Add current OWASP Nest project metadata - #42
Merged
Merged
Conversation
OWASP Nest indexes projects from a project.owasp.yaml file in the project repository. This repository has never had one on main, so the OWASP index carries no current metadata for ACS and the retired Agent Observability Standard page remains the canonical public listing. An owasp-nest[bot] push on 2025-10-02 created the branch nest/owasp-agent-observability-standard-metadata with a generated draft. No pull request was opened from it, so nobody reviewed it, and the rebrand from AOS to ACS landed six months later without it. The branch is now one commit ahead and twenty-three behind. Its draft was unusable as written: pitch: A very brief, one-line description of your project tags: custom-tag, custom-tag-1, custom-tag-2 Both were untouched generator placeholders. The draft also named the project Agent Observability Standard, pointed website at the retired owasp.org page, listed both superseded OWASP repositories including www-project-agent-observability-standard-2, and carried a leader email address. This file is written fresh against the current project rather than salvaged from that draft. Leaders carry GitHub handles and no email address, which the schema allows since person requires only name. The community channel is GitHub Discussions, matching CONTRIBUTING.md and README.md. License records the dual Apache-2.0 and CC-BY-SA-4.0 split rather than the draft's Apache-2.0 alone. The audience gains defender alongside builder, since Guardian Agents are a defender-side role. Leadership is carried over from the draft unchanged. Naming OWASP project leaders is a governance decision rather than a repository one, so this commit does not alter the list. It should be confirmed against the current project leadership. Validated against owasp/nest-schema project.json and common.json. Every URL in the file returns 200. The validation workflow is the bot's, with actions/checkout pinned to the same commit the other workflows use and an explicit read-only permissions block, matching the hardening in 81b02b1. Signed-off-by: rocklambros <rock@rockcyber.com>
rocklambros
requested review from
GangGreenTemperTatum,
afogel,
almogbhl,
bar-capsule,
fewdisc,
mamicidal,
sclintonowasp and
stefanoamorelli
as code owners
September 5, 2026 14:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
OWASP Nest indexes projects from a
project.owasp.yamlin the project repo. This repo has never had one onmain, so the OWASP index holds no current metadata for ACS and the retired Agent Observability Standard page stands as the canonical public listing.An
owasp-nest[bot]push on 2025-10-02 creatednest/owasp-agent-observability-standard-metadatawith a generated draft. No PR was ever opened from it, so it went unreviewed, and the AOS → ACS rebrand landed six months later without it. That branch is now 1 ahead / 23 behind.Why the draft wasn't salvageable
Untouched generator placeholders. It also used the retired project name, pointed
websiteat the retiredowasp.orgpage, listed both superseded OWASP repos includingwww-project-agent-observability-standard-2, and carried a leader email address.This file is written fresh against the current project.
What changed versus the draft
namewebsiteowasp.orgpageagentcontrolstandard.orgrepositoriesleaderslicenseApache-2.0Apache-2.0+CC-BY-SA-4.0communityaos.owasp.orgpitch/tagsaudiencepersonrequires onlynamein the schema, so leaders carry no email — consistent with #41.Verification
owasp/nest-schemaproject.json+common.jsonactions/checkoutpinned to the same SHA as the other workflows, explicit read-onlypermissions, per 81b02b1Two things to confirm
level: 2is also carried over unchanged.The stale bot branch is deleted separately.