OpenJS Foundation Cross Project Council Meeting - August 18, 2026 ![rw-book-cover](https://img.youtube.com/vi/Fbi-7jIiDaU/maxresdefault.jpg) 🔗 **Source:** [OpenJS Foundation Cross Project Council Meeting - August 18, 2026](https://www.youtube.com/watch?v=Fbi-7jIiDaU) > [!note]+ Document Notes > tags: [openjs-foundation, open-source-governance, javascript-ecosystem, ai-vulnerability-disclosure, cross-project-council] > author: [MISSING] > source: OpenJS Foundation (YouTube) > reference: https://www.youtube.com/watch?v=Fbi-7jIiDaU > date created: 2026-08-21 13:40 > > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > > # 🏷️ Title: OpenJS Foundation Cross Project Council Meeting - August 18, 2026 > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [OpenJS Foundation Cross Project Council Meeting - August 18, 2026 (video)](https://www.youtube.com/watch?v=Fbi-7jIiDaU) - Open Visualization collab summit, September 2026 (openvisualization.org, referenced not linked in transcript) - Sovereign Tech Fund / Sovereign Tech Agency (referenced, not linked in transcript) ## 📝 Summary - **What happened.** A recurring OpenJS Foundation Cross Project Council (CPC) status meeting: event recap (Node Interactive at render ATL), a running "opt-in ad network" governance proposal being socialized across Technical Steering Committees, a roll call of working-group updates (AI, Bundler, deprecated Ecosystem Report, Open Viz, Package Metadata Interop, Security, Standards/TC39, Sustainability), a notable new research proposal on AI-discovered vulnerability disclosure norms, W3C board election news, TC39 in-person meeting scheduling for next year, and an admitted lapse in reviewing the Code of Conduct panel's membership cadence. - **Why it matters.** This is a working governance body for a major JavaScript/Node ecosystem foundation making real, if informal, decisions about advertising within an open-source foundation, security-disclosure norms in an AI era, and internal accountability (COC panel review). The informality of the discussion (interruptions, half-finished thoughts, jokes) doesn't reduce the substance of what's being decided. - **Key stakeholders.** OpenJS Foundation CPC members and named individuals (Robin, Kate, Toby, Chris, Ben, Michael, Wes referenced, Justin Samuels of render ATL); member/impact projects (jQuery, Electron, Express mentioned for upcoming presentations); the Code of Conduct panel; the broader JS/Node community affected by governance decisions like the ad network. - **Risks and tradeoffs.** The ad-network proposal ("exploring the opt-in ad network") is discussed as something being cautiously "socialized" across TSCs with an eye toward avoiding pushback — advertising inside an open-source foundation's infrastructure is a reputationally sensitive move that isn't interrogated critically in this meeting, just tracked procedurally. The COC panel review cadence is explicitly admitted to be undefined/lapsed ("I don't think there's a defined cadence for this panel review... I think we haven't done this in a while"), a real governance gap being surfaced live rather than resolved. - **Bottom line.** A working, functioning cross-project governance body doing routine but consequential process work — most notable for a live admission of a compliance gap (COC panel review) and a genuinely novel emerging-tech governance question (AI-era vulnerability disclosure norms) surfaced almost in passing. ## 📖 Main Content - **Core structure:** standard meeting-minutes flow — announcements → agenda items (ad network, governance guidance, project presentation scheduling, collab space) → working-group roll call → dates/reminders → open floor. - **Ad network:** framed as "exploring the opt-in ad network," already being informally socialized with some TSCs ("some of the TC TSC's are starting to socialize it within their group as well... haven't had a lot of push back"). No technical or ethical specifics are discussed in this meeting — it's a status check, not a design discussion. - **AI vulnerability disclosure research:** one member describes submitting a Sovereign Tech Fund/Agency application for a security-working-group research project on "open vulnerability reporting" — specifically whether it's better to be more transparent about vulnerability reports or continue coordinated (embargoed) disclosure, motivated by the observation that AI tools may cause multiple independent parties to discover the same vulnerability simultaneously. A second member pushes back with a specific, well-reasoned counterpoint: discovery depends heavily on prompting and model choice, so one AI-discovered vulnerability isn't automatically "AI-discoverable by everyone else." Both sides agree it's "certainly worth researching." - **Working-group roll call:** AI working group had no meeting recap but references unrecorded Render conference AI sessions the group will still try to promote; Bundler group has no update but a member commits to reactivating it post-Render; Ecosystem Report working group is confirmed inactive/deprecated, with its README already updated in June (a small, resolved item