Lab 02 — Trust Audit

Phase: 01 — Apache Contributor Foundations
Difficulty: ⭐⭐☆☆☆ | Estimated Time: 3–4 hours
Type: Analysis / Document

Goal

Apply the Apache trust model as an evaluator — not a contributor. Given a fictional contributor profile, score each of the six trust dimensions, identify what is blocking committer candidacy, produce concrete actions, and write a PMC nomination draft or explain precisely why you cannot write one yet.

Background

When a PMC member considers nominating someone, they do not run a checklist. They have accumulated an impression over months or years of observation. But that impression can be decomposed into the six trust dimensions from the HITCHHIKERS-GUIDE.

This lab makes you practice that decomposition on a profile you haven't lived through — the way you would evaluate a contributor you don't know personally when their name comes up in a private@ nomination thread.

The Fictional Profile: Alex Kowalczyk

Alex is a backend engineer at a mid-size data platform company. Their company runs Apache Spark on YARN at scale. Alex has been contributing to Apache Spark for 14 months. Here is what the public record shows:

JIRA activity:

Filed 12 issues, 9 of which were confirmed as real bugs. Reproduction cases are detailed and reliable.
Submitted 8 patches. 6 were merged. 1 is still open with review comments from 4 months ago that Alex has not responded to. 1 was closed as "won't fix" without explanation.
Left 7 comments on other people's issues — all were "+1 to reproduce, I see the same" type comments with no technical depth.

GitHub (apache/spark) activity:

Authored 6 merged PRs. All are in the sql/ and core/ modules.
Reviewed 3 PRs in the last 14 months. Two reviews were "LGTM" with no comments. One review had a single comment: "Can you add a test for the null case?"
No reviews outside the two subsystems where Alex's own patches live.

dev@ mailing list:

Replied to one DISCUSS thread 8 months ago with a brief technical opinion. No follow-up when challenged.
Zero posts on user@.
Sent one "I'd like to work on this" email that was not followed up.

General observation:

Alex attended Spark Summit and gave a lightning talk about the company's use case.
Alex's patches are well-written: unit tests included, Javadoc updated, no obvious style violations.
The one open PR with 4-month-old review comments is a non-trivial change to TaskSchedulerImpl that the reviewer said had a subtle thread-safety issue.

Steps

Step 1 — Score the Six Trust Dimensions (1 hour)

Using only the evidence in the profile above, complete the trust audit template.

For each dimension:

Assign a score of 1–5 (1 = no evidence, 5 = strong consistent evidence)
Write 2–3 sentences of specific evidence citing details from the profile (not general statements)
Note any red flags for the dimension

→ trust-audit-template.md

Step 2 — Identify the Top Two Gaps (30 min)

After scoring all six dimensions:

Which two dimensions have the lowest scores?
For each, write a paragraph explaining:
- Why this gap matters to the Apache community specifically
- What a committer's private reaction would likely be when this gap comes up in the nomination discussion
- Whether this gap is recoverable, and in what timeframe

Save this in a section called ## Gap Analysis in your trust-audit file.

Step 3 — Produce Three Concrete Actions (30 min)

Write three specific, actionable recommendations for Alex to strengthen their committer candidacy over the next 6 months.

Each action must be:

Specific (not "contribute more reviews" — but "review 2 PRs per week outside the sql/ module, focusing on components Alex knows from reading the issue tracker")
Time-bounded (achievable in 6 months)
Directly addressing a gap from Step 2

Save this in a section called ## Recommended Actions in your trust-audit file.

Step 4 — Write the Nomination Draft or Blocker Statement (30 min)

Option A — If you believe Alex is ready for nomination today:

Write a 150–200 word PMC nomination email for Alex. Apache nomination emails follow a rough format:

State the nominee's name and Apache ID
Summarize their contributions (specific patches, reviews, community work)
State your assessment of their trustworthiness
Explicitly invite discussion

Option B — If you believe Alex is NOT ready for nomination today:

Write a 150–200 word explanation of:

The single most important blocker
What specifically Alex would need to demonstrate before you could write Option A
A realistic timeline

Save this in a section called ## Nomination Draft or Blocker Statement in your trust-audit file.

lab-02-trust-audit/
├── README.md                              ← this file
├── trust-audit-template.md               ← blank template (do not edit)
├── trust-audit-alex-kowalczyk.md          ← your completed audit
└── trust-audit-self.md                   ← (optional) self-audit

Talking Points

Be prepared to explain:

Why is review engagement a trust signal more important than patch volume? (asymmetric signal: anyone can submit patches; willingness to review benefits others with no personal upside)
What does an abandoned patch with review comments signal to a PMC member? (unreliability under pressure; the hardest patches to respond to are the ones where the reviewer is right)
Why is a single "LGTM" review noise rather than signal? (no evidence of understanding; maintainers need to know Alex can catch real problems)
What is the most dangerous failure mode in Alex's profile? (the 4-month-old open PR with unresolved thread-safety concern — an in-progress change to a core scheduling component that is now blocking the maintainer)

Resume Bullet

"Applied the Apache committer trust framework to structured contributor evaluation: scored six trust dimensions from public evidence, identified candidacy blockers, produced a 6-month development plan, and drafted a PMC nomination or blocker analysis."

Apache Committer / PMC Engineer