Record current leadership and reconcile the governance files - #44
Merged
Merged
Conversation
83f5632 carried leadership over from the owasp-nest[bot] draft unchanged and flagged it for confirmation against the current project. This commit confirms it. Rock Lambros joins Michael Bargury and Ory Segal in leaders. The current structure is a project lead over five workstreams with two leads each, nine people in total. None of it fits project.owasp.yaml. The nest-schema sets additionalProperties false with no field for a founding credit, caps leaders at five entries, and gives Person only name, email, github, and slack, so no role or workstream can be attached to a person. GOVERNANCE.md carries what the schema cannot. It names the project lead, the five workstreams and their leads, and credits Michael Bargury and Ory Segal as the creators of ACS. Both remain project leaders, which is why they stay in the leaders list rather than moving to a credit-only mention. The file also states why the two rosters differ, so the next person to read them does not treat the shorter one as stale and reconcile in the wrong direction. Two names arrived carrying Slack profile artifacts, "(Mobile)" on Eva Benn and a bracketed project list on Aruneesh Salhotra. Both are stripped. GitHub handles are verified against the profile API rather than guessed. Eight of nine resolve and every profile URL returns 200. Richard Bird is listed by name alone. Four accounts carry that name and none matches, and a wrong handle attributes a real person's work to a stranger. The leadership-change procedure requires CODEOWNERS to move with the roster. A lead who loses write access stops being a valid owner and GitHub fails the entry silently, so a stale CODEOWNERS drops review coverage without reporting it. This commit does not touch CODEOWNERS, since adding an entry there implies granting write access. Validated against owasp/nest-schema project.json and common.json. Signed-off-by: rocklambros <rock@rockcyber.com>
The previous commit recorded nine workstream leads in GOVERNANCE.md but left CODEOWNERS at the six who were already there. Eva Benn, Richard Bird, and Aruneesh Salhotra lead workstreams that touch the specification, so they belong on the paths that own it. They join the three broad sections only, matching where the other workstream leads sit. The /.github/, licensing, and SECURITY.md lines stay with the admin subset, since CI configuration is a privilege-escalation surface and licensing is a foundation-level decision. All three were invited to write access in the same change. An invitation grants nothing until the invitee accepts, so their entries are inert until then and the header says so. The other owners on those lines still apply, so review coverage does not drop while the invitations are open. The header previously claimed everyone listed has write access. That became false the moment these three were added, so it now states the requirement and the failure mode instead of asserting the state. Richard Bird's handle is confirmed as RbBuiltWrong and backfilled into GOVERNANCE.md, which listed him by name alone. Every handle in CODEOWNERS resolves to a live profile. Signed-off-by: rocklambros <rock@rockcyber.com>
rocklambros
requested review from
GangGreenTemperTatum,
afogel,
almogbhl,
bar-capsule,
fewdisc,
mamicidal,
sclintonowasp and
stefanoamorelli
as code owners
September 5, 2026 17:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Records the current ACS leadership and brings the three governance files into agreement.
project.owasp.yaml—leadersbecomes Rock Lambros, Michael Bargury, Ory Segal. 83f5632 carried the leader list over from the owasp-nest[bot] draft unchanged and flagged it for confirmation. This confirms it.GOVERNANCE.md(new) — the authoritative roster: project lead, five workstreams with two leads each, and the founding credit to Michael Bargury and Ory Segal..github/CODEOWNERS— adds Eva Benn, Richard Bird, and Aruneesh Salhotra to the three broad sections.Why the roster is split across two files
The full structure does not fit
project.owasp.yaml. The OWASP nest-schema:additionalProperties: falsewith no field for a founding creditleadersatmaxItems: 5, and the roster names nine peoplePersononlyname,email,github,slack, so no role or workstream attaches to a personSo the YAML names three and
GOVERNANCE.mdcarries the rest. Both files say why they differ, so the next reader does not treat the shorter list as stale and reconcile in the wrong direction.Michael and Ory stay in
leadersrather than moving to a credit-only mention. There is no field the schema would accept for that, and both remain project leaders.Write access
Eva Benn, Richard Bird, and Aruneesh Salhotra were invited to write access alongside this change. An invitation grants nothing until accepted, so their CODEOWNERS entries are inert until each accepts. The other owners on those lines still apply, so review coverage does not drop meanwhile.
The header previously asserted "Everyone below has write access." That became false when these three were added, so it now states the requirement and the silent-failure mode instead.
CI configuration, licensing, and
SECURITY.mdstay with the admin subset. Those are privilege-escalation and foundation-level surfaces.Verification
project.owasp.yamlvalidates againstowasp/nest-schemaproject.jsonandcommon.jsonunder Draft 7GOVERNANCE.mdreturns 200@RbBuiltWrongand backfilled intoGOVERNANCE.md(Mobile)on Eva Benn, and a bracketed project list on Aruneesh SalhotraNot in this PR
CODEOWNERS lists
@GangGreenTemperTatum,@mamicidal, and@sclintonowasp, none of whom appear in the leadership roster. Not necessarily wrong, but the two lists have diverged and that is worth a separate look.