A documented statement says who decides, and what happens if they stop
A contributor weighing whether to invest in a project and a user weighing whether to depend on it are asking the same two questions: who can merge and release, and does this survive its current maintainers. Leaving both unanswered does not read as informality, it reads as a project nobody has thought past this week.
Observable check
a tracked file states how decisions get made and who makes them, and says what becomes of the project if the current maintainers stop, whether that is a named successor, an organization or foundation holding the repository, or a plain statement that the project has one maintainer and no succession arranged. A single-maintainer project satisfies this rule by saying so; naming a second maintainer is not required.
Where this comes from
- https://www.bestpractices.dev/en/criteria/1
- https://best.openssf.org/Concise-Guide-for-Developing-More-Secure-Software.html
Last read against these sources on 2026-07-28.
OpenSSF Best Practices badge Silver carries both halves as MUSTs: governance, 'clearly define and document its project governance model (the way it makes decisions, including key roles)', and access_continuity, the project 'be able to continue with minimal interruption if any one person dies, is incapacitated, or is otherwise unable or unwilling to continue'. Concise Guide item 25 says the same in one line. bus_factor, having more than one maintainer, is only a SHOULD upstream, which is why this rule asks a solo project to state its position rather than fail it.