Project Incubation: Vexum

[DmitriyG228]

Entry Path

Direct Entry (Advanced Contribution)

Labs Compliance

• I confirm that the codebase continues to meet Labs Acceptance Requirements
• I confirm that the codebase meets Labs Ongoing Maintenance Requirements

Acceptance Checklist

• At least two maintainers from different organizations (one must be a FINOS member)
• Active use by at least two financial services organizations
• At least one detailed end-user adoption story provided
• Consistent adherence to the contribution workflow in CONTRIBUTING.md
• Public roadmap/backlog with target outcomes and timelines is available

Incubating Acceptance - Evidence

Maintainers

• Dmitry Grankin (Vexa) — @DmitriyG228
• Peter Smulovics (Morgan Stanley, a FINOS member) — @psmulovics

Active use by financial-services organizations

• A Eurosystem central bank: self-hosted and live since December 2025 (full data sovereignty). See the adoption story below. (Name withheld pending the institution's consent to be referenced publicly.)
• Morgan Stanley (FINOS member): committed to run a pilot deployment.

Detailed end-user adoption story — a Eurosystem central bank

This institution, a Eurosystem central bank, operates under strict security, data-residency, and audit requirements: meeting content cannot leave the bank's own infrastructure, and no third-party cloud or external model may process it. That rules out cloud meeting-AI and makes a self-hosted, open project necessary.

Since December 2025, the bank has run Vexa/Vexum self-hosted on their own infrastructure (OpenShift) for real-time transcription, speaker identification, and meeting storage and retrieval. They are now piloting the agentic knowledge-as-code workspace, running entirely inside the bank against the bank's own locally-served LLMs. No meeting data or inference leaves the bank's boundary.

Contribution workflow

Apache-2.0, DCO-enforced, PR-based review per https://github.com/Vexa-ai/vexa-core/blob/main/CONTRIBUTING.md . The upstream project (https://github.com/Vexa-ai/vexa — 2.2k+ stars) has an established multi-contributor track record; vexa-core is the FINOS-targeted contribution under the same workflow.

Public roadmap

https://docs.core.vexa.ai/roadmap/status (plus /stages and /approach) — staged target outcomes with an honest shipped-vs-planned status tracker.

Maintenance & Health Commitment

• The Project Team commits to public tracking of all activity using GitHub Issues
• The Project Team commits to maintaining an up-to-date shortlist of 'Good First Issues' or 'Help Wanted'
• The Project Team commits to replying to all community inquiries and issues with reasonable promptness
• The Project Team commits to publicly visible adherence and updates to the project roadmap
• The Project Team commits to pre-release integration with a FINOS-approved dependency and license scanner
• The Project Team commits to build and release processes that use NO private or undocumented steps
• The Project Team commits to presenting a project update once every six months at a public TOC meeting
• The Project Team commits to adhering to Maturity Level 2 of the OSPS Baseline

Maintenance Readiness - Evidence

The project is set up to fulfill these commitments today:

• Public activity tracking via GitHub Issues on https://github.com/Vexa-ai/vexa-core
• Coordinated-disclosure security policy: https://github.com/Vexa-ai/vexa-core/blob/main/SECURITY.md
• Apache-2.0 with NOTICE; DCO sign-off enforced on all commits (see CONTRIBUTING.md)
• Fully public build/release path — Docker Compose + Makefile, no private or undocumented steps
• Public roadmap with status tracker: https://docs.core.vexa.ai/roadmap/status

Committing to, ahead of / at incubation:

• Add a project-level OpenSSF Security Insights file
• Integrate a FINOS-approved dependency + license scanner into pre-release CI
• Reach OSPS Baseline Maturity Level 2
• Maintain an up-to-date "Good First Issues" / "Help Wanted" shortlist

Status Badging

• Project Team commits to adopt the FINOS Incubating badge in the README.md once approved

[eddie-knight]

Hey @DmitriyG228, I'm excited to review this!

Would you be willing to add a security insights file to the project repo(s) to help automate scanning of the maintenance requirements evaluation? Happy to answer any questions you have if it seems complicated, and then once that file's in place I can kick off a scan and share the results in a jiffy.

[DmitriyG228]

@eddie-knight - Will get into it later today!

[eddie-knight]

@DmitriyG228 Here's the result from the initial pass across the vexa-core repo. Pretty good for a first pass!

Most of these can be resolved with repo settings in GitHub.

The SLSA release attestation is an opinionated failure on the part of the evaluator; you may find another way to resolve BR-06.01.

I expect that the only tricky one will be SA-01.01, if you don't have fresh design documentation to link to.

Baseline scanner results

2026-07-01T16:49:19.280-0500 [ERROR] OSPS-AC-03.01: Default branch is not protected
2026-07-01T16:49:19.280-0500 [WARN]  OSPS-AC-04.01: GitHub Actions is disabled for this repository; manual review required.
2026-07-01T16:49:20.047-0500 [ERROR] OSPS-BR-04.01: The latest release does not have mention of a changelog:
2026-07-01T16:49:20.047-0500 [ERROR] OSPS-BR-06.01: No SLSA attestation found in security insights
2026-07-01T16:49:20.047-0500 [ERROR] OSPS-BR-07.01: Secret scanning is not enabled
2026-07-01T16:49:20.048-0500 [ERROR] OSPS-DO-06.01: Dependency management policy was NOT specified in Security Insights data
2026-07-01T16:49:20.573-0500 [WARN]  OSPS-QA-02.01: No dependency manifests found in the GitHub dependency graph API. Review project to ensure dependencies are managed.
2026-07-01T16:49:20.746-0500 [ERROR] OSPS-QA-03.01: Some executed status checks are not mandatory but all should be: GitGuardian Security Checks, gates, gates
2026-07-01T16:49:23.343-0500 [WARN]  OSPS-SA-01.01: No design documentation file found in root, but found directories that may contain design documentation: docs - manual review needed
2026-07-01T16:49:23.343-0500 [ERROR] > vexa-core_osps-baseline-2026-02: 20 Passed, 3 Warnings, 6 Failed

[DmitriyG228]

@eddie-knight, I ran the tests as well and have already fixed most of it. Will finalize tomorrow in the morning. As of the documentation, it's here https://github.com/Vexa-ai/vexa-core or here, if you prefer https://docs.core.vexa.ai/

[DmitriyG228]

@eddie-knight here's the rerun (run at Maturity Level 1+2):

docker run \
  --mount type=bind,source=./config.yml,destination=/.privateer/config.yml \
  --mount type=bind,source=./evaluation_results,destination=/.privateer/bin/evaluation_results \
  local 2>&1 | grep -E '\[ERROR\]|\[WARN\]'


2026-07-02T12:25:20.129Z [WARN]  OSPS-AC-03.01: Branch protection rule does not restrict pushes or require approving reviews; Rulesets not yet evaluated.
2026-07-02T12:25:20.129Z [WARN]  OSPS-AC-04.01: GitHub Actions is disabled for this repository; manual review required.
2026-07-02T12:25:22.227Z [ERROR] > vexa-core_osps-baseline: 27 Passed, 2 Warnings, 0 Failed, 40 Possible

OSPS-AC-04.01: GitHub Actions is disabled is false positive