||||
Stella Ops is **AGPL‑3.0‑or‑later**. By contributing you agree that your
|
||||
patches are released under the same licence.
|
||||
|
||||
---
|
||||
|
||||
### Appendix A – Maintainer list 📇
|
||||
|
||||
*(Generated via `scripts/gen-maintainers.sh` – edit the YAML, **not** this
|
||||
section directly.)*
|
||||
|
||||
| Handle | Area | Since |
|
||||
|--------|------|-------|
|
||||
| `@alice` | Core scanner • Security | 2025‑04 |
|
||||
| `@bob` | UI • Docs | 2025‑06 |
|
||||
|
||||
---
|
||||
# Stella Ops Project Governance
|
||||
*Lazy Consensus • Maintainer Charter • Transparent Veto*
|
||||
|
||||
> **Scope** – applies to **all** repositories under
|
||||
> `https://git.stella-ops.org/stella-ops/*` unless a sub‑project overrides it
|
||||
> with its own charter approved by the Core Maintainers.
|
||||
|
||||
---
|
||||
|
||||
## 1 · Decision‑making workflow 🗳️
|
||||
|
||||
| Stage | Default vote | Timer |
|
||||
|-------|--------------|-------|
|
||||
| **Docs / non‑code PR** | `+1` | **48 h** |
|
||||
| **Code / tests PR** | `+1` | **7 × 24 h** |
|
||||
| **Security‑sensitive / breaking API** | `+1` + explicit **`security‑LGTM`** | **7 × 24 h** |
|
||||
|
||||
**Lazy‑consensus** – silence = approval once the timer elapses.
|
||||
|
||||
* **Veto `‑1`** must include a concrete concern **and** a path to resolution.
|
||||
* After 3 unresolved vetoes the PR escalates to a **Maintainer Summit** call.
|
||||
|
||||
---
|
||||
|
||||
## 2 · Maintainer approval thresholds 👥
|
||||
|
||||
| Change class | Approvals required | Example |
|
||||
|--------------|-------------------|---------|
|
||||
| **Trivial** | 0 | Typos, comment fixes |
|
||||
| **Non‑trivial** | **2 Maintainers** | New API endpoint, feature flag |
|
||||
| **Security / breaking** | Lazy‑consensus **+ `security‑LGTM`** | JWT validation, crypto swap |
|
||||
|
||||
Approval is recorded via Git forge review or a signed commit trailer
|
||||
`Signed-off-by: <maintainer>`.
|
||||
|
||||
---
|
||||
|
||||
## 3 · Becoming (and staying) a Maintainer 🌱
|
||||
|
||||
1. **3 + months** of consistent, high‑quality contributions.
|
||||
2. **Nomination** by an existing Maintainer via issue.
|
||||
3. **7‑day vote** – needs ≥ **⅔ majority** “`+1`”.
|
||||
4. Sign `MAINTAINER_AGREEMENT.md` and enable **2FA**.
|
||||
5. Inactivity > 6 months → automatic emeritus status (can be re‑activated).
|
||||
|
||||
---
|
||||
|
||||
## 4 · Release authority & provenance 🔏
|
||||
|
||||
* Every tag is **co‑signed by at least one Security Maintainer**.
|
||||
* CI emits a **signed SPDX SBOM** + **Cosign provenance**.
|
||||
* Release cadence is fixed – see [Release Engineering Playbook](RELEASE_ENGINEERING_PLAYBOOK.md).
|
||||
* Security fixes may create out‑of‑band `x.y.z‑hotfix` tags.
|
||||
|
||||
---
|
||||
|
||||
## 5 · Escalation lanes 🚦
|
||||
|
||||
| Situation | Escalation |
|
||||
|-----------|------------|
|
||||
| Technical deadlock | **Maintainer Summit** (recorded & published) |
|
||||
| Security bug | Follow [Security Policy](SECURITY_POLICY.md) |
|
||||
|
||||
---
|
||||
|
||||
## 6 · Contribution etiquette 🤝
|
||||
|
||||
* Draft PRs early – CI linting & tests help you iterate.
|
||||
* “There are no stupid questions” – ask in **Matrix #dev**.
|
||||
* Keep commit messages in **imperative mood** (`Fix typo`, `Add SBOM cache`).
|
||||
* Run the `pre‑commit` hook locally before pushing.
|
||||
|
||||
---
|
||||
|
||||
## 7 · Licence reminder 📜
|
||||
|
||||
Stella Ops is **BUSL-1.1**. By contributing you agree that your
|
||||
patches are released under the same licence.
|
||||
|
||||
---
|
||||
|
||||
### Appendix A – Maintainer list 📇
|
||||
|
||||
*(Generated via `scripts/gen-maintainers.sh` – edit the YAML, **not** this
|
||||
section directly.)*
|
||||
|
||||
| Handle | Area | Since |
|
||||
|--------|------|-------|
|
||||
| `@alice` | Core scanner • Security | 2025‑04 |
|
||||
| `@bob` | UI • Docs | 2025‑06 |
|
||||
|
||||
---
|
||||
|
||||
Reference in New Issue
Block a user