From 24ac4b05e11552b1d3a958fce33f58e6f8a377e6 Mon Sep 17 00:00:00 2001 From: Karena Angell Date: Tue, 4 Aug 2026 22:48:15 -0600 Subject: [PATCH 1/4] feat: strengthen governance criteria for incubation and graduation Move governance documentation, vendor neutrality documentation, maintainer lifecycle, contributor ladder, and decision-making documentation from Suggested to Required at incubation. Add maintainer affiliation currency requirement (30-day update). At graduation, add org-balance mechanism requirement, require contributor ladder to demonstrably produce external maintainers, add LFX Insights verification for org diversity, and add annual governance health check as Suggested. Based on governance review findings across 71 graduated and incubating projects showing that structural mechanisms are the strongest predictor of sustained organizational diversity. Signed-off-by: Karena Angell Signed-off-by: Karena Angell --- .../template-graduation-application.md | 18 ++++++++++++++---- .../template-incubation-application.md | 16 +++++++++------- 2 files changed, 23 insertions(+), 11 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/template-graduation-application.md b/.github/ISSUE_TEMPLATE/template-graduation-application.md index 9b3c80f87..50a7d9202 100644 --- a/.github/ISSUE_TEMPLATE/template-graduation-application.md +++ b/.github/ISSUE_TEMPLATE/template-graduation-application.md @@ -93,6 +93,10 @@ Note: this section may be augmented by the completion of a Governance Review fro +- [ ] **Commit to an annual governance health check on maintainer organizational composition.** _(A lightweight self-assessment to detect post-graduation governance concentration trends early.)_ + + + ### Required - [ ] **Clear and discoverable project governance documentation.** @@ -131,7 +135,11 @@ Note: this section may be augmented by the completion of a Governance Review fro -- [ ] **Project maintainers from at least 2 organizations that demonstrates survivability.** +- [ ] **Project maintainers from at least 2 organizations that demonstrates survivability.** _(Verified through [LFX Insights](https://insights.lfx.linuxfoundation.org/) organizational dependency data, not just the MAINTAINERS file.)_ + + + +- [ ] **Document and demonstrate an org-balance mechanism for governance decisions** _(such as org-balanced voting, steering committee with org caps, or equivalent structural protection ensuring no single organization controls governance decisions regardless of maintainer composition. See [Org-Balanced Voting](https://github.com/cncf/project-template/blob/main/GOVERNANCE-org-balanced-voting.md) for a reusable template.)_ @@ -161,12 +169,14 @@ Note: this section may be augmented by the completion of a Governance Review fro ### Suggested -- [ ] **Contributor ladder with multiple roles for contributors.** - - +N/A ### Required +- [ ] **Contributor ladder with multiple roles for contributors, demonstrably producing maintainers from outside the dominant contributing organization.** + + + - [ ] **Clearly defined and discoverable process to submit issues or changes.** diff --git a/.github/ISSUE_TEMPLATE/template-incubation-application.md b/.github/ISSUE_TEMPLATE/template-incubation-application.md index 4eafe957c..1d46c2d9d 100644 --- a/.github/ISSUE_TEMPLATE/template-incubation-application.md +++ b/.github/ISSUE_TEMPLATE/template-incubation-application.md @@ -93,6 +93,12 @@ Note: this section may be augmented by the completion of a Governance Review fro +- [ ] **If the project has subprojects: subproject leadership, contribution, maturity status documented, including add/remove process.** + + + +### Required + - [ ] **Clear and discoverable project governance documentation.** @@ -121,11 +127,9 @@ Note: this section may be augmented by the completion of a Governance Review fro -- [ ] **If the project has subprojects: subproject leadership, contribution, maturity status documented, including add/remove process.** +- [ ] **Maintainer affiliations are current and updated within 30 days of employment changes.** - - -### Required + - [ ] **Document complete list of current maintainers, including names, contact information, domain of responsibility, and affiliation.** @@ -155,14 +159,12 @@ Note: this section may be augmented by the completion of a Governance Review fro Note: this section may be augmented by the completion of a Governance Review from the Project Reviews subproject. -### Suggested +### Required - [ ] **Contributor ladder with multiple roles for contributors.** -### Required - - [ ] **Clearly defined and discoverable process to submit issues or changes.** From 88a50f05da4160038bf9d9682447628af3f16f8e Mon Sep 17 00:00:00 2001 From: Karena Angell Date: Mon, 10 Aug 2026 10:55:09 -0700 Subject: [PATCH 2/4] fix: address review feedback on governance criteria PR - LFX Insights as corroboration not primary source (brandtkeller) - Affiliation currency: add policy requirement and lapse remediation path - Contributor ladder: remove "dominant organization" assumption Signed-off-by: Karena Angell --- .github/ISSUE_TEMPLATE/template-graduation-application.md | 4 ++-- .github/ISSUE_TEMPLATE/template-incubation-application.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/template-graduation-application.md b/.github/ISSUE_TEMPLATE/template-graduation-application.md index 50a7d9202..ebf0c5509 100644 --- a/.github/ISSUE_TEMPLATE/template-graduation-application.md +++ b/.github/ISSUE_TEMPLATE/template-graduation-application.md @@ -135,7 +135,7 @@ Note: this section may be augmented by the completion of a Governance Review fro -- [ ] **Project maintainers from at least 2 organizations that demonstrates survivability.** _(Verified through [LFX Insights](https://insights.lfx.linuxfoundation.org/) organizational dependency data, not just the MAINTAINERS file.)_ +- [ ] **Project maintainers from at least 2 organizations that demonstrates survivability.** _(Verified through the current project maintainer list, including affiliations. Use [LFX Insights](https://insights.lfx.linuxfoundation.org/) where available to corroborate organizational contribution patterns; explain any unavailable or conflicting data.)