Table of Contents generated with DocToc
The reference organization for the Apache Software Foundation. organization.md holds the ASF defaults every Apache project inherits: PMC governance vocabulary, the Vulnogram CVE authority, the PonyMail archive, the apache-projects-mcp metadata backend, the ASF-security forwarder, and the *.apache.org / cveprocess.apache.org / dist.apache.org infrastructure values.
In <project-config>/project.md:
organization: ASF
The project then inherits every key in organization.md and need only declare its own per-project values (security-list address, scope labels, product name, roster handles, tracker labels).
Per-project values are not org-level and stay in project.md: the concrete <security-list> address, the scope-label → product map, the product name / package name, the security-team roster, and the tracker's body-field / label vocabulary.
ASF-specific process skills (the release-management and contributor-growth families, marked organization: ASF) assume this adapter by default.