Maturity baseline: developing (51/100) — 2026-07-11 #8

Maturity baseline

Stage: developing
Score: 51/100

The organization-default repository is compact, clearly scoped, and already supplies useful contribution, conduct, support, security, issue-form, pull-request, and profile defaults. Its maturity is limited by having no validation automation, ownership declaration, maintenance cadence, adoption audit, or backlog; disabled private vulnerability reporting and security automation weaken the reporting contract; and the task form requests a label that is not consistently available in consuming repositories.

Evidence reviewed

• Assessed origin default branch main at 6f08c3d; all existing issues were inspected and none exist, and there are no milestones or pull requests.
• README.md clearly explains organization-wide inheritance and project-specific overrides; GitHub's community profile API reports 87% health and resolves the README, contributing guide, code of conduct, issue template, and pull request template.
• CONTRIBUTING.md defines pre-work checks, a small-change workflow, tests/validation/docs expectations, Conventional Commit-style messages, secret hygiene, linked issues, and review expectations.
• The three YAML issue forms parse successfully and collect reproducible bug, user-problem/solution, and task objective/scope/validation data; blank issues are disabled and the PR template includes validation, risk, rollback, security, and migration checks.
• The repository has 13 tracked files and 387 lines arranged in conventional root, PROFILE, and .github/ISSUE_TEMPLATE locations, but SECURITY.md is duplicated at the root and .github/SECURITY.md without a documented synchronization mechanism.
• No GitHub Actions workflows, CODEOWNERS file, dependency update configuration, rulesets, or branch protection exist; the repository has one contributor and no explicit fallback owner or review SLA.
• SECURITY.md directs private reporting through each repository Security tab and prohibits sensitive public disclosures, but private vulnerability reporting is disabled for this repository and the fallback asks reporters to open a minimal public issue rather than naming a durable private contact.
• Dependabot security updates, secret scanning, and push protection are disabled; there is no automated link, Markdown, YAML-schema, policy-consistency, or inherited-default validation.
• .github/ISSUE_TEMPLATE/task.yml requests the task label, but the .github repository and the assessed t50-systems consumer do not have a task label, demonstrating that default forms can request unavailable labels.
• PROFILE/README.md gives a concise organization description and safe participation guidance, but it does not catalog flagship products, identify maintainers/contact paths, explain project status, or link the public company website.

Action issues created

• Validate organization community files on every pull request #1 — Validate organization community files on every pull request
• Make default issue-form labels portable across repositories #2 — Make default issue-form labels portable across repositories
• Publish durable private security reporting and response targets #3 — Publish durable private security reporting and response targets
• Declare organization-default ownership and review continuity #4 — Declare organization-default ownership and review continuity
• Audit organization-wide adoption and override drift #5 — Audit organization-wide adoption and override drift
• Expand the organization profile into a maintained project directory #6 — Expand the organization profile into a maintained project directory
• Document inheritance, override, and verification behavior #7 — Document inheritance, override, and verification behavior

Existing issue coverage

• No existing open issue was recorded as covering a maturity gap.

Review cadence

Reassess after the high-priority issues are completed or before the next significant release. Scores are directional engineering signals, not production telemetry or compliance certification.