Apply to donate Minder to the OpenSSF

README.md

@@ -76,6 +76,7 @@ The following Technical Initiatives have been approved by the TAC. You may learn
 | gittuf | https://github.com/gittuf/gittuf | TBD | Supply Chain Integrity WG | [Sandbox](process/project-lifecycle-documents/gittuf_sandbox_stage.md) |
 | OpenVEX | https://github.com/openvex | [Meeting Notes](https://docs.google.com/document/d/1C-L0JDx5O35TjXb6dcyL6ioc5xWUCkdR5kEbZ1uVQto/edit) | Vulnerability Disclosures WG | [Sandbox](process/project-lifecycle-documents/openvex_for_sandbox_stage.md) |
 | OSV Schema             | https://github.com/ossf/osv-schema               | [Meeting Notes](https://docs.google.com/document/d/1jzqhW9SK9QRA39fQz0RiAkvpRWB0xztt1TAFJEseTlA/edit?usp=sharing) | Vulnerability Disclosures WG   | TBD        |
+| Minder                 | https://github.com/stacklok/minder (TBD)         | New project for inclusion                                                                                         | Security Tooling WG            | [Sandbox](process/project-lifecycle-documents/minder_sandbox_stage.md) |
 | Model signing          | TBD (to be created) | [Meeting Notes](https://docs.google.com/document/d/18oAsfhfKJurH-YTUFe520CAZS3lkORX1WnZmBv4Llkc/edit)  | AI/ML Security WG | [Sandbox](process/project-lifecycle-documents/model_signing_sandbox_stage.md) |
 | Package Analysis       | https://github.com/ossf/package-analysis         | [Meeting Notes](https://docs.google.com/document/d/1GFslP6elYCx27TUitdigDr1gsOItYkL0Vq7hTB9y4Lo/edit) | Securing Critical Projects WG   | TBD        |
 | Package Feeds          | https://github.com/ossf/package-feeds            | [Meeting Notes](https://docs.google.com/document/d/1GFslP6elYCx27TUitdigDr1gsOItYkL0Vq7hTB9y4Lo/edit) | Securing Critical Projects WG   | TBD        |

process/project-lifecycle-documents/minder_sandbox_stage.md

@@ -0,0 +1,55 @@
+## Application for creating a new project at Sandbox stage
+
+### List of project maintainers
+
+The project has [11 maintaners](https://github.com/stacklok/minder/blob/main/MAINTAINERS.md#maintainers-list) from 2 different companies:
+
+  * Juan Antonio Osorio, Stacklok, @JAORMX
+  * Jakub Hrozek, Stacklok, @jhrozek
+  * Radoslav Dimitrov, Stacklok, @rdimitrov
+  * Don Browne, Stacklok, @dmjb
+  * Evan Anderson, Stacklok, @evankanderson
+  * Eleftheria Stein-Kousathana, Stacklok, @eleftherias
+  * Yolanda Robla Mota, Stacklok, @yrobla
+  * Luke Hinds, Stacklok, @lukehinds
+  * Michelangelo Mori, Stacklok, @blkt
+  * Adolfo García Veytia, Stacklok, @puerco
+  * Vyom Yadav, Canonical, @Vyom-Yadav
+
+### Sponsor
+
+Most projects will report to an existing OpenSSF Working Group, although in some cases a project may report directly to the TAC. The project commits to providing quarterly updates on progress to the group they report to.
+
+  * [Security Tooling WG](https://github.com/ossf/wg-security-tooling)
+
+### Mission of the project
+
+The project must be aligned with the OpenSSF mission and either be a novel approach for existing areas, address an unfulfilled need, or be initial code needed for OpenSSF WG work. It is preferred that extensions of existing OpenSSF projects collaborate with the existing project rather than seek a new project.
+
+  * Minder is a supply chain security platform to enable teams and organizations to define security policies in a consistent way across multiple supply chain assets. Minder helps project owners proactively manage their security posture by providing a set of checks and policies to minimize risk along the software supply chain, and attest their security practices to downstream consumers.
+
+    Unlike other projects in this space, Minder supports multiple sets of organization policy across different supply chain assets, and allows users to define their own supply chain security rules using policy rules (Rego) and apply them flexibly to assets using selectors (CEL).
+
+    Minder currently supports: repositories on GitHub, builds on GitHub Actions, and artifacts in DockerHub or GHCR.io.  Support for GitLab repositories is in progress.
+
+
+### IP policy and licensing due diligence
+
+When contributing an existing Project to the OpenSSF, the contribution must undergo license and IP due diligence by the Linux Foundation (LF).
+
+  * Minder is currently licensed under the Apache 2.0 License, with a CLA for contributors.
+  * We will initiate this process shortly.
+
+### Project References
+
+The project should provide a list of existing resources with links to the repository, and if available, website, a roadmap, contributing guide, demos and walkthroughs, and any other material to showcase the existing breadth, maturity, and direction of the project.
+
+| Reference           | URL |
+|---------------------|-----|
+| Repo                | https://github.com/stacklok/minder |
+| Website             | https://minder-docs.stacklok.dev |
+| Contributing guide  | https://github.com/stacklok/minder/blob/main/CONTRIBUTING.md |
+| Security.md         | https://github.com/stacklok/minder/blob/main/SECURITY.md |
+| Roadmap             | https://minder-docs.stacklok.dev/about/roadmap |
+| Demos               | https://www.youtube.com/watch?v=WniqzgNHjJQ (a little dated) |
+| Other               |     |