DRAFT DRAFT DRAFT

NOTE that the content for this month report is in markdown format- please do not remove any formatting characters when adding your reports.

If your report is missing please use the clutch2report.py script to generate your report.

It also best to:

Do not change existing formatting. Especially do not change the formatting of the sign-off area.
Keep all lines under 76 characters long.
All content under the ### headings should be indented by two spaces. Do not use tabs.
Please don't change the text in the headings or add new ones.
Include one space after a bullet point or full stop on a numbered list.
Use [X] (X and no spaces) to sign off reports.
Do not include long URLs and use the apache URL shortener https://s.apache.org.
Please note that some lines have two spaces at the end. Do not remove these spaces.

Please make sure you use the current report and don't copy an old one, the headings do change from time to time.

A script will be run on this report before it is submitted to the board. If your lines are too long it may insert line breaks in unexpected places.

Reflow

fold -w 76 -s $1 | cat -s

Timeline

Wed October 07	Podling reports due by end of day
Sun October 11	Shepherd reviews due by end of day
Sun October 11	Summary due by end of day
Tue October 13	Mentor signoff due by end of day
Wed October 14	Report submitted to Board
Wed October 21	Board meeting

Shepherd Assignments

Calvin Kirs	Maka
Drew Farris	Caldera
Justin Mclean	Pegasus
PJ Fanning	Asyncband
Timothy Chen	Amoro
Willem Jiang	NullAway

Incubator PMC report for October 2026

DRAFT - still to be edited/updated before submission.

The Apache Incubator is the entry path into the ASF for projects and codebases wishing to become part of the Foundation's efforts.

here are currently 24 podlings under incubation. In September, the Incubator made one release. IPMC membership saw one addition and no removals and two IP clearances were completed.

NullAway entered incubation at the very end of September. Auron and ResilientDB graduated at the September board meeting.

The Aegis MCP Governance Gateway proposal is on the wiki and in discussion with possible mentors, including its relationship to Apache Knox.

Mailing list discussion otherwise focused on release voting, the IPMC release vote process, and new podling proposals.

Eight release candidates were cancelled during the month, compared with none in August and two in July. Most were withdrawn after IPMC reviewers found LICENSE and NOTICE problems, third-party code under ASF headers, or bundled files that should not be in a source release. One podling also had unreleased versions published to Docker Hub before the vote, which it has agreed to remove. The increase seems to be partly due to use of AI on both sides. Podlings use AI to help prepare releases, which introduces some mistakes. Reviewers are using AI to check them, which can find issues a human reviewer might miss.

The IPMC voted to explicitly permit podlings to run the PPMC and IPMC release votes concurrently. The vote passed with 14 binding +1 votes, one binding 0 and one binding -1, and the policy and guides have been updated. A separate proposal for a faster path, where three IPMC votes on the podling dev list would conclude a release, did not gain support.

A follow-on discussion explored better ways to verify licensing in release candidates, including using AI agents to help reviewers check source provenance. A hybrid release candidate checker, with a deterministic script and an AI review step, was added to the Incubator repo and discussed on the general list. It was tested blind against 50 past release candidates with a good success rate. The IPMC and ComDev also agreed to host the governance configuration values that the Magpie onboarding skill uses, with no skills moving between projects for now.

After its 0.7.0 release candidate was cancelled, Asyncband published 0.7.0 to crates.io outside the ASF release process. It yanked that version and published 0.7.1 as an interim non-ASF release.

Maka is eager to release for a new podling. It brought its first release candidate to the IPMC about a month after entering incubation, and replaced it with a second after review. The RC2 vote is underway, but potentially has an issue. About a third of the surviving code was written before the repository had a licence, and ICLAs have not been confirmed for one of its larger contributors from that period. This is also a minor issue with its nightly desktop builds on GitHub.

Toree's mentor responded to last month's status discussion. The podling says a new release candidate for 0.6.0-incubating is close, to be followed by a release supporting a more recent Spark version.

Neither the Pegasus PPMC nor its mentors have responded to last month's retirement discussion. The podling has been asked to address its future in its October report.

PouchDB has agreed to announce its triage meetings and post summaries to the dev list, but none has been posted yet. It still has no ASF release after 17 months.

OzHera's dev list had no traffic in September. Its September report said a security fix would ship in a release planned for mid-October.

