[dmealing]

What Changed

• Added GOVERNANCE.md: defines three roles (contributor, port maintainer, core maintainer); how rights are earned (about 5 merged PRs and 2 months of reviews for port maintainer, with separate publish rights for a port's registry packages); lazy-consensus decisions, with model-format, ADR, compatibility-policy and release changes needing core-maintainer approval; the creator's tie-break and veto, limited to the model format, ADRs and releases; ownership of the GitHub org, package namespaces and trademark staying with Doug Mealing LLC; and a written succession clause for when the creator steps away.
• Added MAINTAINERS.md: lists core maintainers, the maintained areas (all currently "Maintainer wanted"), and the registry owners per port (npm, Maven Central, NuGet, PyPI), with co-owners to be added as they earn it.
• Linked both files from README.md (contributing section) and CONTRIBUTING.md (intro and review step).

Policy choices for review (beyond what the positioning reports state)

GOVERNANCE.md

1. Publish rights: granted after one release of that port as port maintainer, with 2FA on the registry account and a walkthrough of docs/RELEASING.md with a core maintainer.
2. Core maintainer: at least 6 months as a port maintainer, by invitation, with all existing core maintainers agreeing.
3. Lazy consensus timing: no fixed wait for a PR inside one area; 3 days for a change across areas; an objection needs a reason to block.
4. No self-approval once an area has a second maintainer (the sole maintainer self-merges until then).
5. Disputes: core maintainers decide by majority; the creator breaks an even split only on the model format, ADRs and releases; on any other subject (and among successor core maintainers) an even split leaves the status quo in place.
6. The compatibility policy and GOVERNANCE.md itself added to the list of changes needing core-maintainer approval.
7. The metaobjects.dev and metaobjects.com domains included in what Doug Mealing LLC owns.
8. Contributors keep copyright; no CLA or assignment (states the current Apache 2.0 inbound=outbound practice).
9. Paid work or sponsorship grants no role, vote or review exception. No paid work is promised to anyone.
10. Succession: triggered by a written statement or 6 months with no commits, reviews or replies; the LLC gives remaining core maintainers org admin and registry owner access; if none, port maintainers elect core maintainers; if no maintainers, README marks the project unmaintained; the veto does not pass on; ownership stays with the LLC.
11. Stepping down: access removed within a week. Inactivity: 6 months, then one month to reply, then Emeritus; can return on request.
12. Removal: for a Code of Conduct breach or misuse of rights; core-maintainer majority excluding the person; any core maintainer can suspend compromised access at once, with a restore decision within two weeks.
13. Changing GOVERNANCE.md: PR open 2 weeks, every core maintainer approves; the Ownership section needs Doug Mealing LLC's agreement.

MAINTAINERS.md
14. The 11 areas, including Kotlin as its own area separate from Java, and spec/ + fixtures/ as one area that always needs core approval.
15. Registry owners as read on 2026-10-28: npm user dougmealing on all 14 published packages; PyPI Owner dougmealing; NuGet organization metaobjects; Maven Central com.metaobjects via the creator's Sonatype Central account and GPG key; GitHub org has one member, dmealing.

Good-first-issues filed (label: good first issue)

#485, #486, #487, #488, #489, #490, #491, #492, #493, #494. They are GitHub issues only; this PR does not change code for them.

Skipped from the report's list:

• meta gen on an unknown attribute: it now warns and exits 0 (cli/src/commands/gen.ts:195-204); making it fail changes exit codes for adopters, a maintainer call. No "audit file" exists.
• TS api-docs documenting routes without a routes generator: PR fix(codegen-ts): api reference follows routes generator filter #462 fixed most of it; the rest needs a design choice (telling "no generator" from an ejected copy).
• llms.txt and the api-docs "Model / metadata" link: being fixed upstream.
• The Python mypy item was split in two (Python routers: the repository Protocol's list method shadows the builtin list under mypy --strict #486, Python routers: fix handler return annotations so mypy --strict passes #487): 129 errors on the fitness fixture, not 8.