that took several back-and-forth exchanges to confirm); Open Viz has a collab summit coming in September; Package Metadata Interop hasn't met in some time and its continuation status is questioned; Security working group is running normally with recorded sessions and linked agenda issues; Standards/TC39 covers a W3C board election (a member is running) and progress locking in 2 of 3 in-person TC39 plenary locations for next year; Sustainability has no update. - **Governance gap surfaced live:** discussion of Code of Conduct panel membership review turns into an admission that no one is sure there's a defined review cadence, and that even if there is, it likely hasn't been followed ("I think we have failed to do that. Seriously."). Resolution is to open a tracking issue rather than resolve it in the meeting. ### 🗒️ Notes #### ⏱️ [00:04](https://www.youtube.com/watch?v=Fbi-7jIiDaU&t=4) Opening / render ATL recap - Meeting opens with thanks to the render ATL team for hosting Node Interactive; informal recap of what worked (an in-hall session format with headphones for attendees, described as noisy but functional) and a mention that free childcare at the event was well received. - One member offers a critical self-observation about a template artifact: "I don't know why this update meeting template is has the agenda on here." #### ⏱️ [04:05](https://www.youtube.com/watch?v=Fbi-7jIiDaU&t=245) Board/staff updates and ad network status - No August board meeting; next board meeting isn't until next month. - The "opt-in ad network" is being informally socialized across some TSCs with no reported pushback so far. #### ⏱️ [11:41](https://www.youtube.com/watch?v=Fbi-7jIiDaU&t=701) Working group roll call begins - Open Viz, Package Metadata Interop, Security, and Standards groups covered in sequence; the Ecosystem Report group's inactive status and README cleanup (already done in June) takes several exchanges to confirm and credit correctly. #### ⏱️ [13:07](https://www.youtube.com/watch?v=Fbi-7jIiDaU&t=787) AI-era vulnerability disclosure research proposal - A Sovereign Tech Fund application is described for security-working-group research into whether vulnerability reports should stay confidential/coordinated or become more transparent, given AI tools may cause simultaneous independent discovery. - Immediate pushback: discovery is prompt- and model-dependent, so one AI finding a vulnerability doesn't mean it's uniformly discoverable — flagged as worth researching regardless. #### ⏱️ [17:39](https://www.youtube.com/watch?v=Fbi-7jIiDaU&t=1059) Code of Conduct panel review gap - Live admission that the CPC has no clear, followed cadence for reviewing COC panel membership; agreement to open a tracking issue rather than resolve it on the call. ## 📚 References - [OpenJS Foundation Cross Project Council Meeting - August 18, 2026](https://www.youtube.com/watch?v=Fbi-7jIiDaU) — primary source (video/transcript) for this analysis. - No external documents, papers, or written sources were cited by name with URLs during the meeting itself; references to openvisualization.org and the Sovereign Tech Fund/Agency are verbal mentions only. ## 🗣️ Paraphrase - The council opens by thanking the render ATL team for hosting Node Interactive and reflecting on what worked about the event format, including a headphone-based multi-session setup in a noisy expo hall and on-site childcare. - An "opt-in ad network" idea continues moving through informal socialization with technical steering committees, without reported objections so far. - Working groups report in one by one: some are active and productive (Security, Standards/TC39, Open Viz), some are stalled and need reactivation (Bundler), and one is confirmed fully wound down with its documentation already cleaned up (Ecosystem Report). - A member describes applying for funding to research whether AI tools change the calculus on keeping vulnerability reports confidential versus more open, prompting a thoughtful, specific counterargument about how AI-driven discovery actually varies by prompt and model — both agree it's worth studying properly. - The meeting surfaces, without fully resolving, that the council hasn't been keeping to whatever review cadence exists (if any) for its Code of Conduct panel's membership, and commits to opening an issue to track fixing that. ## 📰 Newsletter - Not applicable to this source in a WordPress-specific sense — this is OpenJS Foundation (Node.js/JS ecosystem) governance, not WordPress. However, it's strong comparative material for anyone thinking about federated open-source governance structures (The WPOCC, FAIR) — see Action Items below for direct cross-references. ## ✅ Action Items #### DevRel - Developer advocacy: the render ATL event-format notes (headphone-isolated in-hall sessions, on-site childcare) are concrete, reusable ideas for any conference/meetup organizing effort. #### OSPO - Policy & Governance: the live admission of an undefined/lapsed COC panel review cadence is a direct, concrete example of a governance-hygiene gap worth checking for in any OSPO's own foundation/community