Community

New IPMC members:

Chia-Ping Tsai

People who left the IPMC:

none

New Podlings

NullAway

Podlings that failed to report, expected next month

TODO

Graduations

Auron
ResilientDB The board has motions for the following:
TODO

Releases

The following releases entered distribution during the month of September:

Asyncband 0.7.2

IP Clearance

Cloudberry Command Center
Grails IntelliJ Plugin

Legal / Trademarks

N/A

Infrastructure

N/A

Amoro

Amoro is a Lakehouse management system built on open data lake formats like Apache Iceberg and Apache Paimon.

Amoro has been incubating since 2024-03-11.

Three most important unfinished issues to address before graduating:

Are there any issues that the IPMC or ASF Board need to be aware of?

How has the community developed since the last report?

How has the project developed since the last report?

How would you assess the podling's maturity?

Please feel free to add your own commentary.

Initial setup
Working towards first release
Community building
Nearing graduation
Other:

Date of last release:

XXXX-XX-XX

When were the last committers or PPMC members elected?

Have your mentors been helpful and responsive?

Are things falling through the cracks? If so, please list any open issues that need to be addressed.

Is the PPMC managing the podling's brand / trademarks?

Are 3rd parties respecting and correctly using the podlings name and brand? If not what actions has the PPMC taken to correct this? Has the VP, Brand approved the project name?

Signed-off-by:

(amoro) Justin Mclean Comments:
(amoro) Zhongyi Tan Comments:
(amoro) Yu Li Comments:
(amoro) Xinyu Zhou Comments:
(amoro) Kent Yao Comments:

IPMC/Shepherd notes:

Asyncband

Asyncband is a runtime-agnostic library providing essential synchronization primitives for asynchronous Rust programming.

Asyncband has been incubating since 2026-08-18.

Three most important unfinished issues to address before graduating:

Grow a diverse, sustained contributor base and recognize contributors as committers and PPMC members.
Establish a regular ASF release process shared by multiple release managers, with consistent licensing and artifact verification.
Broaden participation in reviews and public decision-making so that project maintenance does not depend on a small number of individuals.

Are there any issues that the IPMC or ASF Board need to be aware of?

No.

The initial 0.7.0 release vote was cancelled after IPMC review identified third-party licensing and attribution issues. The community corrected the source notices and LICENSE file, strengthened release checks, and subsequently completed the approved 0.7.2 release. The non-ASF 0.7.0 crate was yanked, and release candidate tags no longer trigger publication to crates.io.

How has the community developed since the last report?

Since entering incubation, 18 contributors have had pull requests merged into the main repository, covering new primitives, performance, correctness, tests, and documentation.

Bohao Zhang (iqwqi) joined as a committer and PPMC member. Release responsibilities are also expanding: Haixu Ouyang (orthur) is managing 0.7.3, following Zili Chen (tison) as release manager for 0.7.2.

GitHub Discussions are mirrored to the public development mailing list, with links back to the archived threads.

How has the project developed since the last report?

The repository, website, and mailing lists are operating on ASF infrastructure. The project completed its first ASF-approved release, Apache Asyncband (Incubating) 0.7.2, on 2026-09-11.

Development since that release has added competing MPMC and SPMC queues, bounded lossless broadcast channels, an auto-reset event, and dynamic phase coordination. Contributors also improved channel performance, cancellation handling, and API documentation.

The project is using Apache Trusted Releases (ATR), with automated source archive composition, signing, and staging. Version 0.7.3 has passed its PPMC vote and is undergoing IPMC voting.

How would you assess the podling's maturity?

Please feel free to add your own commentary.

Initial setup
Working towards first release
Community building
Nearing graduation
Other:

Date of last release:

2026-09-11 (Apache Asyncband (Incubating) 0.7.2)

When were the last committers or PPMC members elected?

Bohao Zhang (iqwqi) joined as a committer and PPMC member in September 2026.

Have your mentors been helpful and responsive?

Are things falling through the cracks? If so, please list any open issues that need to be addressed.

Yes. Mentors have participated in release reviews and voting and provided guidance on ASF processes. There are no outstanding issues requiring additional mentor attention.

Is the PPMC managing the podling's brand / trademarks?

Are 3rd parties respecting and correctly using the podlings name and brand? If not what actions has the PPMC taken to correct this? Has the VP, Brand approved the project name?

Yes. The project uses Apache Asyncband (Incubating) branding on its website and repository. No third-party misuse is known.

VP, Brand approved the Apache Asyncband name on 2026-08-16 through PODLINGNAMESEARCH-257.

