Open Source Program Review Record
Current review
| Field |
Record |
| Review type |
Initial adoption and self-assessment |
| Review date |
2026-10-25; effective on Project Lead approval and merge of the adoption change |
| Reviewer |
QuantDinger Project Lead (@brokermr810) |
| Program scope |
Public OpenByteInc/QuantDinger supplied software defined in README.md |
| Standards |
REUSE Specification; OpenChain ISO/IEC 5230:2020; OpenChain ISO/IEC 18974:2023 |
| Outcome |
Controls and evidence mapped; self-assessment becomes effective on approval and merge |
| Next review due |
2028-04-24, or earlier after a material program change or failure |
Initial competence and awareness record
| Participant |
Roles |
Competence evidence |
Awareness evidence |
Assessment |
@brokermr810 |
Program Sponsor, Project Lead, Maintainer, security response |
Repository administration, release approval, protected-branch and CI operation, OpenSSF Baseline adoption, REUSE and security workflow adoption, coordinated security documentation |
Approval and merge of this program; continued privileged access is governed by MAINTAINERS.md |
Meets role requirements on effective date |
Future participants are added to MAINTAINERS.md and their competence and
awareness assessment is recorded in the access-grant or review pull request.
Initial control evidence
| Metric/control |
Initial evidence |
| License metadata |
REUSE.toml, LICENSES/Apache-2.0.txt, Apache-2.0 project license |
| Automated license check |
Required REUSE workflow and live REUSE status badge |
| Component records |
Python requirements and lock, MCP pyproject.toml, Dockerfiles, Git history, BuildKit release SBOM/provenance |
| Dependency monitoring |
Dependabot and scheduled pip-audit |
| Source and secret analysis |
CodeQL, Bandit, Gitleaks, SonarQube Cloud |
| Release traceability |
Git tag/release, immutable workflow inputs, image digest, provenance, SBOM, and keyless signing |
| Vulnerability intake |
Private email route and GitHub Security Advisory process in SECURITY.md |
| Finding and exception records |
Source scanner/advisory records and linked pull requests; every release-blocking finding must be resolved or formally treated before release |
Change log
| Date |
Change |
Review result |
Corrective action |
| 2026-10-25, effective on adoption merge |
Program v1.0, release checklist, and both OpenChain self-assessments adopted |
Initial controls mapped to all checklist items |
Re-run the formal review on material change and by 2028-04-24 |