governance — "do we have a defined cadence for reviewing our own oversight bodies, and are we actually following it?" - Security Management: the AI-era vulnerability disclosure research question (confidential/coordinated vs. more transparent reporting, given possible simultaneous AI-assisted discovery) is directly relevant to any OSPO's vulnerability-intake and embargo policy — worth tracking the OpenJS security working group's research output when published. #### Community - Maintainers: the "schedule initial annual project presentations" agenda item (jQuery and Electron done, Express proposed next) is a lightweight, reusable format for surfacing member-project health/roadmap to a cross-project council — worth considering for The WPOCC's own cross-project visibility needs. - Ecosystem: the Package Metadata Interop working group's uncertain-continuation status, raised almost in passing ("They have not met for some time... is that another one that we're pulling off of this or no?"), is a reminder to periodically audit a foundation's own working-group roster for groups that are nominally active but functionally dormant. #### WordPress - Not applicable to this source — no WordPress Core, plugin, theme, or ecosystem content present; this is OpenJS/Node/JS governance. #### The WPOCC - Programs: the OpenJS CPC's model — a cross-project council doing periodic working-group roll calls plus scheduled project-presentation slots — is a directly comparable governance pattern worth evaluating against The WPOCC's own structure, since both are attempting cross-project coordination within a broader open-source ecosystem. #### FAIR - Policies and covenants: the ad-network socialization process (informally checking with TSCs before formal proposal, tracking pushback) and the vulnerability-disclosure research question are both relevant precedents for FAIR's own governance-covenant and security-disclosure design work — worth following the OpenJS security working group's eventual research output. ## 🧪 Hypotheses - H1: Foundations that run a regular, roll-call-style working-group status check (as OpenJS CPC does here) catch dormant/inactive working groups faster than foundations relying on working groups to self-report their own status changes. - H2: The rate and severity of independently-discovered ("AI-assisted") vulnerability reports for a given open-source project has increased measurably since general-purpose AI coding/security tools became widely available. - H3: Advertising-network proposals inside open-source foundations generate measurably more community pushback once formally announced than during informal pre-socialization with steering committees — i.e., early "no pushback yet" signals from TSC socialization are not predictive of full-community reaction. - H4: Foundations with an explicitly defined and calendared oversight-body review cadence (e.g., for a Code of Conduct panel) are less likely to have multi-year gaps in that review than foundations relying on informal/undocumented cadences. ### 📊 Methodology - H1: A comparative study of working-group "aliveness" (measured by commit/meeting activity) across foundations that do vs. don't run a regular cross-project roll-call meeting, tracking time-to-detection of dormancy. - H2: A longitudinal analysis of vulnerability report volume/discovery-method metadata (where disclosed) across a sample of major open-source security trackers, correlating with AI coding-tool adoption timelines. - H3: A comparative case study of open-source foundations that added advertising/monetization features, comparing community reaction at the informal-socialization stage versus the public-announcement stage. - H4: An audit of a sample of open-source foundations' governance documents for explicit oversight-body review cadences, cross-referenced against actual review history (dates of last review) to measure compliance gaps. - Data sources available today: OpenJS Foundation's own public meeting notes/recordings (this video is one instance), GitHub issue trackers for CPC-related repos, and any published output from the described Sovereign Tech Fund research project once available. ### ❓ Questions - What did the AI-vulnerability-disclosure research project's actual proposal document say — what specific research questions and methodology were submitted to the Sovereign Tech Fund? - Has the "opt-in ad network" proposal been published anywhere publicly yet, or is it still entirely in informal TSC-level socialization as of this meeting? - What's the actual review cadence (if any) that was originally intended for the Code of Conduct panel, and who is accountable for tracking it going forward once the new issue is filed? - How many OpenJS working groups are currently in a similar "hasn't met for some time, unclear if still active" state as Package Metadata Interop, beyond the two flagged in this meeting (Ecosystem Report, confirmed inactive; Package Metadata Interop, uncertain)? - Did the counter-argument about AI vulnerability discovery being prompt/model-dependent change the shape of the research proposal, or does the proposal proceed as