Signed-off-by:

(asyncband) Hao Ding Comments:
(asyncband) Zili Chen Comments:
(asyncband) Jean-Baptiste Onofré Comments:
(asyncband) Mingyang Liu Comments:

IPMC/Shepherd notes:

Caldera

Caldera provides a modular platform for modeling, scripting, and executing adversary behavior. It allows users to construct emulation plans, provides agents for communicating with the command and control server, and enables users to evaluate security detections in a structured, scalable, and repeatable way. With the use of plug- ins and community-contributed features, Caldera supports a range of use cases including adversary emulation, purple teaming, detection engineering, and continuous security validation. Using Caldera, defenders can emulate known threat actor behavior and perform other red team activity to evaluate their organization’s defensive capabilities, test analytics, and find detection gaps. As a modular tool based on the MITRE ATT&CK framework, Caldera is designed to be extensible, intelligence-driven, and automation-friendly.

Caldera has been incubating since 2025-12-19.

Three most important unfinished issues to address before graduating:

Rebuild contributor momentum and broaden the committer base. Contribution has slowed since late August, and all five non-mentor PPMC members work at MITRE. Graduation needs at least three legally independent committers, so this is our top priority. We are re-engaging contributors through a developer guide, workshops and our Discord community, and we plan to invite regular outside contributors to become committers.
Prepare a first Apache release. We have reviewed what a first release needs. Open items: ASF source headers; LICENSE entries for bundled JavaScript and CSS; two LGPL-3.0 dependencies (ldap3, svglib) to make optional or replace; compiled binaries and third-party payloads in the plugins; a KEYS file; a written release process; and a license check in CI.

Are there any issues that the IPMC or ASF Board need to be aware of?

This report is late, and we apologize. Activity slowed in September, and the PPMC is now focused on getting the project back on track. Our immediate steps are to clear the review queue (67 open pull requests, 66 of which need an approving review), to re-engage contributors, and to move project discussion onto dev@.

We would welcome mentor guidance on two questions:

How should we bring the MITRE-hosted plugin repositories into the ASF: software grant coverage or IP clearance?
Can third-party security tools used as test payloads be included in an Apache release? We plan to raise this with Legal Affairs.

How has the community developed since the last report?

- New contributors are arriving. Five people outside the PPMC opened six pull requests: hardening file uploads against path traversal, building Docker images on tag pushes, a payload encoder fix, a dependency fix, a documentation fix and a new plugin. Reviewing these is our first priority.

To rebuild contributor momentum, we proposed a getting-started guide for developers on dev@ (2026-08-28) and are now preparing it, along with workshops for new contributors [ADD dates if set].
Our Discord community is growing [ADD a number]. We plan to announce workshops on dev@ and users@, and to bring discussions that affect the project back to dev@.
No new committers or PPMC members were added. We plan to finish onboarding the remaining initial committers named in the proposal.
dev@ was quiet, with three messages in September. We are following up on a user question about ATT&CK v19.1 support.
GitHub stars passed 7.4k, up from 7.2k at the last report.

How has the project developed since the last report?

- Five pull requests were merged on 2026-08-26 and 2026-08-27: security-related updates for aiohttp, cryptography and asyncssh; three front-end dependency updates; and a change that routes GitHub notifications to notifications@caldera.apache.org.

We completed a graduation readiness review covering licensing, releases, the website and branding. Its findings drive items 2 and 3 above.
Four issues were opened and three were closed.
There have been no commits to master since 2026-08-27 and no release yet. Clearing the review queue is the next step.

How would you assess the podling's maturity?

Please feel free to add your own commentary.

Initial setup
Working towards first release
Community building
Nearing graduation
Other:

Date of last release:

No Apache release yet. The last release before incubation was 5.3.0 (2025-04-24)

When were the last committers or PPMC members elected?

Yes. PJ Fanning has been consistently active and helpful, including on infrastructure and reporting, and Francis Chuang helped with the website move. One item needs attention: the podling status page has not been updated since 2025-12-19. We will work with our mentors to bring it up to date.

Have your mentors been helpful and responsive?

Are things falling through the cracks? If so, please list any open issues that need to be addressed.

Is the PPMC managing the podling's brand / trademarks?

Are 3rd parties respecting and correctly using the podlings name and brand? If not what actions has the PPMC taken to correct this? Has the VP, Brand approved the project name? Yes

Remaining work we have identified: "Apache Caldera (Incubating)" naming and the incubation disclaimer in the README, the website title and the documentation on Read the Docs, which is still titled "MITRE Caldera".

Signed-off-by:

(caldera) Kevin Ratnasekera Comments:
(caldera) Francis Chuang Comments:
(caldera) PJ Fanning Comments:
(caldera) Gordon King Comments:

IPMC/Shepherd notes:

Maka

Maka is a local-first AI agent runtime and workspace. It records model messages, tool calls, tool results, permission decisions, and termination events in append-only logs.

