Repository navigation
Community maintainer handover: who reviews and merges what #60
Description
OPAQUE wound down on 2026-10-12. Qiang, Satish and the other OPAQUE accounts are leaving the org, and from here AgenTrust runs on community maintainers. I stay on as Project Lead. Today there are 92 open PRs across the repos, and until now almost every review needed one of the people who are leaving.
These are the slots, based on who has actually been reviewing and merging:
| Repo | Primary | Backup |
|---|---|---|
| trace-spec, trace-registry | @lywinged | @rajnisht7 |
| agent-manifest | @rajnisht7 | @carloshvp |
| cmcp, ca2a | @carloshvp | @zohebk8s |
| integrations | @carloshvp | @rajnisht7 |
| weight-custody-manifest | @zohebk8s | @dinakarjs |
| .github, agentrust-telemetry, awesome-ai-governance, site | @rajnisht7 | @carloshvp |
The primary takes routine review. If nothing happens in two business days, it goes to the backup. Release environments stay as they are for now.
@rajnisht7 also becomes an org owner. @AaronRoeF and @podcastinator stay on as org owners alongside him and me.
@dinakarjs, this skips the 60-day Reviewer period on my call as Project Lead, based on 38 merged PRs since 10-01. Two questions before it takes effect: who is behind the account, and are the PRs written by an agent you supervise? Either answer is fine. Reviewers need to know who they are working with.
Reviewer invitations: @noah-ing (17 merged PRs) and @chernistry (14 merged PRs). Reviewers review and triage. After 60 days of that, a Reviewer can be nominated as maintainer. @altrudev, a company account cannot hold a maintainer role, so please name the individual account you would like considered.
Please reply here with accept, decline, or a swap. A reply here is the acceptance record that maintainers/handover.md asks for.
The roster change lands in a .github PR, plus one PR per repo for maintainers.json, CODEOWNERS and MAINTAINERS.md. Grouped Dependabot updates are already open in eight repos (cmcp#756, trace-spec#513 and six more) and are the quickest queue to clear first.
Qiang Xu and Trish Avila move to emeritus. Rishabh Poddar and Aaron Fulkerson step back from review but stay org owners. Qiang alone reviewed 107 PRs between 09-14 and 10-08.
Activity
noah-ing commentedon Oct 14, 2026
Accept—thanks, Imran. Happy to join as a Reviewer and help with reviews and triage.
rajnisht7 commentedon Oct 14, 2026
Happy to accept! Thank you for putting this together. Looking forward to work more closely with community, helping with reviews, maintenance, and contributing more to the project. Excited to be part of this next phase and building great things together!
governance: hand maintainer coverage to community maintainers (#149)
governance: hand maintainer coverage to community maintainers (#101)
imran-siddique commentedon Oct 14, 2026
Thanks @rajnisht7, you're an org owner now as well.
First queue, all green and all within your access: the handover snapshots in agent-manifest#504, trace-spec#514, trace-registry#133, agentrust-telemetry#90 and integrations#318, then the Dependabot grouping PRs in the same repos (#503, #513, #132, #89, #317). Those need approve and merge like anything else. After they land, new Dependabot PRs queue auto-merge and only need your approval, except in trace-registry, which has no review rule yet.
Anything that looks off in a snapshot, flag it here rather than merging around it.
carloshvp commentedon Oct 14, 2026
Accept, thanks @imran-siddique. I’ll take primary coverage for cmcp, ca2a and integrations, and backup coverage for agent-manifest, .github, agentrust-telemetry, awesome-ai-governance and the site, as proposed.
I’ll start by reviewing the handover snapshots and grouped Dependabot PRs in my primary repos, coordinate with @zohebk8s and @rajnisht7, and flag any access gaps or snapshot concerns here.
Thanks to Qiang, Trish, Rishabh and Aaron for their work on AgenTrust.
Very interesting new phase of the project and the key contributors and excited to be part of it.
dinakarjs commentedon Oct 15, 2026
Thank you, Imran. @dinakarjs is operated by me, Srinivasa Dinakar Jainti. My background includes 18+ years in pre-silicon verification and system design, including formal verification and evidence-based validation.
I use AI agents under my supervision. I define the approach and code structure, guide implementation, and review the produced code and validation results. AI assists with implementation, investigation, testing, and drafting; I remain responsible for submitted changes and claims. Validation limitations are documented in the PRs.
I accept the proposed backup-maintainer role for weight-custody-manifest, alongside @zohebk8s as primary, including taking up reviews left untouched for two business days. Thank you for recognizing my contributions and waiving the Reviewer period.