originally framed? ### 🔮 Future Research - Track the OpenJS Foundation security working group's AI-era vulnerability disclosure research once published, given its direct relevance to any foundation's (including The WPOCC's and FAIR's) own disclosure-policy design. - A structured comparison of cross-project governance council formats (OpenJS CPC's working-group roll call + project-presentation slots vs. other foundations' models) to identify transferable patterns for The WPOCC. - A lightweight audit tool/checklist for open-source foundations to self-check for undefined or lapsed oversight-body review cadences (COC panels, security committees, etc.), directly modeled on the gap this meeting surfaced. ### 💡 Implications - **Practice:** any foundation running cross-project governance (including The WPOCC) could adopt the "working-group roll call + scheduled project presentations" format as a lightweight way to keep dormant groups visible and member-project health surfaced regularly. - **Policy:** the AI-vulnerability-discovery discussion has real policy implications for embargo/coordinated-disclosure norms across the whole open-source ecosystem, not just OpenJS — worth monitoring as a bellwether question other foundations will need to answer too. - **Security:** the specific counter-argument raised (AI-assisted discovery is prompt/model-dependent, not a uniform "everyone finds it at once" event) is a reusable, well-reasoned talking point for any security-disclosure policy discussion grappling with the same question. - **Education:** the render ATL headphone-isolated session format is a concrete, exportable idea for any organization running expo-hall-adjacent programming at a shared conference. - **Funding models:** the Sovereign Tech Fund/Agency application process modeled here (a working group member independently applying for research funding on behalf of a foundation initiative) is a funding pattern worth understanding for any foundation (WPOCC/FAIR included) considering similar externally-funded research efforts. ### 🧠 Learning Styles Assessment - Reading level estimate: transcript of informal spoken conversation — grade-level estimates don't apply cleanly to spoken meeting transcripts (heavy use of filler words, interruptions, incomplete sentences); comprehension difficulty is moderate due to overlapping speakers and un-attributed turns rather than vocabulary complexity. #### 👀 Visual learners - Present: none — audio/video meeting with no slides or visual aids referenced in the transcript. - Improve: a simple working-group status table (group name | status | next action) extracted from the roll call would make the meeting's actual output scannable in seconds instead of requiring a full transcript read. #### 🔊 Aural learners - Present: this is inherently audio-first content (a recorded meeting) — well suited to aural learners as-is. - Improve: speaker labels/diarization in the transcript (currently unattributed `>>` turn markers) would make it far easier to follow who said what on a re-listen. #### 🗣️ Verbal learners - Present: conversational, first-person, low-jargon language throughout (aside from foundation/project-specific proper nouns). - Improve: a glossary of the acronyms/entities used without expansion (CPC, TSC, TC39, COC, W3C AC rep) would help readers unfamiliar with OpenJS/W3C governance structures. #### 🧩 Kinesthetic learners - Present: minimal — this is a discussion meeting, not a hands-on/procedural session. - Improve: not a natural fit for this content type. #### 🧠 Logical learners - Present: the meeting itself follows a clear, repeatable agenda structure (announcements → agenda items → working-group roll call → dates/reminders → open floor) that logical learners would find easy to follow once identified. - Improve: a structured decision log (what was decided, what was deferred to an issue, what remains open) extracted from this meeting would suit logical learners better than the raw transcript. #### 🧑‍🤝‍🧑 Social learners - Present: the entire artifact is a multi-person collaborative discussion — inherently social-learner-friendly content. - Improve: none needed — this format already serves social learners well. #### 🧘‍♀️ Solitary learners - Present: minimal — content assumes group context and familiarity with ongoing threads (referenced prior meetings, known individuals by first name only). - Improve: a brief "who's who and what's the background" primer would help a solitary reader without meeting-series context follow along. #### 🌿 Naturalistic learners - Present: not applicable — no ecological/environmental content. - Improve: not applicable. ### 📊 Accessibility Assessment #### Screen reader semantics - Present: the transcript itself is plain, linear text with timestamp markers — reasonably screen-reader-navigable as a document, though speaker turns are marked only by `>>` rather than named/structured speaker labels. - Improve: proper speaker diarization (named or numbered speaker labels) would significantly improve screen-reader navigability for a multi-speaker transcript like this. #### Keyboard navigation - Present: not