Validation: one no-mistakes run (docs-only tier: test, lint, document and CI skipped). Review found 3 warnings: the tie-break scope conflict was fixed by the pipeline; the veto and the stepping-down, paid-work and no-CLA text were kept by maintainer decision and are listed above for review.

Validation

Risk Assessment

✅ Low: Docs-only change. The round-1 fix is verified: the tie-break is scoped to the model format, ADRs and releases, and an even split elsewhere or during succession leaves the status quo. The linked files, paths and package names in the new text exist in the repo. The listed policy choices are deliberate maintainer decisions.

Testing

• ⏭️ Test - skipped

Pipeline

Updates from git push no-mistakes

✅ **Intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 2 warnings

• ⚠️ GOVERNANCE.md:82 - Two sections give conflicting scope for the creator's tie-break. Line 81-82 says that when core maintainers split evenly on any disagreement, 'the creator decides'. Line 104-110 says the tie-break is limited to three subjects (model format, ADRs, releases), and that elsewhere the creator has one vote like any other core maintainer. The intent requires the tie-break and its scope to be stated. A reader cannot tell which sentence governs a 1-1 split over, say, a port-area dispute. Fix: scope line 82 to those three subjects, or point to the tie-break section and say what happens on an even split elsewhere. The succession step at line 139 says the tie-break passes 'to a majority vote', which is not a tie-break and does not resolve an even split.
• ⚠️ GOVERNANCE.md:111 - The creator veto is a component the intent does not require. The intent asks for 'the creator's tie-break and its scope'. A unilateral veto over the model format, ADRs and releases is a separate and stronger power. It lets the creator overrule a core-maintainer majority, so a tie-break is never needed on those subjects. It also undercuts the second-maintainer assurance that the document exists to give. Smallest honest remedy: remove the Veto bullet (and the 'creator's veto does not pass' clause at line 148), keep only the scoped tie-break. If the veto is deliberate, the author should confirm it.
• ⚠️ GOVERNANCE.md:151 - The change adds binding policy beyond the intent's list (roles, how rights are earned, merge and publish rights, lazy consensus, model-format and ADR approval, tie-break, ownership, succession). None of these is in the intent. The 'Stepping down and removal' section (line 151-174) adds inactivity rules, removal rules and an emergency access-suspension power with a two-week review. The Ownership section adds a 'Paid work or sponsorship' clause (line 129) and a statement that there is no copyright assignment and no CLA (line 124-127). The CLA statement is a new licensing position, and CONTRIBUTING.md line 127-130 only says contributions are licensed under Apache-2.0. Smallest remedy: remove these components, or have the author confirm each one.

🔧 Fix applied.
2 warnings still open:

• ⚠️ GOVERNANCE.md:111 - The creator veto is a component the intent does not require. The intent asks for 'the creator's tie-break and its scope'. A unilateral veto over the model format, ADRs and releases is a separate and stronger power. It lets the creator overrule a core-maintainer majority, so a tie-break is never needed on those subjects. It also undercuts the second-maintainer assurance that the document exists to give. Smallest honest remedy: remove the Veto bullet (and the 'creator's veto does not pass' clause at line 148), keep only the scoped tie-break. If the veto is deliberate, the author should confirm it.
• ⚠️ GOVERNANCE.md:151 - The change adds binding policy beyond the intent's list (roles, how rights are earned, merge and publish rights, lazy consensus, model-format and ADR approval, tie-break, ownership, succession). None of these is in the intent. The 'Stepping down and removal' section (line 151-174) adds inactivity rules, removal rules and an emergency access-suspension power with a two-week review. The Ownership section adds a 'Paid work or sponsorship' clause (line 129) and a statement that there is no copyright assignment and no CLA (line 124-127). The CLA statement is a new licensing position, and CONTRIBUTING.md line 127-130 only says contributions are licensed under Apache-2.0. Smallest remedy: remove these components, or have the author confirm each one.

⏭️ **Test** - skipped

Step was skipped.

⏭️ **Document** - skipped

Step was skipped.

⏭️ **Lint** - skipped

Step was skipped.

✅ **Push** - passed

✅ No issues found.