From daa7d0db084a7d28264e93e8112b411e51799c4c Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Wed, 23 Sep 2026 18:28:04 -0400 Subject: [PATCH] The bus factor is two: znmead knows the code and reviews pull requests The maintainer's word (2026-09-23): znmead knows the code, and reviews pull requests from that date. The pages said the bus factor was one because the knowledge was held once; it is held twice now, and his reviews are the public record of it. Copy only. Signed-off-by: Ayla Croft --- CHANGELOG.md | 7 +++++++ docs/governance.md | 19 ++++++++++--------- docs/succession.md | 8 +++++--- 3 files changed, 22 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 51f275f..2ff7da6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,13 @@ All notable changes to this project are documented here. The format follows ## [Unreleased] +### Changed: the bus factor is two (copy) + +- `docs/succession.md` and `docs/governance.md`: `znmead` knows the code (the maintainer's word, + 2026-09-23) and reviews pull requests from that date, so the knowledge to carry the project + is held twice; his reviews are the public record of it. The Scorecard row's bus-factor note + follows. + ### Changed: the slice records leave the public tree; SLICES.md says what each slice committed - The `slices/` archive (243 files: the plans, review logs and gate runs of slices 001 to 007) diff --git a/docs/governance.md b/docs/governance.md index a82c256..1f5b7d2 100644 --- a/docs/governance.md +++ b/docs/governance.md @@ -14,13 +14,14 @@ the parts a larger project would have and this one does not. **One maintainer.** The repository `ScriptKittyOS/beam_mcp` is owned by the ScriptKittyOS organization; its one administrator is the maintainer, who is also the Hex package's owner and the address `SECURITY.md` names. `CODEOWNERS` names that login for every path. There is -no steering group, no second reviewer, and no vote: a decision is the maintainer's, recorded -in the tree (a CHANGELOG entry, a page, a test) or it was not made. **For continuity**, two +no steering group and no vote: a decision is the maintainer's, recorded in the tree (a +CHANGELOG entry, a page, a test) or it was not made. From 2026-09-23 pull requests are +reviewed by `znmead`, who knows the code, as well as by the maintainer. **For continuity**, two people hold access: `znmead` and Mike Hostetler the Maintain role here, and Mike maintainer -ownership on hex.pm, so issues, merges and releases can go on without the maintainer; neither is a reviewer -of record, and neither decides anything while the maintainer can. The **bus factor is one** for knowledge, -and `docs/succession.md` says what that means, what their access covers, and what a successor -would need. +ownership on hex.pm, so issues, merges and releases can go on without the maintainer; neither +decides anything while the maintainer can. The **bus factor is two**: the maintainer and +`znmead` both know the code; `docs/succession.md` says what that means, what the access covers, +and what a successor would need. ## How a change lands @@ -78,7 +79,7 @@ promised, and moves when the Scorecard next runs. | Packaging | the package is published to hex.pm by the maintainer from the canonical tarball, on a signed tag; no GitHub Actions publishing workflow | the publish step holds a Hex API key, which stays on the maintainer's seat rather than in a workflow secret: a decision, recorded here; the provenance workflow attests the bytes but does not publish them | −1, "packaging workflow not detected": the check reads a publishing workflow only | | SAST | Dialyzer and Credo in the gate; no CodeQL | the gate's analysers are what the language has; a CodeQL workflow is a separate decision and is not taken here | 0, the check recognises neither Dialyzer nor Credo | | Fuzzing | eleven property-based tests in the gate; no OSS-Fuzz | property tests are the fuzzing the suite does; OSS-Fuzz integration is not taken | 10, "project is fuzzed": the check reads the property tests as fuzzing | -| CII-Best-Practices | **silver** since 2026-09-23 ([project 14774](https://www.bestpractices.dev/projects/14774)), passing the same day; continuity of access met by the two people `docs/succession.md` names; every answer cites this tree, and one that stops being true is changed there | the badge is a self-assessment a reader can check line by line; the bus factor (a SHOULD) is answered Unmet, since access is held twice and knowledge once | 2, "badge detected: InProgress" (the run of 2026-09-23 17:26 UTC, before passing was recorded; the check gives passing 5, silver 7, gold 10) | +| CII-Best-Practices | **silver** since 2026-09-23 ([project 14774](https://www.bestpractices.dev/projects/14774)), passing the same day; continuity of access met by the two people `docs/succession.md` names; every answer cites this tree, and one that stops being true is changed there | the badge is a self-assessment a reader can check line by line; the bus factor is answered Met, two people knowing the code | 2, "badge detected: InProgress" (the run of 2026-09-23 17:26 UTC, before passing was recorded; the check gives passing 5, silver 7, gold 10) | | Dangerous-Workflow | the pull-request body is read through an environment variable, never interpolated into a script | | 10 | | Binary-Artifacts | none in the tree | | 10 | | Contributors | one organization owns the repository; the NOTICE names the owner and the builder | the check counts the companies commit authors declare, and read two | 6, "2 contributing companies or organizations" | @@ -88,5 +89,5 @@ promised, and moves when the Scorecard next runs. No second maintainer is invented to satisfy a check. No GitHub Release is published beside the Hex release to satisfy a check. No analyser is added for its name. Where a check reads low for a reason this page states, the reason stands until the fact changes: a second -maintainer is `docs/succession.md`'s subject, and the off-account archive that would lower -the bus factor's cost waits on a decision recorded there. +maintainer is `docs/succession.md`'s subject, and the off-account archive of the private +records waits on a decision recorded there. diff --git a/docs/succession.md b/docs/succession.md index 3024d6d..3b10cd6 100644 --- a/docs/succession.md +++ b/docs/succession.md @@ -8,10 +8,12 @@ SPDX-License-Identifier: Apache-2.0 What happens to this package if its one maintainer stops. Stated as it is, so a consumer can weigh it, and so a successor knows where everything is. -## The bus factor is one +## The bus factor is two -There is one maintainer (`docs/governance.md`): one person has written and reviewed this code, -and that knowledge is not held twice. They hold the ScriptKittyOS organization that owns the +There is one maintainer (`docs/governance.md`), and a second person who knows this code: +`znmead`, on the maintainer's word (2026-09-23), who holds the Maintain role (next section) and +reviews pull requests from that date, so his reviews are the public record of it. The +knowledge to carry the project is held twice. The maintainer holds the ScriptKittyOS organization that owns the repository, the Hex package's `full` ownership, the address in `SECURITY.md`, and the OpenPGP key that signs release tags (`docs/provenance.md`). The package itself signs no bytes (`docs/crypto-posture.md`) and release attestations are made by GitHub's workflow identity, so