Operate project maintenance + sustainability + supply chain integration per OpenSSF Scorecard + broader supply chain security frameworks. Maintained Project must (a) maintain regular commits + releases + issue triage + (b) avoid project becoming abandoned + (c) plan succession + maintainer onboarding + (d) coordinate with OpenSSF Alpha-Omega + similar sustainability initiatives where applicable. Integration with broader supply chain security must (a) align with NIST SP 800-161 SCRM + SLSA + S2C2F + Sigstore + (b) integrate Scorecard with broader OSPO + procurement + dependency review processes + (c) feed Scorecard signals into vulnerability management + (d) coordinate with downstream consumers on security improvements. Maintain project documentation + onboarding + community guidelines + Code of Conduct + with broader governance per CHAOSS metrics + Linux Foundation project governance + similar.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.