[WIP] Start a Golden contrib module guidelines section

docs/develop/repositories.md

@@ -24,3 +24,23 @@ Thease feature branches don't have to be pushed to D.o, and can be removed after
 ### Pull requests
 
 - When a PR is not ready you can prefix the title with: `[WIP]`.
+
+### Golden Contrib
+
+We started adding more modules during the 3.x cycle and invented the *Golden Contrib* name for it.
+
+The idea is to package modules that extend Aegir to make them easier to install.  [Their descriptions](/extend/contrib/#golden-contrib) are listed on the Contributed Projects page.
+
+These are included from our [makefiles](http://cgit.drupalcode.org/hostmaster/tree/drupal-org.make) and end up in `profiles/hostmaster/modules/aegir/`.
+
+#### Golden contrib module guidelines
+
+- It should have a full release on Drupal.org
+- It should be covered by the security team.
+- There should be the intention to maintain the module for the longer term, at least as long as the current stable Aegir release.
+- All Aegir core maintainers should have access to the module project on Drupal.org.  However, a minimum of two is required at all times. Use [the current maintainers list](/community/core-team/#current-members) for reference.
+- Where appropriate it should include a file for Aegir's feature system. E.g. [hosting.feature.modulename.inc](http://cgit.drupalcode.org/hosting/tree/example/site_data/hosting.feature.site_data.inc)
+- It should be security reviewed by other core maintainers, keeping the following in mind:
+    * The module should not increase the system's attack surface.
+    * If it does, a strong warning must be provided in the description.
+* It should not encourage users to perform dangerous operations, from which there is no recovery.  If such features are requested, their use must come with warnings.

docs/extend/contrib.md

@@ -11,7 +11,7 @@ Note that the support and development status varies for these. Please evaluate e
 
 ### Included in Aegir package
 
-These ship with Aegir (the ["golden contrib"](http://cgit.drupalcode.org/hostmaster/tree/drupal-org.make) suite of modules) so their features simply require enabling if desired.  For the others, manual installation is required.
+These ship with Aegir (the [Golden Contrib](http://cgit.drupalcode.org/hostmaster/tree/drupal-org.make) suite of modules) so their features simply require enabling if desired.  See [the guidelines](/develop/repositories#golden-contrib-module-guidelines) for inclusion.  For the others, manual installation is required.
 
 #### [Hosting CiviCRM](https://www.drupal.org/project/hosting_civicrm)