oss-governance

Rank models by value per maintainer hour rather than ambition. A maintainer council is the default at three or more maintainers; elected steering committees only pay off with multiple employers, a founder departure, or a foundation application. An absence factor of 1 rules out every shared model until co-maintainers are recruited.

Include scope, roles separating merge rights from privileged credentials, self-assessable maintainer promotion criteria, removal and emeritus rules, per-class decision rules with thresholds and timers, escalation and appeals, trademark ownership, and an amendments clause. Keep it to what the project has done or will plausibly do this year.

Use the contributor absence factor: the smallest number of contributors responsible for 50% of contributions, excluding bots and merge commits. Compute it per governed area as well as project-wide, and separately inventory privileged credentials like signing keys and registry tokens, which need at least two holders.

Only when the project needs to handle money or must prove vendor neutrality to adopters; otherwise a host adds obligations without benefit. Fix the slow readiness gaps first, namely a single-employer maintainer pool and governance that has never been exercised, since those take quarters.

No. Licensing, contributor agreements, trademark filings, and employment questions are explicitly routed to legal counsel. The Skill prepares the decision, such as what the project wants and what a host requires, but never answers legal questions itself.

Relieve load first through triage help, scope cuts, or paused releases rather than promotion. Grant merge rights quickly since they are cheap to revoke, but withhold signing keys and publish tokens until after a supervised release cycle, citing the 2024 xz-utils takeover as the cautionary case.