_ @@ -173,7 +173,7 @@ N/A ### Required -- [ ] **Contributor ladder with multiple roles for contributors, demonstrably producing maintainers from outside the dominant contributing organization.** +- [ ] **Contributor ladder with multiple roles for contributors, with demonstrated evidence of the ladder producing maintainers from more than one contributing organization.** diff --git a/.github/ISSUE_TEMPLATE/template-incubation-application.md b/.github/ISSUE_TEMPLATE/template-incubation-application.md index 1d46c2d9d..5e934e5e9 100644 --- a/.github/ISSUE_TEMPLATE/template-incubation-application.md +++ b/.github/ISSUE_TEMPLATE/template-incubation-application.md @@ -127,7 +127,7 @@ Note: this section may be augmented by the completion of a Governance Review fro -- [ ] **Maintainer affiliations are current and updated within 30 days of employment changes.** +- [ ] **Maintainer affiliations are current and a policy is in place requiring updates within 30 days of employment changes.** _(If affiliations have lapsed, document how the project identified and corrected them.)_ From 358cdbfa93f49e73fcefea418a17afe433864012 Mon Sep 17 00:00:00 2001 From: Karena Angell Date: Mon, 10 Aug 2026 11:01:06 -0700 Subject: [PATCH 3/4] fix: add 'as applicable' qualifier to contributor ladder requirement Signed-off-by: Karena Angell --- .github/ISSUE_TEMPLATE/template-graduation-application.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/ISSUE_TEMPLATE/template-graduation-application.md b/.github/ISSUE_TEMPLATE/template-graduation-application.md index ebf0c5509..7ce13ad68 100644 --- a/.github/ISSUE_TEMPLATE/template-graduation-application.md +++ b/.github/ISSUE_TEMPLATE/template-graduation-application.md @@ -173,7 +173,7 @@ N/A ### Required -- [ ] **Contributor ladder with multiple roles for contributors, with demonstrated evidence of the ladder producing maintainers from more than one contributing organization.** +- [ ] **Contributor ladder with multiple roles for contributors, with demonstrated evidence of the ladder producing maintainers from more than one contributing organization, as applicable.** From fbe2082e6486f26fa1284a62ae4fce2d8cd67946 Mon Sep 17 00:00:00 2001 From: Karena Angell Date: Mon, 10 Aug 2026 11:52:00 -0700 Subject: [PATCH 4/4] docs(operations): add governance concentration practice period to DD guide Adds guidance for TOC members on handling projects with >75% org dependency during DD, including a 3-month practice period for governance mechanism adoption. Links to governance templates, remediation process, and blog for best practices context. Signed-off-by: Karena Angell --- operations/dd-toc-guide.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/operations/dd-toc-guide.md b/operations/dd-toc-guide.md index c53905466..1992bf4c4 100644 --- a/operations/dd-toc-guide.md +++ b/operations/dd-toc-guide.md @@ -185,6 +185,21 @@ TOC members who sponsor projects seeking graduation are expected to review the r If a project is a specification project such as the TUF, SPIFFE and in-toto projects, there really is very little additional development that would need to happen and it is reasonable for the specification project to have only a few maintainers. For a specification project, it is required to have at least one implementation and that reference implementation DOES NOT need to be part of the project undergoing Due Diligence. The reference implementation should have sufficient adoption to assess maturity and viability of the specification. In many successful specifications, different adopters will implement their own copy for a variety of reasons. Each individual implementation may have limited diversity of maintainers, adoption, etc. but as a whole it can be broad and diverse. +#### Governance concentration and practice period + +During DD, TOC members should review the project's organizational contribution concentration using [LFX Insights](https://insights.lfx.linuxfoundation.org/) to corroborate the maintainer list. For projects with **>75% organizational dependency** and no org-balance mechanism (such as [org-balanced voting](https://github.com/cncf/project-template/blob/main/GOVERNANCE-org-balanced-voting.md), steering committee with org caps, or equivalent structural protection), the TOC recommends the project implement governance changes and demonstrate them in practice for **3 months** before the DD continues. + +Exit criteria for the practice period: + +- Org-balanced voting or steering committee adopted and documented +- At least 3 governance meetings held with published minutes +- At least one governance decision made through the new process +- No regression in LFX org dependency + +This is not punitive -- it verifies that governance works under real conditions before the project moves forward. Projects with lower concentration or existing structural protections may proceed without a practice period. The TOC member should record the decision (whether a practice period is needed and why) in the DD PR. + +For governance best practices and anti-patterns to look for during DD, see the [governance guidance blog post](https://www.cncf.io/blog/), the [governance templates](https://contribute.cncf.io/projects/best-practices/governance/templates/), and the [governance remediation process](governance-remediation-process.md). + ### Finalizing the Due Diligence When the TOC has finished their criteria evaluation, they should move the project's card on the [Application to Move Levels board](https://github.com/orgs/cncf/projects/27/views/9) to "Adopter Interviews & Project Discussion" and re-engage the project to elevate and discuss any items needing clarity, correction, or improvement. This includes notifying the project of any recommendations. Recommendations and discussion points may be copied into the kick-off document to facilitate discussion and to provide for additional context and discussion with the project until they are finalized.