Maka has been incubating since 2026-08-13.

Three most important unfinished issues to address before graduating:

Complete IP clearance for the initial codebase: record the mentors' sign-off on the contributor review, now that the material contributors have ICLAs on file, and publish the podling status page.
Make the first Apache release, 0.2.0-incubating, and keep developer nightly builds (GitHub prereleases, npm nightly tag) unpromoted and labelled with the incubation disclaimer.
File the podling name search and grow the committer and PPMC base beyond the initial contributors.

Are there any issues that the IPMC or ASF Board need to be aware of?

Nothing requires Board action. For IPMC awareness: the IPMC vote on 0.2.0-incubating RC2 has three binding +1 votes and one binding -1. The -1 concerns ICLA coverage for a material contributor from before the repository had a license, and public nightly builds. That contributor has since been elected a committer and the Secretary has his ICLA on file. Nightly builds are no longer linked from the website or README, and their release pages are gaining the incubation disclaimer. The PPMC is following up on the vote thread.

How has the community developed since the last report?

This is the first report. Since 2026-08-13:

Elected 14 new committers: Chengbo Zhang, Blake Yang, Yilin Wang, Yunpei Zhou, Junwei Yao, Guangdong Liu, Xiao Liu, Qinyu Wan, Guoliang Sun, Xinhao Xu, Jiahao Zhang, Zhiyi Wang, Chong Wang and Jiaxiong Liu (account pending).
Elected two new PPMC members, Zhiyi Wang and Jiahao Zhang.
116 distinct contributors had pull requests merged, 20 of them for the first time.
GitHub Discussions are mirrored to dev@, which carried about 40 design threads, including the website rebuild, the pull request flow, and the committer nomination process.
Held two release votes on dev@ (RC1 and RC2).

How has the project developed since the last report?

Moved the repository to apache/maka and set up the mailing lists and the maka.apache.org website.
Merged 1,495 pull requests; 899 issues were opened and 760 closed.
Prepared the first source release: ASF headers, LICENSE and NOTICE review, DISCLAIMER-WIP, and removal of code with unclear provenance. RC1 was cancelled after IPMC feedback; RC2 is under IPMC vote.
Product work focused on WorkHub, a single conversational entry point for delegating work, and on hardening the Runtime Host, which owns session execution and storage.

How would you assess the podling's maturity?

Please feel free to add your own commentary.

Initial setup
Working towards first release
Community building
Nearing graduation
Other:

Date of last release:

None yet. 0.2.0-incubating RC2 is under IPMC vote.

When were the last committers or PPMC members elected?

September 2026: Chong Wang as a committer and Jiahao Zhang as a PPMC member.

Have your mentors been helpful and responsive?

Are things falling through the cracks? If so, please list any open issues that need to be addressed.

Yes. Mentors reviewed and voted on the release candidates and advised on IP clearance and the release process. Open item: the mentors' sign-off on the contributor review for the initial codebase.

Is the PPMC managing the podling's brand / trademarks?

Are 3rd parties respecting and correctly using the podlings name and brand? If not what actions has the PPMC taken to correct this? Has the VP, Brand approved the project name?

The website and README use "Apache Maka (incubating)". No podling name search has been filed yet; the PPMC will file one. No third-party misuse is known.

Signed-off-by:

(maka) Hao Ding Comments:
(maka) Huajie Wang Comments:
(maka) Zhuoran Shang Comments:
(maka) Xinyu Tan Comments:
(maka) Zili Chen Comments:
(maka) Mingyang Liu Comments:

IPMC/Shepherd notes:

NullAway

NullAway is a fast, annotation-based nullness checker for Java that helps eliminate NullPointerExceptions at build time with minimal overhead.

NullAway has been incubating since 2026-09-28.

Three most important unfinished issues to address before graduating:

Are there any issues that the IPMC or ASF Board need to be aware of?

How has the community developed since the last report?

How has the project developed since the last report?

How would you assess the podling's maturity?

Please feel free to add your own commentary.

Initial setup
Working towards first release
Community building
Nearing graduation
Other:

Date of last release:

XXXX-XX-XX

When were the last committers or PPMC members elected?

Have your mentors been helpful and responsive?

Are things falling through the cracks? If so, please list any open issues that need to be addressed.

Is the PPMC managing the podling's brand / trademarks?

Are 3rd parties respecting and correctly using the podlings name and brand? If not what actions has the PPMC taken to correct this? Has the VP, Brand approved the project name?