Add microcks - Governance Review

[krol3]

The governance review required in the issue#2035
Draft notes here: https://hackmd.io/@krol/SJLahh_9Wg

/closes #2035

[angellk]

@krol3 please fix so the governance review isn't under the security reviews folder

[krol3]

@krol3 please fix so the governance review isn't under the security reviews folder

Thank you. It was fixed.

[joshgav]

@krol3 can you remove the changes within the "security-assessment" folder? Then I think this is ready for merge.
Did you have any additional comments @yada or @angellk?

[yada]

@joshgav, all good on our side. We’ll refer back to this review as we address its recommendations. Thank you.

Update — September 7, 2026: Following the approval of the governance review, we are now starting the follow-up work. We’ll add a separate comment to this PR for each suggested improvement once it is completed.

[joshgav]

I fixed so the PR doesn't touch the security-assessment folder anymore.
With that I think we are good to merge.
Thank you @krol3!

[brandtkeller]

lgtm - great governance review for Microcks.

[brandtkeller]

Agree with this and the overlays it has for vendor neutrality - there may need to be provisions for number of votes allowed per organization to obtain the supermajority acceptance.

[yada]

✅ Organization-balanced voting implemented

Thanks @brandtkeller for the recommendation. Microcks has adopted organization-balanced voting for formal governance decisions, using one vote per affiliation regardless of Maintainer
headcount.

Routine technical decisions remain under lazy consensus and individual Maintainer authority. Formal governance decisions now require a two-thirds majority of all eligible organizational
votes, ensuring that no single organization can control the project’s governance alone.

The change was approved by all three current Maintainers, representing both Postman and AXA France:

• Vote result: 3 of 3 Maintainers — 100% approval
• Implementation: docs: adopt organization-balanced governance voting microcks/.github#93
• Merge commit: microcks/.github@10a7fda
• Governance policy: https://github.com/microcks/.github/blob/main/GOVERNANCE.md#decision-making-and-voting
• Maintainer affiliations: https://github.com/microcks/.github/blob/main/MAINTAINERS.md

Following the merge, GOVERNANCE.md and MAINTAINERS.md were successfully replicated across all Microcks repositories where these organization-wide governance files apply:

https://github.com/microcks/.github/actions/runs/34251534743

[yada]

Following the approval of the governance review, we are now starting the follow-up work. We’ll add a separate comment to this PR for each suggested improvement once it is completed.

[yada]

✅ Secure vulnerability reporting

Addressed in Microcks .github PR #94.

The updated security policy now requires private reporting through security@microcks.io, establishes acknowledgement within five business days, defines a 90-day coordinated-disclosure
target, and clarifies remediation and Security Team responsibilities.

Final policy: https://github.com/microcks/.github/blob/main/SECURITY.md
Replication: https://github.com/microcks/.github/actions/runs/34286520276

The policy was successfully replicated to the Microcks repositories where it is needed and relevant.

[yada]

✅ Completed the Code of Conduct escalation update in microcks/.github#95.

The Maintainer vote passed, the PR was merged, and the updated CODE_OF_CONDUCT.md and GOVERNANCE.md files were successfully replicated to Microcks repositories where needed and relevant:
https://github.com/microcks/.github/actions/runs/34543115542

[yada]

✅ Project and repository inventory

Completed in microcks/.github#96.

The organization-balanced Maintainer vote passed, and the PR was merged. SUBPROJECTS.md now provides the canonical inventory of Microcks repositories, including their scope, lifecycle, ownership, and CLOMonitor coverage.

Canonical inventory: https://github.com/microcks/.github/blob/main/SUBPROJECTS.md
Governance reference: https://github.com/microcks/.github/blob/main/GOVERNANCE.md
Successful replication: https://github.com/microcks/.github/actions/runs/34591435051

The updated GOVERNANCE.md was successfully replicated to Microcks repositories where needed and relevant. SUBPROJECTS.md remains centralized in the .github repository.