I’ll coordinate with @zohebk8s and flag access gaps or handover concerns here.
altrudev commentedon Oct 15, 2026
Hi Imran, thanks for considering me.
To clarify,
@altrudevis my personal GitHub user account, operated by me, Val Rukhaylo. Altru.dev is my independent project, not a separate team operating this account.I'm interested in understanding the opportunity before accepting an ongoing responsibility. Which repository and role did you have in mind for me: reviewer, primary maintainer, or backup? What is the expected time commitment and response cadence? Would a limited, asynchronous scope focused on technical review, security, and verification be workable alongside my independent Frequency development and commercial work?
I appreciate the invitation and would be glad to discuss a realistic scope before confirming any role.
altrudev commentedon Oct 15, 2026
One additional question before I decide on the role: following OPAQUE's transition and the reported Anthropic agreement, what continuing engineering, infrastructure, and financial support, if any, is committed to AgenTrust? Is the community expected to sustain the repositories and releases independently, or will OPAQUE or Anthropic provide ongoing support? I ask to understand the long-term sustainability and realistic scope of an unpaid maintainer commitment. Thanks.
lywinged commentedon Oct 15, 2026
Accept, thanks. Primary for trace-spec and trace-registry, with @rajnisht7 as backup, as proposed.
The snapshots there, trace-spec#514 and trace-registry#133, list @rajnisht7 and me as the table does. One line may now claim too much: trace-registry's MAINTAINERS.md still says "Maintainers hold publish rights on the
trace-verifypackage", while release environments, and so who can publish, stay as they are.Of the first queue in those two repos, trace-spec#513 is the one still open. @rajnisht7 reviewed it and asked for two changes:
synchronizein the triggers, and auto-merge only for minor and patch updates. trace-spec#523 from @dinakarjs makes both. In trace-spec, #523 is built on #513's branch, so if #513 is squash-merged first, #523 no longer applies cleanly to main. I'll review trace-spec#523.Until trace-registry has a review rule, any merge I make there will meet what maintainers/handover.md asks, including a current-head approval from a maintainer who is neither the author nor the last pusher.
imran-siddique commentedon Oct 15, 2026
@altrudev thanks Val, that settles the account question.
The offer is Reviewer on trace-spec, where 16 of your 32 merged PRs landed, plus cmcp if you like. Reviewers work at their own pace; the two-business-day routing above binds primaries and backups only. After 60 days a Reviewer can be nominated as maintainer.
On support: AgenTrust is an independent open-source project, not tied to any company. No company funds, staffs or directs it. Every contribution is voluntary and interest-based, and the maintainers in the table above sustain the repos and releases.
chernistry commentedon Oct 15, 2026
Accept, thanks @imran-siddique. I'll review and triage in trace-spec, where 10 of my 14 merged PRs landed, and in trace-registry if that helps.
altrudev commentedon Oct 15, 2026
governance: hand maintainer coverage to community maintainers (#61)
governance: hand maintainer coverage to community maintainers
governance: hand maintainer coverage to community maintainers
imran-siddique commentedon Oct 15, 2026
Carrying over from #55, which is now closed. Three things are still open. Owner and recovery coverage needs a private check for both owners, imran-siddique and rajnisht7. We still need seven days of routine review and merges by at least two non-Imran maintainers, with the merge operator linked for each. And a non-Imran release operator has to validate a package build and install, with a working backup path.
zohebk8s commentedon Oct 15, 2026
@imran-siddique Accept, thanks Imran. I’m happy to take primary maintainer responsibility for WCM and backup coverage for cMCP and cA2A, as proposed. I’ll coordinate with Dinakar and Carlos on reviews. Thank you for the trust.
imran-siddique commentedon Oct 15, 2026
@chernistry @altrudev thanks, both recorded: trace-spec#529 lists you as Reviewers, and trace-registry#137 adds Alex there too. cmcp's Reviewers section is created by cmcp#757, which is waiting on review, so Val's cmcp row goes in after it merges.
@lywinged, trace-registry#137 also replaces the publish-rights line. Publishing goes through the
pypirelease environment, which the handover left as it was.imran-siddique commentedon Oct 15, 2026
@lywinged you were right about the publish line. trace-registry#137 now says publishing
trace-verifyruns through thepypirelease environment, whose approvers are set separately from this list. agent-manifest#510 and weight-custody-manifest#199 made the same correction. agent-manifest had no gate at all: itspypienvironment did not exist, so any account with write could publish on apython-v*tag. That environment now exists with a required reviewer and apython-v*tag rule.