diff --git a/CHARTER.md b/CHARTER.md index dbd2aa82..7df8344e 100644 --- a/CHARTER.md +++ b/CHARTER.md @@ -45,7 +45,7 @@ Upon host organization acceptance, governance transitions from the current Proje All contributions must be made under the terms of [LICENSE](LICENSE). Contributors must sign commits with the Developer Certificate of Origin (DCO). No contribution may incorporate material covered by a patent the contributor is unwilling to license royalty-free to conforming implementations. -Specification text, schema, examples, and code are licensed under Apache 2.0, the Project License, with Patent Promise. Documentation other than specification text is licensed under CC BY 4.0. Specification text published before the Project License took effect stays available under CC BY 4.0. See [LICENSE](LICENSE). +Normative specification text and the normative TRACE JSON Schema are licensed under the Community Specification License 1.0. Source code, examples, workflows, and tests are licensed under Apache License 2.0. Documentation other than specification materials is licensed under CC BY 4.0. Earlier specification publications remain available under the licenses stated when they were published. See [LICENSE](LICENSE) and the [license map](Governance/License.md). ## 5. Trademark Policy diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 71e6a277..6ed66d69 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -90,4 +90,4 @@ Maintainer response targets are commitments to you, not minimums. Ping the PR if Anyone who submits a PR, files an issue, or participates in discussion on the repository is a Contributor bound by the license terms. -Code and specification contributions are made under the Apache License, Version 2.0, the Project License. Documentation contributions other than specification text are made under CC BY 4.0. You keep the copyright in your contributions: no contributor is asked to assign copyright to the project. See [LICENSE](LICENSE) and [General Project Policies](GOVERNANCE.md#general-project-policies). +Specification contributions are made under the [Community Specification License 1.0](Governance/COMMUNITY-SPECIFICATION-LICENSE.md) and the [Community Specification Contributor License Agreement](Governance/CLA.md). Source-code contributions are made under Apache License 2.0. Documentation contributions other than specification text are made under CC BY 4.0. You keep the copyright in your contributions: no contributor is asked to assign copyright to the project. See [LICENSE](LICENSE), the [license map](Governance/License.md), and [General Project Policies](GOVERNANCE.md#general-project-policies). diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 4ba25d31..8a2a5a82 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -6,13 +6,13 @@ TRACE Specification has been established as TRACE Specification a Series of LF P TRACE Specification participants acknowledge that the copyright in all new contributions will be retained by the copyright holder as independent works of authorship and that no contributor or copyright holder will be required to assign copyrights to the project. -Except as described below, all code and specification contributions to the project must be made using the Apache License, Version 2.0 available at http://www.apache.org/licenses/LICENSE-2.0 (the "Project License"). +All specification contributions to the Project must be made under the [Community Specification License 1.0](Governance/COMMUNITY-SPECIFICATION-LICENSE.md) and the [Community Specification Contributor License Agreement](Governance/CLA.md). -All outbound code and specifications will be made available under the Project License. The Maintainers may approve the use of an alternative open license or licenses for inbound or outbound contributions on an exception basis. +All code contributions to the Project must be made under the Apache License, Version 2.0, available at https://www.apache.org/licenses/LICENSE-2.0 (the "Source Code License"). Outbound code will be made available under the Source Code License. The Maintainers may approve an alternative open source license for code on an exception basis. All documentation (excluding specifications) will be made available under the Creative Commons Attribution 4.0 International license, available at: https://creativecommons.org/licenses/by/4.0. -Specification text published before this policy took effect stays available under the license it was published under. See [LICENSE](LICENSE). +Specification text published before this policy took effect stays available under the license under which it was published. See [LICENSE](LICENSE) and the [license map](Governance/License.md). ## Roles @@ -48,6 +48,34 @@ The Project makes decisions through a consensus process ("Approval" or "Approved Decisions may be appealed via a pull request or an issue, and that appeal will be considered by the Project Lead in good faith, who will respond in writing within a reasonable time. +## Ways of Working + +Inspired by [ANSI's Essential Requirements for Due Process](https://share.ansi.org/Shared%20Documents/Standards%20Activities/American%20National%20Standards/Procedures,%20Guides,%20and%20Forms/2020_ANSI_Essential_Requirements.pdf), the Project adheres to consensus-based due-process requirements for approving, revising, reaffirming, and withdrawing TRACE specifications. Any person or organization with a direct and material interest has the right to express a position and its basis, have that position considered, and appeal a decision. + +### Openness + +Participation is open to all persons and organizations directly and materially affected by the work. There are no undue financial barriers to participation. Voting or decision-making eligibility is not conditional on membership in another organization or unreasonably restricted by technical qualifications. + +### Lack of dominance + +The specification-development