Add process for handling reports

proposals/stage-1/CODE_OF_CONDUCT/FOUNDATION_CODE_OF_CONDUCT_REQUIREMENTS.md

@@ -16,19 +16,19 @@ as its code of conduct and it applies to all foundation activities and spaces. I
 addition, projects joining the foundation are required to adopt this code of conduct
 within 3 months of joining the foundation.
 
-The foundation has chosen to require a common Code of Conduct. This will allow a common
+A common Code of Conduct will allow a common
 escalation process and will allow the Foundation to better support projects in their efforts to apply
 the Code of Conduct.
 
 ## Enforcement
 
-For spaces managed by the foundation complaints can be forwarded to report@xxxx.org and will
-be investigated by the Cross Project Council(CPC) or its delegates. All complaints will be reviewed, 
+For spaces managed by the Foundation, complaints can be forwarded to report@openjsf.org and will
+be investigated by the Cross Project Council (CPC) or its delegates. All complaints will be reviewed, 
 investigated, and will result in a response that is deemed necessary and appropriate
 to the circumstances. The CPC is obligated to maintain confidentiality with regard
 to the reporter of an incident.
 
-For spaces managed by each project, the project must provide an email to which complaints 
+For spaces managed by member projects, the project must provide an email to which complaints 
 can be forwarded and document that complaints will be investigated and will result in a
 response that is deemed appropriate for the circumstances. Each project is free to
 implement enforcement of the Code of Conduct using processes appropriate for the size
@@ -44,7 +44,7 @@ in place by a project (for reports made to a project) or the CPC (in the
 case of reports relating to spaces within the scope of the foundation versus a project).
 In exceptional cases where a reporter wishes to challenge the response from the CPC or
 project, or does not feel comfortable reporting through the standard processes, an escalation
-report can be made to coc-escalation@xxx.org.
+report can be made to coc-escalation@openjsf.org.
 
 All escalations will be reviewed and investigated by the Code of Conduct Panel (CoCP)
 and will result in a response that is deemed necessary and appropriate to the circumstances.

