Skip to content

Commit a21e044

Browse files
kelkalotkelkalot
authored
code owners and governance
added code owners and governance details
1 parent a69f8da commit a21e044

2 files changed

Lines changed: 159 additions & 0 deletions

File tree

‎CODEOWNERS‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# SimpleAudit — CODEOWNERS
2+
#
3+
# GitHub uses this file to auto-request reviews from the right people when a PR
4+
# touches matching paths. See GOVERNANCE.md for the roles behind these owners.
5+
#
6+
# IMPORTANT:
7+
# * The file must be named exactly "CODEOWNERS" (no extension) and live at the
8+
# repo root, in .github/, or in docs/. Recommended: .github/CODEOWNERS
9+
# * Every owner listed must be a repository collaborator with write access,
10+
# otherwise GitHub silently ignores that entry.
11+
# * Later matches override earlier ones.
12+
#
13+
# Syntax: <path-pattern> @owner [@owner ...]
14+
15+
# ---------------------------------------------------------------------------
16+
# Default owner for everything
17+
# ---------------------------------------------------------------------------
18+
* @kelkalot
19+
20+
# ---------------------------------------------------------------------------
21+
# Co-maintainers — uncomment and verify each GitHub handle + write access.
22+
# (Add maintainers from GOVERNANCE.md once their handles are confirmed.)
23+
# ---------------------------------------------------------------------------
24+
# * @kelkalot @sushantgautam
25+
26+
# ---------------------------------------------------------------------------
27+
# Domain-specific ownership — fill in handles, then uncomment.
28+
# These route reviews to the people responsible for sensitive areas.
29+
# ---------------------------------------------------------------------------
30+
31+
# Core auditing / judge engine (methodology-sensitive)
32+
# /simpleaudit/ @kelkalot
33+
34+
# Health / clinical scenarios & judges (Norwegian Directorate of Health advisors)
35+
# /simpleaudit/scenarios/health.py @kelkalot # + <health-advisor>
36+
# /simpleaudit/scenarios/helpmed.py @kelkalot # + <health-advisor>
37+
# /simpleaudit/scenarios/bullshitbench_health.py @kelkalot
38+
# /simpleaudit/judges/helsedir_sexhealth_no.py @kelkalot
39+
# /simpleaudit/judges/helsedir_sexhealth_no_rag.py @kelkalot
40+
41+
# Youth-domain scenario packs (provenance-sensitive)
42+
# /simpleaudit/scenarios/ung.py @kelkalot
43+
# /simpleaudit/scenarios/hei_refusal.py @kelkalot
44+
45+
# Norwegian public-sector packs
46+
# /simpleaudit/scenarios/nav_aap.py @kelkalot
47+
# /simpleaudit/scenarios/skatteetaten.py @kelkalot
48+
49+
# Governance, security & policy docs
50+
# /GOVERNANCE.md @kelkalot
51+
# /SECURITY.md @kelkalot
52+
# /CODE_OF_CONDUCT.md @kelkalot
53+
# /DPG.md @kelkalot

