2023-08-02 Meeting notes

Jakub Skoczen is next, followed by  Jenn Colt 

All

TCR-27 - Getting issue details... STATUS

• Any updates?
  • Zak provided update from Martina

Maccabee Levine / Tod Olson / Jakub Skoczen / Craig McNally 

• Updates from CC: No meeting this week.
• Updates from PC: Updates on WOLFcon planning, Support SIG processes.
• Updates from Release Management Stakeholder Group: No meeting, meets every 2 weeks. CSPs were released, notes in slack.
  
• Updates from the Security Team:
  • Recent critical security vulnerabilities have been addressed
  • We have been collecting thoughts/pain points/etc. and will be scheduling a retro to improve
    • Handling embargoed vulnerabilities
    • Interactions with RMS group/CSP process
    • Responsible/private disclosure
    • How we can utilize tools to identify these types of issues sooner
  • questions about security:
    • do we know how much impact a vulnerability in one module has on other modules?
      • ie, how much risk does the practice of one team introduce risk to all teams
        • depends on the vulnerability (for ex. system user issues)
    • in this case once a type of vuln was found, checked other modules for similar
  • how was it for independent sys. ops
    • went well for A&M but they are very closely tied to community so that may have helped, not sure about others. happy with how it was handled
    • did try to get the same comms to sys ops as to the TC chairs. responsible disclosure goal is to get everyone the same amount of notice

All

Note:  Please use the '//' date macro in the decision record metadata, e.g. 02 Aug 2023 

Previous notes:

• Check-in on action items from the Kafka Tenant Collections RFC Retro
• A retro board has been created for the Breaking Changes RFC:  https://easyretro.io/publicboard/dY8fCRqguiSDP3wtvSLhNzlULdM2/8b9f3f24-ca29-4122-bcfa-4387935e2e8e
  • The intent was to create the board now so cards can be added while this is fresh in our heads, but schedule the RFC sometime after WOLFcon.  We just had an RFC retro and are still working on the action items which came out of it.
• Jenn Colt  provided an update during the meeting on the progress of the documentation. The content from a lengthy GitHub document has been successfully migrated to a draft page on the Wiki, specifically under the "GitHub documentation" subpage of the RFC process. The migration involved moving the background narrative into the Wiki while retaining the specific steps about branching in GitHub. According to Jenn, this approach seems to have worked well, as the first three narrative sections blend seamlessly with the existing content. She mentioned leaving the Lifecycle section in the Wiki to serve as a useful reference for GitHub tags, although it may be subject to changes. Jenn noted that they have not made any changes to the process pieces yet, as they await finalization of updates, especially with the new draft branching strategy. She indicated that Craig is also involved in the process-oriented updates, and both will collaborate to address that aspect. Jenn expressed readiness for the changes to be reviewed but realized that it might be best to hold off merging until the draft branching strategy receives approval. She concluded that once the approval is secured, the Wiki pages and the pull request will provide sufficient guidance for anyone to get started with their RFC.

Today:

• Whether vote on RFC/DR should be independent
• Breaking changes needs communication to team leads
  • How breaking changes should be communicated has been deferred but outcome of subgroup ADR is intended to be announced in channels and maybe meeting
  • Subgroup was just defining what the breaking changes are, need another group to define communication guidelines and to communicate further about breaking changes
  • ADR mentions channels where it (the DR) needs to be announced
• Craig and Jenn will keep working on doc and process update

Maccabee Levine/ Jeremy Huff / Craig McNally  

Previous notes:

• A schedule has been posted: https://wolfcon2023.sched.com/
• Idea from Jenn Colt:  
  • Could we move the TC shoulder meeting to a time during conference when there's not much of interest to TC, use that for face-to-face meeting? Will need to look more closely at schedule.
• Craig McNally - not much window to carry on the shoulder meeting during WolfCon, till now 7 people will be attending WolfCon in person
• Jenn Colt - also couldn't find a suitable time for a f2f meeting
• Maccabee Levine - if shoulder meeting on the Friday of Wolfson week is happening needs to be known soon.
• Jeremy Huff I'll be leaving on Friday. So I could do a Friday meeting if it was at eight or nine in the morning.
• Jenn Colt Almost the same. It could be stressful
• Jeremy Huff asked about the topics to talk about at the Friday meeting. 
• Jeremy Huff : I will pursue this in the TC internal channel for an early Friday shoulder meeting. Maybe I will do a doodle poll or something like that.

Today:

• Please fill out the doodle poll. Zooms should also be available for friday meetings

Standing agenda item to review/discuss any requested or required changes to officially supported technology lists

• React/Stripes update
• Jest/RTL have preferred update
• Node version EOL update
• Approved Poppy versions

Craig McNally 

• 07 Aug 2023 Application formalization continued (Vince)
• 08 Aug 2023 Folio chairs meeting - any topics Craig McNally/Jeremy Huff should raise? 
• 14 Aug 2023 
• 21 Aug 2023 WOLFcon 2023
• 25 Aug 2023 F2F shoulder meeting
• 28 Aug 2023 

We need to find a time to discuss "Officially Supported Technologies - Upkeep".   There's likely to be a desire to discuss various topics in more depth after WOLFcon.  Should we try to squeeze this in before WOLFcon?

Previous Notes:

• A workflow for these pages. When do they transition from one state to another. Do we even need statuses at all ?
• Stripes architecture group has some questions about the Poppy release.
• Zak: A handshake between developers, dev ops and the TC. Who makes that decision and how do we pass along that knowledge ? E.g. changes in Nodes and in the UI boxes. How to communicate this ? We have a large number of teams, all have to be aware of it.  TC should be alerted that changes are happening. We have a couple of dedicated channels for that. Most dev ops have subscribed to these channels. How can dev ops folk raise issues to the next level of community awareness ? There hasn't been a specific piece of TC to move that along.
• Craig: There is a fourth group, "Capacity Planning" or "Release Planning". Slack is the de facto communication channel.  There are no objections to using Slack. An example is the Java 17 RFC. 
• Craig: The TC gets it on the agenda and we will discuss it. The TC gets the final say.
• Marc Johnson: We shouldn’t use the DevOps Channel. The dev ops folks have made it clear that it should only be used for support requests made to them.
• Jakub: Our responsibility is to avoid piling up technical debt.
• Marc: Some set of people have to actually make the call. Who lowers the chequered flag ?
• Craig: It needs to ultimately come to the TC at least for awareness. There is a missing piece. Capacity Planning needs to provide input here. 
• Marc: Stakeholders / Capacity Planning could make that decision. Who makes the decision ? Is it the government or is it some parts of the body ?
• Marc: the developers community, the dev ops community and sys ops are involved. For example the Spring Framework discussion or the Java 17 discussion. But it was completely separate to the TC decision. It is a coordination and communication effort.
• Marc: Maybe the TC needs to let go that they are the decision makers so that they be a moderating group.
• Jakub: I agree with Marc. But we are not a system operating group. Dependency management should be in the responsibility of Release management. There are structures in the project for that.
• Jason Root: I agree with Jakub and with Marc also. Policies should drive operational/release/support aspects of Folio.
• Jason Root: If the idea of “support” is that frameworks are supported, then of course the project should meet that.
• Marc Johnson
  Some group needs to inform OleksAii when a relevant policy event occurs.
  These documents effectively ARE the manifestation of the policy.
• Craig: This is a topic for the next Monday session.

• Craig to see if Oleksii Petrenko could join us to discuss the process for updating the officially supported technologies lists.