Wave 4J: file OpenSSF sandbox application

[kenithphilip]

Tracking issue for OpenSSF foundation transition

Per ADR-0003 the v1.1 transition is to OpenSSF as a sandbox-tier project.

Drafts

• docs/governance/foundation_proposal_v1_1.md (rationale)
• docs/governance/openssf_sandbox_application.md (the actual application form contents to paste into the OpenSSF intake)

Submission steps

1. Solicit a TAC sponsor in #project-lifecycle on OpenSSF Slack
2. Submit the sandbox application via https://openssf.org/projects/
3. Once accepted, file follow-on PRs for OpenSSF Charter / CoC adoption per Step 1 of the transition plan in foundation_proposal_v1_1.md
4. Run public CFP for Steering Committee (3-5 members) for 30 days

Status

The application content is locked. Step 1 (TAC sponsor solicitation) requires the maintainer to post in OpenSSF Slack.

[kenithphilip]

Pre-written Slack solicitation message added at docs/governance/openssf_slack_post.md. Paste verbatim into OpenSSF #project-lifecycle when you're ready, then submit at https://openssf.org/projects/ once a sponsor is lined up.

[kenithphilip]

Process correction: I had the OpenSSF intake wrong. There is no #project-lifecycle Slack channel anymore. The actual application process is a PR to ossf/tac per process/project-lifecycle.md.

Submission gate: OpenSSF Sandbox requires a minimum of 3 maintainers across at least 2 organisations. Tessera has 1 maintainer today, so the application PR cannot land yet.

Updated the docs in commit fdb494e:

• Removed the now-misleading openssf_slack_post.md.
• Added tessera_sandbox_stage.md, the actual file that will become process/project-lifecycle-documents/tessera_sandbox_stage.md in the ossf/tac repo when filed. Format verified against bomctl_sandbox_stage.md (canonical template).
• Updated openssf_sandbox_application.md with the corrected PR-based process and a recruiting plan for the 2 additional co-maintainers.

Sponsor candidates: Supply Chain Integrity WG (closest fit, given the Sigstore + MCP-mirror dependency) or Security Tooling WG.

Next steps before this can move forward:

1. Recruit 2 co-maintainers from at least one other organisation. Use the 4 open framework PRs and agentgateway/agentgateway#1665 as outreach channels.
2. Document the second-maintainer commits in a public issue here.
3. Then fork ossf/tac, copy tessera_sandbox_stage.md in, update the README table, open the PR.