Here is a proposal for a phased rollout of the Core Committer program, beginning with an initial low-effort learnable pilot, later expanding to a more scalable solution.
Phase 1: Pilot with champion support
This pilot is an initial increment of the CC program, with an opportunity to test assumptions and gather initial learnings before moving forward. In this phase, we focus on discovering unanticipated technicalities and legalities in the program by enlisting a few carefully selected long-time contributors to the platform (external CCs and internal champions) to help us co-create this program and collectively identify issues.
Each CC signs an individual contributor agreement that allows the CC to contribute to the platform without any affiliation with an organization. This is a required legal agreement that clarifies legal ownership and potential liability of the individual’s contributions.
If the CC works at an organization that is an Open edX provider, an additional entity contributor agreement is required to eliminate any risk of confusion between work done in an individual capacity versus in an employee capacity.
Each CC signs an NDA with edX in order to protect edX from any confidential/security/legal exceptional cases that occur from inadvertent code merges and when the CC is included to troubleshoot the issue. Additionally, edX is obligated to protect member, customer, and learner info, when there is an unintended disclosure.
Each CC in the pilot is assigned to 2 edX employees as their 2 internal champions. The champions support the CCs through the pilot to:
Ensure a reliable and timely communication channel exists with the CC, for example, in case of emergencies or questions on upcoming PRs.
Building upon learnings from the pilot, in this phase we focus on officially establishing and publishing the CC program in collaboration with the participants in the pilot.
Retro. Collect feedback and input in the form of a retrospective of the pilot program.
Adjust. Based on learnings from the retro, make any adjustments to the proposed program.
Selection. With the group, form a concrete proposal for the selection criteria of who can join as a CC.
Publish. Document and publish the establishment of the CC program, along with its updated rights, responsibilities, and selection process. When published, communicate that the program is still in its infancy and yet to be fully developed (to be scalable in phase 3).
Phase 3: Scale program without the need for individual champions
At this point, we pivot from small-scale hand-holding of CCs to a more scalable solution. Based on learnings from the previous phases, we can introduce measures to reduce involvement from the internal edX champions. Otherwise, the limited availability of edX champions will remain a bottleneck and prevent the expansion of this program.
During this phase, we can also revisit the need for CCs to sign an NDA, depending on learnings from earlier and how we choose to scale the program.
Here are some preliminary ideas for scaling the program (pending learnings from earlier phases):
Self-serve testing capability to predict scalability and production issues (ref: DrupalCI Testing)
Further advancements in decoupling code changes from production usage
Toggle agility and scalability
Configuration simplicity and decoupling
Extract CC-ownable extensions from the core and distribute shared ownership of extensions with CCs
Here are some alternative ideas that were considered, but rejected after initial deliberation with edX Legal and Enterprise representatives:
Give CCs access to edX production debugging and monitoring tools so they can be self-sufficient with addressing issues in their own code changes and repositories.
Give CCs access to edX deployment pipeline and other operational infrastructure so they can rollback and manage deployment of their own changes.
These approaches take us down the path of having CCs be closer in relation to edX contractors, with them gaining potential access to edX PII and production data in order to troubleshoot issues. While this may be a viable path to production-aware self-sufficiency, it complicates the CC relationship and introduces legal and security barriers. So we reject this path in favor of keeping CCs focused on code, rather than data and deployment and confidential business.