0 Fork 0

Files

T

docs: KofTwentyTwo standards v1 policies, standards, and architecture

Original KofTwentyTwo standards written against 2026 public frameworks
(OpenSSF OSPS Baseline v2026.08.28, NIST SSDF v1.1, SLSA v1.2, Scorecard):

- policies: requirement framework (K22-<AREA>-NN, RFC 2119), SDLC,
  security program (WISP equivalent), AI-assisted development, exceptions
- standards: repository, CI/CD, testing, dependencies, releases
- architecture: Windows desktop application reference architecture
- compliance: full OSPS Baseline crosswalk (63/64 met, 1 excepted),
  SSDF, SLSA, and Scorecard mappings
- exception register (EX-0001 single maintainer, EX-0002 Windows signing)
- governance, maintainers and repository inventory, code of conduct,
  licenses (docs CC BY 4.0, code MIT)

Coding standards (Kingsrook style), IDE/CLI configs, reusable workflows,
and the conformance checker follow in separate pull requests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

2026-10-09 07:47:10 -05:00

2.6 KiB

Raw Permalink Blame History

Governance

KofTwentyTwo is an individual open-source maintainer's account. This document says who decides what, and how that changes as the project grows.

Model

KofTwentyTwo projects are run by a single maintainer who has final responsibility for every repository, release, and security decision. Decisions are made in public: in issues and pull requests, and for significant ones in architecture decision records (K22-SDLC-02).

Roles and responsibilities

Role	Responsibilities	Access
Maintainer	Sets direction; reviews and merges changes; cuts releases; responds to security reports; owns the security program; keeps these standards current	Admin on every repository, owner of package namespaces and signing identities
Collaborator	Contributes regularly to a specific repository; may triage issues and review pull requests	Triage or write on named repositories only, granted under `K22-SEC-02`
Contributor	Opens issues and pull requests	None beyond public access
Automation	CI, Dependabot, AI coding agents acting through pull requests	Least-privilege tokens; never merges or releases (`K22-AI-10`)

Current holders of each role with access to sensitive resources are listed in MAINTAINERS.md.

Adding a maintainer or collaborator

The person has a track record of accepted contributions in the repositories concerned.
The maintainer opens a pull request adding them to MAINTAINERS.md with the role and repositories, and confirms their account uses phishing-resistant MFA (K22-SEC-01).
Access is granted after the pull request merges, at the lowest level that fits.
When the project has two maintainers, every protect-main ruleset moves to one required approval and exception EX-0001 is closed.

Removing access

Access is removed when it is no longer used (at the latest at the annual access review, K22-SEC-04), on request, or immediately if an account may be compromised. The change is recorded in MAINTAINERS.md.

Changing these standards

Changes to this repository go through pull requests like any other change. Changes that add a MUST or remove an allowance are released as a new MAJOR version with notes on what repositories need to do.

2.6 KiB Raw Permalink Blame History