assessable from transcript text alone — depends on the YouTube player's own accessibility, not this pipeline's scrape. - Improve: not assessable from available content. #### Contrast and readability - Not applicable to this source — no visual UI to assess from a transcript. #### Text resizing and reflow - Not applicable to this source. #### Media and captions - Present: this document *is* the caption/transcript — auto-generated YouTube captions, which is why filler words, incomplete sentences, and some likely mis-transcriptions (e.g., proper nouns) are preserved as spoken. - Improve: a human-reviewed/corrected transcript pass would improve accuracy over raw auto-captions, particularly for proper nouns and technical terms. #### Forms and interactions - Not applicable to this source. #### Standards reference - Given this is a plain transcript rather than a formatted web page, the main WCAG-relevant consideration is media alternative quality (auto-caption accuracy) rather than layout/interaction criteria — auto-captions are present but unverified for accuracy against the actual audio. ### 🌍 DEIB Assessment #### Cultural breadth - Not applicable to this source — an internal foundation governance call has no natural cultural-breadth dimension to assess. #### Inclusive language - Present: casual, informal register throughout ("clanker" used once as slang for AI, in a self-deprecating remark); no exclusionary or harmful language identified otherwise. - Improve: none identified as a concern; note the informal register may reduce accessibility for readers unfamiliar with the speakers' shorthand and inside references. #### Neurodiversity support - Present: the meeting follows a repeatable agenda structure across sessions, which supports predictability for regular attendees. - Improve: for someone reading the transcript without live-meeting context, the lack of speaker labels and frequent topic-jumping/interruption would be genuinely difficult to follow — a structured summary (as recommended under Logical learners) would help significantly. #### Representation - Present: a specific, positive mention of on-site childcare at Linux Foundation events and a comment about a colleague's five-year-old daughter attending render ATL — a small but genuine family-inclusion data point. - Improve: none flagged as needed from available content. #### Psychological safety - Present: the tone throughout is warm, joking, and low-stakes even when surfacing a real governance gap (the COC panel review lapse is met with self-deprecating humor — "Seriously" — rather than blame). - Improve: none flagged; the meeting models a psychologically safe way to surface a compliance gap without assigning individual blame. ### ✅ Logical Validity #### Strong reasoning - The pushback on the AI-vulnerability-disclosure framing is a genuinely strong piece of reasoning: rather than accepting "AI means everyone discovers the same vulnerabilities simultaneously" at face value, the counter-argument correctly identifies that discovery is contingent on prompt and model choice, which is a real and non-obvious methodological point worth preserving. #### Fallacies - Not applicable to this source in a formal sense — this is an informal working meeting transcript, not an argumentative essay; there are no sustained rhetorical arguments dense enough to contain classic named fallacies. The closest thing to a reasoning gap is the ad-network item, which is tracked procedurally ("socializing it... haven't had a lot of pushback") without any explicit discussion of the tradeoffs or risks of advertising within the foundation — an absence-of-scrutiny pattern rather than a fallacy per se. #### Tone of voice - Warm, informal, collegial, self-deprecating; frequent interruptions, half-finished sentences, and inside jokes consistent with a long-running working group with established rapport. ### 🛡️ DARVO Analysis - Not applicable to this source — DARVO requires an accusation and a response to it; this transcript contains no accusation-and-defense dynamic. The closest adjacent moment (the COC panel review lapse) is met with direct, non-defensive acknowledgment ("I think we have failed to do that. Seriously.") rather than any denial, attack, or victim-reversal — a notably healthy pattern worth naming as the positive counter-example to DARVO rather than an instance of it. ## 🎯 Conclusion - **Bottom line:** a routine but substantive cross-project governance meeting that surfaces one genuinely novel emerging question (how should open-source vulnerability disclosure norms adapt to AI-assisted discovery) and one real, candidly-admitted governance gap (undefined/lapsed Code of Conduct panel review cadence), inside an otherwise standard working-group status roll call. - **Practical next steps for readers:** (1) if working on governance for The WPOCC or FAIR, use the OpenJS CPC's roll-call + project-presentation format as a comparison point; (2) track the OpenJS security working group's AI-vulnerability-disclosure research output once published; (3) consider whether The WPOCC's own oversight bodies (if any) have a similarly undefined