Skip to content

Access Continuity Plan

ZapTrace currently operates as a solo-maintainer project. This document states the continuity model honestly so OpenSSF evidence does not imply stronger governance than the project has.

Current state

Capability Current owner Continuity status
Repository administration @oaslananka Single-maintainer risk
Issue triage and closure @oaslananka Single-maintainer risk
Pull request merge authority @oaslananka Single-maintainer risk
Release creation @oaslananka Automated workflow exists; trigger authority is single-maintainer
Private vulnerability report handling @oaslananka Single-maintainer risk
Package/registry publishing Not automated pre-1.0 No public package continuity claim

Public mitigations already in place

  • Source code, issues, pull requests, roadmap, security policy, CI workflows, and release process are public.
  • Release artifacts are generated by reproducible GitHub Actions workflows.
  • Branch protection and required checks document the expected quality gate.
  • GOVERNANCE.md, MAINTAINERS.md, and SUPPORT.md identify roles, responsibilities, support scope, and limitations.

Required before claiming full continuity

ZapTrace must not claim full access-continuity maturity until at least one of the following is true:

  1. A trusted backup maintainer has documented repository, issue, release, and security-triage access.
  2. A trusted emergency steward has documented recovery access and legal authority to continue the project.
  3. The project transfers stewardship to an organization with documented admin continuity.

Emergency steward expectations

A backup maintainer or emergency steward must be able to, within one week of confirmed maintainer unavailability:

  • create and close issues;
  • review and merge pull requests;
  • run or trigger release workflows;
  • publish security advisories or coordinate vulnerability disclosure;
  • rotate compromised credentials and remove unsafe access;
  • update this continuity plan.

Badge evidence guidance

For OpenSSF Best Practices, access_continuity and bus-factor-related criteria should remain Unmet or Partial until the backup-maintainer or emergency-steward requirement is actually satisfied. The project can still use this document as evidence that the risk is identified and managed transparently.