Tessera needs 2 co-maintainers from another organisation (OpenSSF transition gate)

[kenithphilip]

Tessera needs 2 co-maintainers from another organisation

Tessera v1.0.2 GA shipped on 2026-04-26. The v1.x line is API + wire-format frozen, and the OpenSSF transition is the natural next step (per docs/governance/foundation_proposal_v1_1.md, tracked in #19).

Submission gate: OpenSSF Sandbox tier requires a minimum of 3 maintainers across at least 2 organisational affiliations. Tessera currently has 1 maintainer (Kenith Philip, independent). The PR to ossf/tac cannot land until 2 additional co-maintainers from any other organisation have agreed to maintain the project.

This issue is the public ask.

What "co-maintainer" means here

• Joining the Tessera repo with Maintain access on kenithphilip/Tessera.
• Triaging and reviewing inbound PRs (a few per week, expected).
• Sign-off on changes to load-bearing invariants (the list is short: Context.min_trust, WorkerReport shape, signing formats; see CLAUDE.md).
• Quarterly maintainer call once OpenSSF acceptance lands (cadence per the foundation proposal).
• DCO sign-off on every commit (per ADR-0001).

What it does NOT mean

• Sole-on-call. The threat-model scope is narrow (see SECURITY.md); critical bug load is bounded.
• A vote against a foundation transition. Joining as a maintainer is the enabler for the transition, not a commitment to a different governance preference downstream.
• Code-only. Documentation reviewers, security-disclosure responders, and process-stewards are equally welcome.

Project state for context

• 50,000+ Python LOC + ~21,000 Rust LOC across 11 crates.
• 2058 Python tests passing, ~390 Rust tests, 9 agentgateway plugin tests.
• 1091-payload red-team corpus.
• Apache-2.0 with DCO sign-off; no CLA.
• Compliance taxonomy mappings: NIST AI 600-1, ISO/IEC 42001 Annex A, CSA AICM 1.0, MITRE ATLAS, EU AI Act Articles 9/12/14/15, OWASP Agentic ASI 1-10, NIST CSF, CWE.
• 4 active framework integration PRs (LangChain, LangGraph, LlamaIndex, PydanticAI, CrewAI) and an upstream agentgateway discussion (agentgateway/agentgateway#1665).

How to express interest

Comment on this issue with:

• Your GitHub handle.
• Your organisational affiliation (employer, foundation, independent).
• A short note on which area of the codebase you're most interested in maintaining (taint-tracking, MCP signing chain, framework adapters, governance docs, etc.).

Once 2 additional maintainers from at least 1 other organisation are committed, the OpenSSF application PR (docs/governance/tessera_sandbox_stage.md) lands.

Cross-posted to the 4 active framework PRs:

• docs: add Tessera tool-call gating for LangChain + LangGraph langchain-ai/docs#3741
• docs(community/integrations): add Tessera tool-call gating run-llama/llama_index#21482
• docs: add Tessera tool-call gating integration pydantic/pydantic-ai#5207
• docs(learn): add tool-call gating with Tessera (multi-agent example) crewAIInc/crewAI#5627