review cadence worth auditing proactively rather than discovering the gap live, as happened here. ## 🔄 Refactor Appendix — OpenJS Foundation Cross Project Council Meeting - August 18, 2026 > Density: 2–5 Literature atoms (H3), 0–3 Permanent candidates (H4). > Defaults: 3 Literature, 1 Permanent. Resonance filter applied. ### 📚 Literature Atoms (H3) #### [H1] AI-assisted vulnerability discovery may not be uniform across finders > [!quote] ID:rw_1 > what you discover depends a lot on how you prompt it and what models you're using... I'm not sure it's true that every AI discovered vulnerability is automatically AI discoverable by everyone else **Context & use**: - Raised as a direct counterpoint to a proposed research project on vulnerability-disclosure transparency norms in the AI era. - Directly relevant to any foundation's (WPOCC/FAIR included) security-disclosure policy design. **Tags**: #xref #addendum <!-- atomicity: 1 idea ✓ --> #### [H2] OpenJS security working group is researching AI-era disclosure norms > [!quote] ID:rw_2 > I've submitted uh an an application for the sovereign tech fund... on a research project that the security working groups on on open vulnerability reporting **Context & use**: - A live, funded research effort worth tracking for its eventual findings. - Cross-references the H1 atom's counter-argument, which was raised in direct response. **Tags**: #xref #articleseed <!-- atomicity: 1 idea ✓ --> #### [H3] COC panel review cadence is undefined and has lapsed > [!quote] ID:rw_3 > I don't think there's a defined cadence for this panel review. Doesn't mean there shouldn't be, but I don't think there is. **Context & use**: - A candidly admitted governance gap, resolved only by committing to open a tracking issue. - Good comparison point for auditing The WPOCC's or FAIR's own oversight-body review cadences. **Tags**: #xref #addendum <!-- atomicity: 1 idea ✓ --> ### 🧠 Permanent Candidates (H4) #### [P1] Simultaneous AI-discovery is not a uniform property of a vulnerability **Claim** (one sentence, Courtney's voice): Whether an AI tool surfaces a given vulnerability depends on the specific prompt and model used, so one AI-assisted discovery doesn't imply the vulnerability is equally discoverable to every other AI user. **Evidence pointer**: [[#H1]] **Scope & conditions**: Holds for AI-assisted vulnerability research generally; matters most when deciding disclosure timelines under an assumption of imminent independent rediscovery — that assumption may be weaker than it first appears. **Links** (≥1 with annotation): - [[Coordinated disclosure norms]] — because extends - [[AI security research]] — because applies-in vulnerability-disclosure policy design - [[FAIR security disclosure]] — because applies-in federated open-source governance <!-- atomicity: 1 idea ✓ --> ### ✏️ Fleeting Queue - [F1] Track down and read the actual OpenJS Sovereign Tech Fund research proposal on AI-era vulnerability disclosure once it's findable/published. #xref - [F2] Compare the OpenJS CPC working-group roll-call format directly against The WPOCC's current cross-project coordination structure — possible article/governance-design idea. #articleseed ### → Things 3 (max 2 actions) - [ ] Check whether The WPOCC has a defined, followed review cadence for any of its own oversight bodies — context: prompted by the COC panel gap in this meeting #things <!-- deep-read:sections end --> 📄 **Full text:** [[Full Document Contents/Articles/OpenJS Foundation Cross Project Council Meeting - August 18, 2026.md|OpenJS Foundation Cross Project Council Meeting - August 18, 2026 by YouTube]] ## Highlights - >> Yeah. So, I don't think there's a defined cadence for this panel review. Doesn't mean there shouldn't be, but I don't think there is. Unless I just missed it. ([View Highlight](https://read.readwise.io/read/01m0jswpkz8f93gvf1eat8z6rh)) - Note: Candid admission of an undefined/lapsed Code of Conduct panel review cadence — a real governance gap surfaced live. - Tags: atom/literature/h3, addendum - >> Yeah. and I've submitted uh an an application for the sovereign tech fund at the sovereign tech agency uh on a research project that the security working groups on on open vulnerability reporting and just trying to determine if it's better to be more transparent um on vulnerability reports ([View Highlight](https://read.readwise.io/read/01m0jsw7cewy7vk97naw84s50b)) - Note: A live, funded OpenJS security working group research effort on AI-era vulnerability disclosure norms — worth tracking output. - Tags: atom/literature/h2, ai-vulnerability-disclosure - >> and my gut reaction to that is that what you discover depends a lot on how you prompt it and what models you're using. So, I'm not sure it's true that every AI discovered vulnerability is automatically AI discoverable by everyone else, but um certainly worth researching. ([View Highlight](https://read.readwise.io/read/01m0jswf1k5cc2npsfbamcg62b)) - Note: Direct counterpoint: AI-assisted vulnerability discovery depends on prompt/model, so it isn't uniformly discoverable by everyone. - Tags: addendum, atom/literature/h1