process must not be dominated by any single interest category, individual, or organization to the exclusion of fair and equitable consideration of other viewpoints. + +### Balance + +The Project seeks participation from diverse interest categories, including implementers, technology providers, users, security and privacy experts, and other materially affected parties. + +### Coordination and harmonization + +The Project makes good-faith efforts to identify and resolve conflicts between TRACE deliverables and existing industry standards. + +### Consideration of views and objections + +The Project promptly considers written views and objections from all Contributors. The Project Lead documents the evidence used to determine Consensus, including material objections and their disposition. + +### Written procedures + +This governance document and other materials describing the Community Specification development process are publicly available to any interested person. + ### Review periods by change class Review periods are minimums. The Project takes as much time as it needs to reach a consensus decision, and a period does not expire a discussion that is still live. @@ -76,7 +104,7 @@ A Draft Specification is not stable. Normative requirements, wire formats, and c ### Final -Once the Project believes it has achieved the objectives for its specification as described in the Scope, it will Approve that Draft Specification and progress it to "Final" status. +Once the Project believes it has achieved the objectives for its specification as described in the [Scope](Governance/Scope.md), it will Approve that Draft Specification and progress it to "Final" status. A Final specification is an "Approved Specification" for purposes of the Community Specification License 1.0. A Final specification is stable. Its normative content does not change except through errata, which are corrections that do not alter what a conformant implementation must do. New requirements are made in a new version, not in the published one. Conformance claims are made against a Final version, and the conformance suite tracks Final versions. diff --git a/Governance/CLA.md b/Governance/CLA.md new file mode 100644 index 00000000..44246f47 --- /dev/null +++ b/Governance/CLA.md @@ -0,0 +1,18 @@ +# Community Specification Contributor License Agreement 1.0 + +By making a Contribution to this repository, I agree to the terms of the following documents: + +(a) [Community Specification License 1.0](COMMUNITY-SPECIFICATION-LICENSE.md) + +(b) [TRACE Governance Policy](../GOVERNANCE.md) + +(c) [TRACE Contribution Policy](../CONTRIBUTING.md) + +(d) [TRACE Code of Conduct](../CODE_OF_CONDUCT.md) + + +In addition, for source code contributions, I certify that: + +(a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. (d) I understand and agree that this working group and the contribution may be public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this agreement or the open source license(s) involved. + +I represent that I am legally entitled to make the grants set forth in the documents above. If my employer(s) has rights to intellectual property that may be infringed by the materials developed by this Project, I represent that I have received permission to enter these agreements on behalf of that employer. diff --git a/Governance/COMMUNITY-SPECIFICATION-LICENSE.md b/Governance/COMMUNITY-SPECIFICATION-LICENSE.md new file mode 100644 index 00000000..06ac447e --- /dev/null +++ b/Governance/COMMUNITY-SPECIFICATION-LICENSE.md @@ -0,0 +1,99 @@ +# Community Specification License 1.0 + +**The Purpose of this License.** This License sets forth the terms under which 1) Contributor will participate in and contribute to the development of specifications, standards, best practices, guidelines, and other similar materials under this Working Group, and 2) how the materials developed under this License may be used. It is not intended for source code. Capitalized terms are defined in the License’s last section. + +**1. Copyright.** + +**1.1. Copyright License.** Contributor grants everyone a non-sublicensable, perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as expressly stated in this License) copyright license, without any obligation for accounting, to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute any materials it submits to the full extent of its copyright interest in those materials. Contributor also acknowledges that the Working Group may exercise copyright rights in the Specification, including the rights to submit the Specification to another standards organization. + +**1.2. Copyright Attribution.** As a condition, anyone exercising this copyright license must include attribution to the Working Group in any derivative work based on materials developed by the Working Group. That attribution must include, at minimum, the material’s name, version number, and source from where the materials were retrieved. Attribution is not required for implementations of the Specification. + +**2. Patents.** + +**2.1. Patent License.** + +**2.1.1. As a Result of Contributions.** + +**2.1.1.1. As a Result of Contributions to Draft Specifications.** Contributor grants Licensee a non-sublicensable, perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as expressly stated in this License) license to its Necessary Claims in 1) Contributor’s Contributions and 2) to the Draft Specification that is within Scope as of the date of that Contribution, in both cases for Licensee’s Implementation of the Draft Specification, except for those patent claims excluded by Contributor under Section 3. + +**2.1.1.2. For Approved Specifications.** Contributor grants Licensee a non-sublicensable, perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as expressly stated in this License) license to its Necessary Claims included in the Approved Specification that are within Scope for Licensee’s Implementation of the Approved Specification, except for those patent claims excluded by Contributor under Section 3. + +**2.1.2. Patent Grant from Licensee.