‎GOVERNANCE.md‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# SimpleAudit Governance
2+
3+
This document describes how the SimpleAudit project is governed — who maintains
4+
it, how decisions are made, and how to participate. It complements the
5+
[Code of Conduct](./CODE_OF_CONDUCT.md), the [Security Policy](./SECURITY.md),
6+
and the contribution guidance in the [README](./README.md).
7+
8+
SimpleAudit is an open-source (MIT) AI safety auditing framework and a
9+
[verified Digital Public Good](https://www.digitalpublicgoods.net/r/simpleaudit).
10+
It is stewarded by Simula Research Laboratory (Simula) and SimulaMet, and
11+
developed in collaboration with the Norwegian Directorate of Health.
12+
13+
## Governance model
14+
15+
SimpleAudit follows a **maintainer-led model with institutional stewardship**.
16+
Day-to-day direction rests with a small group of maintainers drawn from the
17+
stewarding institutions; anyone may contribute. There is currently no separate
18+
board or steering committee — decisions are made by the maintainers, in the
19+
open, on GitHub. This document is the source of truth for that model and is
20+
versioned with the project.
21+
22+
## Roles and responsibilities
23+
24+
### Lead maintainer / steward
25+
Sets overall direction, has the final say where consensus cannot be reached,
26+
and is the primary point of contact.
27+
28+
- **Michael A. Riegler** (Simula) — `@kelkalot` · michael@simula.no
29+
30+
### Maintainers
31+
Review and merge contributions, triage issues, cut releases, and uphold the
32+
Code of Conduct. Maintainers have write access to the repository.
33+
34+
- Sushant Gautam (SimulaMet)
35+
- Finn Schwall (Simula)
36+
- Annika Willoch Olstad (Simula)
37+
- Klas H. Pettersen (SimulaMet)
38+
- Sunniva Bjørklund (Hdir)
39+
40+
### Domain advisors
41+
Provide expert review for specialised content — clinical/health scenarios,
42+
Norwegian public-sector and youth domains, and safety policy — advising on
43+
correctness and appropriateness within their domain.
44+
45+
- Sunniva Bjørklund, Maja Gran Erke, Hilde Lovett (Norwegian Directorate of
46+
Health) — health / clinical content
47+
- Tor-Ståle Hansen (Ministry of Defence, Norway) — safety / public-sector
48+
49+
### Contributors
50+
Anyone who opens an issue or pull request. Contributors do not need write
51+
access; their changes are merged after maintainer review.
52+
53+
## Decision-making
54+
55+
- **Routine changes** (bug fixes, documentation, new scenario packs or judge
56+
configs, dependency bumps): handled through pull requests. A PR may be merged
57+
once it has at least one approving review from a maintainer (or the relevant
58+
code owner) and CI passes. Small, low-risk changes may use *lazy consensus* —
59+
if no maintainer objects within a reasonable window, the change proceeds.
60+
- **Significant changes** (breaking API changes, methodology changes, new
61+
external dependencies, or anything affecting data provenance or safety
62+
posture): proposed and discussed in a GitHub Issue or PR before merging, so
63+
maintainers and affected domain advisors can weigh in. The goal is consensus
64+
among active maintainers.
65+
- **Tie-breaking**: where maintainers cannot reach consensus, the lead
66+
maintainer makes the final decision, recorded in the relevant issue or PR.
67+
- **Transparency**: substantive decisions are made and recorded in public
68+
issues and pull requests.
69+
70+
## Contribution & review process
71+
72+
1. For non-trivial changes, open an issue to discuss first (optional for small
73+
fixes).
74+
2. Submit a pull request and ensure CI (tests) passes.
75+
3. Reviews are requested automatically from the relevant owners via
76+
[`CODEOWNERS`](./.github/CODEOWNERS); at least one maintainer / code-owner
77+
approval is required to merge.
78+
4. Health/clinical, Norwegian-domain, and other safety-sensitive changes should
79+
additionally be reviewed by a relevant domain advisor.
80+
81+
See the README "Contributing" section for current areas of interest.
82+
83+
## Becoming a maintainer
84+
85+
Contributors who have made sustained, high-quality contributions and shown good
86+
judgement may be invited to become maintainers by consensus of the existing
87+
maintainers. Maintainers who become inactive may move to emeritus status, with
88+
write access adjusted accordingly. Changes to the maintainer list are made via a
89+
pull request to this document.
90+
91+
## Releases
92+
93+
SimpleAudit uses semantic versioning, is published to
94+
[PyPI](https://pypi.org/project/simpleaudit/), and tags releases on GitHub. Any
95+
maintainer may cut a release once `main` is green.
96+
97+
## Code of Conduct & Security
98+
99+
All participation is governed by the [Code of Conduct](./CODE_OF_CONDUCT.md).
100+
Security vulnerabilities are handled per the [Security Policy](./SECURITY.md).
101+
102+
## Amending this document
103+
104+
Changes to governance are proposed via pull request and require approval from
105+
the lead maintainer plus at least one other maintainer. The change history is
106+
tracked in version control.

0 commit comments

Comments
 (0)