proposals/stage-1/CODE_OF_CONDUCT/HANDLING-REPORTS.md

@@ -0,0 +1,80 @@
+# Handling reports and escalation
+This document describes the proposed process for handling reports and escalation, along with relevant roles in the OpenJS Foundation.
+
+This process covers two types of reports based on ./FOUNDATION_CODE_OF_CONDUCT_REQUIREMENTS.md:
+
+* Reports for spaces managed by the Cross Project Council (CPC) which come in through `[email protected]`
+* Escalations which come in through `[email protected]`.   
+
+Generally, reports to coc-escalation should refer to a report that was already submitted to:
+
+* [email protected] or
+* one of the project's reporting emails 
+* explanation of why the reportee does not feel comfortable using the previous reporting emails for the initial report
+
+If a report to coc-esclation does not include one of those, the reportee will be asked to to provide one of those three as the 
+reason for reporting to coc-escalation.
+
+## Confidentiality and record-keeping
+Personal information is confidential. All reports should be recorded, together with the discussion of it. The following private repos will be used to record and discuss reports.
+
+* [email protected] -> github.com/openjs-foundation/moderation
+* [email protected] -> github.com/openjs-foundation/coc-escalation
+
+For each report there should be an issue which captures the report, discussion and final conclusion.  The report should NOT contain identifying details of the reporter.
+
+## Conflict of Interest
+
+Any member of the CPC or Code of Conduct Panel(CoCP) who is involved in the report should recuse themselves from the discussions.
+
+## Reports to [email protected]
+
+All members of the CPC are subscribed to the `[email protected]` mailing list.  When a report is received the following actions will be taken:
+   * One of the CPC members will respond to the reportee confirming that the report has been received. When possible the same person
+     who responds initially will act as the point of contact for future conversations.
+   * If no response has been sent by the next CPC meeting, the CPC chair will ensure there is a private session in which one of the
+     CPC members is identified as the point of contact.
+   * The point of contact will then ensure the following steps are completed:
+     1. Report is acknowledged: The contact person responds to let the reportee know that the report is being discussed.
+     2. Information gathering: Time is allocated to collect information in one place to make sure everyone involved has access.
+     3. Information is discussed: The facts are discussed in context of opinions. This can be done in the issue for the report, or
+        in a meeting in which case the key discussion points should then be added to the issue.
+     4. An action to be taken is arrived at: The action to be taken is decided by consensus as per the standard CPC
+        [Decision Making](https://github.com/openjs-foundation/cross-project-council/blob/master/CPC-CHARTER.md#section-9-decision-making) process.
+     5. Resolution offered: The resolution is offered to the reportee by the contact person. If the resolution is accepted as
+        reasonable or there is no response within 7 days the process moves to the next step. If the reportee expresses concerns then the
+        contact person will bring these back to the CPC members for further discussion. This cycle can continue until the 
+        CPC members reach consensus that the reportee's concerns have been adquately addressed.
+     6. Final resolution: the resolution agreed by the CPC members is implemented and the outcome reported to the reportee by
+        the main contact.
+
+## Reports to [email protected]
+
+All members of the [Code of Conduct Panel (CoCP)](.FOUNDATION_CODE_OF_CONDUCT_REQUIREMENTS.md#code-of-conduct-panel)
+are subscribed to the [email protected] mailing list. The current list of members is documented in ./CODE_OF_CONDUCT_PANEL_MEMERS.md.
+
+When a report is received the following actions will be taken:
+
+  * One of the Code of Conduct Panel (CoCP) members will respond to the reportee confirming that the report has been received.
+    When possible the same person who responds initially will act as the point of contact for future conversations.
+  * If no response has been sent within 1 day the Foundation Executive Director will ensure a member of the Code of Conduct
+    Panel is identified as the main point of contact either through email or scheduling a meeting for the CoCP.
+  * The main point of contact will then ensure the following steps are completed:
+     1. Report is acknowledged: The contact person responds to let the reportee know that the report is being discussed.
+     2. Information gathering: Time is allocated to collect information in one place to make sure all CoCP members have access.
+     3. Information is discussed: The facts are discussed in context of opinions. This can be done in the issue for the report, or
+        in a meeting in which case the key discussion points should then be added to the issue.
+     4. An action to be taken is arrived at: The action to be taken is decided by consensus as per the standard CPC
+        [Decision Making](https://github.com/openjs-foundation/cross-project-council/blob/master/CPC-CHARTER.md#section-9-decision-making) process substituting in CoCP for references to the CPC.
+     5. The proposed action is discussed with the leadership for the space to which the report applies (ex CPC or member
+        project leadership). If the leadership representatives expresses concerns then the
+        contact person will bring these back to the CoCP members for further discussion.  This cycle can continue  until the 
+        CoPC members reach consensus that the leadership representatives concerns have been adequately addressed.
+     6. Resolution offered: The resolution is offered to the reportee by the contact person. If the resolution is accepted as
+        reasonable or there is no response within 7 days the process moves to the next step.  If the reportee expresses concerns then the
+        contact person will bring these back to the CoCP members for further discussion. This cycle can continue until the 
+        CoCP members reach consensus that the reportee's concerns have been adequately addressed. This may also require that
+        step 5 be repeated as well if the proposed action is modified.
+     6. Final resolution: the resolution agreed by the CoCP members is implemented and the outcome reported back to the reportee by
+        the main contact.
+

proposals/stage-1/CODE_OF_CONDUCT/README.md

@@ -7,8 +7,11 @@ Michael Dawson (@mhdawson)
 
 ## Description
 
-This document captures a proposed approach for
+These documents capture a proposed approach for implementing and handling Code of Conducts within the Foundation.
+
+* FOUNDATION_CODE_OF_CONDUCT_REQUIREMENTS.md: a proposed approach for
 managing Code of Conducts within the Foundation.
+* HANDLING-REPORTS.md: a proposed framework for handling reports and escalation.
 
 ## Required Resources
 
@@ -18,11 +21,11 @@ Discussion/approval by bootstrap committee
 
 In current proposals for the groups within a merged
 foundation, the responsibility would be a joint
-responsibility of the Foundation, Board, CPC and projects.
+responsibility of the Foundation, Board, CPC, and projects.
 
 ## How would success be measured?
 
-Success is incorporate of the content within this document
+Success is incorporation of the content within this document
 either as the document itself or incorporate into one
 of the other Governance documents for the foundation.
 
@@ -34,4 +37,20 @@ foundation.
 
 ## What is neccessary to complete this proposal
 
+* Aligned language within the documents of the proposal
+
+## Further questions
+
+* How do we protect privacy?
+* How do we investigate?
+* What are the conflicts of interest?
+* How to avoid conflicts of interest?
+* Does this relate to the work of the Node.js and other projects’ moderation team?
+
+### Implementation details for channels
+* Form: It would be easier on the reportee to have a form template to help them structure their report. The form submission could trigger an email. TODO: copy for a form.
+* Repo: openjs/moderation (not provisioned). As commented in PR review, hosting sensitive personal information on GitHub needs due consideration, review, and possibly legal consultation.
 
+### What to look forward to
+* Beacon project
+* Code of Conduct Project: A cross-project collaboration between multiple open source tech communities RxJS, AngularJS, Node.js, Vue.js etc to find consensus on Code of Conducts. Progress is rapid and can add definition to our own process (where possible) within 6 months. Recommend incorporating the findings and avoid duplication of effort.