From 1b28fe65d946fde335cf44c8400a1c83f23f15ad Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Wed, 23 Sep 2026 14:12:48 -0400 Subject: [PATCH] GOVERNANCE: two continuity holders, znmead (Maintain here) and Mike Hostetler (maintainer on hex.pm) For the OpenSSF badge's access_continuity: the project can triage, merge and release within a week if the maintainer cannot. Measured 2026-09-23: GitHub lists znmead as a collaborator with role maintain on this repository (accepted); hex.pm lists mikehostetler as an owner of beam_mcp_signer at level maintainer (mix hex.owner list); mikehostetler's GitHub invitation (maintain) is pending and the page says so. Unprotected main and tags let Maintain merge and tag. What the access does not reach is stated: settings, collaborators, Hex owners, the security intake. The bus factor stays one for knowledge. No code change. Signed-off-by: Ayla Croft --- CHANGELOG.md | 6 ++++++ GOVERNANCE.md | 17 ++++++++++------- 2 files changed, 16 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0711aa7..d646087 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ SPDX-License-Identifier: Apache-2.0 ## [Unreleased] +### Changed: governance (no code change) + +- `GOVERNANCE.md` names two continuity holders, as on `beam_mcp`: `znmead` (the Maintain role + on this repository) and Mike Hostetler (`maintainer` ownership on hex.pm; invited to + Maintain), what that covers and what it does not. The bus factor stays one for knowledge. + ### Added - `:private_key` may be a zero-arity function returning the 32-byte key diff --git a/GOVERNANCE.md b/GOVERNANCE.md index b615cac..aedd5f5 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -15,12 +15,13 @@ apply here, and this page says what is particular to this repository. | role | who | responsibilities | |---|---|---| -| **Maintainer** | one person: the ScriptKittyOS organization's administrator, the hex.pm owner of `beam_mcp_signer` (account `aylacroft`), and the address in `SECURITY.md` | decides what lands and when; reviews every pull request; keeps CI green; answers security reports on `SECURITY.md`'s commitments; tags (signed) and publishes releases; keeps this page, the roadmap and the CHANGELOG true | +| **Maintainer** | one person: the ScriptKittyOS organization's administrator, the `full` hex.pm owner of `beam_mcp_signer` (account `aylacroft`), and the address in `SECURITY.md` | decides what lands and when; reviews every pull request; keeps CI green; answers security reports on `SECURITY.md`'s commitments; tags (signed) and publishes releases; keeps this page, the roadmap and the CHANGELOG true | +| **Continuity holders** | two people, from 2026-09-23, the same as on `beam_mcp`: `znmead`, the Maintain role on this repository; Mike Hostetler (`mikehostetler`), `maintainer` ownership of `beam_mcp_signer` on hex.pm, invited to Maintain here too | if the maintainer cannot act, keep the project going within a week between them: triage and close issues, merge pull requests once CI is green, tag (signed with their own key, announced in the CHANGELOG with its fingerprint) and publish releases; decide nothing while the maintainer can | | **Contributor** | anyone | proposes changes by pull request under `CONTRIBUTING.md`: signed off, tested, green; reports bugs and enhancements as issues; reports vulnerabilities privately | There is no steering group and no vote. A decision is the maintainer's and is recorded in the -tree (a CHANGELOG entry, a page, a test) or it was not made. The bus factor is one, stated -rather than hidden. +tree (a CHANGELOG entry, a page, a test) or it was not made. Access is held twice; knowledge +is held once, so the bus factor is one, stated rather than hidden. ## How a change lands @@ -38,7 +39,9 @@ the assurance case changes in the same pull request. ## If the maintainer stops -`beam_mcp`'s succession page applies as written: the repository is public and forkable under -the organization, published releases stay on hex.pm, and a successor needs organization -ownership, `mix hex.owner add beam_mcp_signer` from the current owner (or hex.pm's support -process), and nothing else: this package holds no secret of its own. +The continuity holders above can triage, merge and release without the maintainer. +`beam_mcp`'s succession page applies as written, including what their access does not reach: +this repository's settings, adding collaborators, and adding owners on hex.pm stay with the +maintainer (the organization's owner, the package's `full` owner), and so does the security +intake `SECURITY.md` names. The repository is public and forkable under the organization, +published releases stay on hex.pm, and this package holds no secret of its own.