** Licensee grants each other Licensee a non-sublicensable, perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as expressly stated in this License) license to its Necessary Claims for its Implementation, except for those patent claims excluded under Section 3. + +**2.1.3. Licensee Acceptance.** The patent grants set forth in Section 2.1 extend only to Licensees that have indicated their agreement to this License as follows: + +**2.1.3.1. Source Code Distributions.** For distribution in source code, by including this License in the root directory of the source code with the Implementation; + +**2.1.3.2. Non-Source Code Distributions.** For distribution in any form other than source code, by including this License in the documentation, legal notices, via notice in the software, and/or other written materials provided with the Implementation; or + +**2.1.3.3. Via Notices.md.** By issuing pull request or commit to the Specification’s repository’s Notices.md file by the Implementer’s authorized representative, including the Implementer’s name, authorized individual and system identifier, and Specification version. + +**2.1.4. Defensive Termination.** If any Licensee files or maintains a claim in a court asserting that a Necessary Claim is infringed by an Implementation, any licenses granted under this License to the Licensee are immediately terminated unless 1) that claim is directly in response to a claim against Licensee regarding an Implementation, or 2) that claim was brought to enforce the terms of this License, including intervention in a third-party action by a Licensee. + +**2.1.5. Additional Conditions.** This License is not an assurance (i) that any of Contributor’s copyrights or issued patent claims cover an Implementation of the Specification or are enforceable or (ii) that an Implementation of the Specification would not infringe intellectual property rights of any third party. + +**2.2. Patent Licensing Commitment.** In addition to the rights granted in Section 2.1, Contributor agrees to grant everyone a no charge, royalty-free license on reasonable and non-discriminatory terms to Contributor’s Necessary Claims that are within Scope for: +1) Implementations of a Draft Specification, where such license applies only to those Necessary Claims infringed by implementing Contributor's Contribution(s) included in that Draft Specification, and +2) Implementations of the Approved Specification. + +This patent licensing commitment does not apply to those claims subject to Contributor’s Exclusion Notice under Section 3. + +**2.3. Effect of Withdrawal.** Contributor may withdraw from the Working Group by issuing a pull request or commit providing notice of withdrawal to the Working Group repository’s Notices.md file. All of Contributor’s existing commitments and obligations with respect to the Working Group up to the date of that withdrawal notice will remain in effect, but no new obligations will be incurred. + +**2.4. Binding Encumbrance.** This License is binding on any future owner, assignee, or party who has been given the right to enforce any Necessary Claims against third parties. + +**3. Patent Exclusion.** + +**3.1. As a Result of Contributions.** Contributor may exclude Necessary Claims from its licensing commitments incurred under Section 2.1.1 by issuing an Exclusion Notice within 45 days of the date of that Contribution. Contributor may not issue an Exclusion Notice for any material that has been included in a Draft Deliverable for more than 45 days prior to the date of that Contribution. + +**3.2. As a Result of a Draft Specification Becoming an Approved Specification.** Prior to the adoption of a Draft Specification as an Approved Specification, Contributor may exclude Necessary Claims from its licensing commitments under this Agreement by issuing an Exclusion Notice. Contributor may not issue an Exclusion Notice for patents that were eligible to have been excluded pursuant to Section 3.1. + +**4. Source Code License.** Any source code developed by the Working Group is solely subject the source code license included in the Working Group’s repository for that code. If no source code license is included, the source code will be subject to the MIT License. + +**5. No Other Rights.** Except as specifically set forth in this License, no other express or implied patent, trademark, copyright, or other rights are granted under this License, including by implication, waiver, or estoppel. + +**6. Antitrust Compliance.** Contributor acknowledge that it may compete with other participants in various lines of business and that it is therefore imperative that they and their respective representatives act in a manner that does not violate any applicable antitrust laws and regulations. This License does not restrict any Contributor from engaging in similar specification development projects. Each Contributor may design, develop, manufacture, acquire or market competitive deliverables, products, and services, and conduct its business, in whatever way it chooses. No Contributor is obligated to announce or market any products or services. Without limiting the generality of the foregoing, the Contributors agree not to have any discussion relating to any product pricing, methods or channels of product distribution, division of markets, allocation of customers or any other topic that should not be discussed among competitors under the auspices of the Working Group. + +**7. Non-Circumvention.** Contributor agrees that it will not intentionally take or willfully assist any third party to take any action for the purpose of circumventing any obligations under this License. + +**8. Representations, Warranties and Disclaimers.** + +**8.1. Representations, Warranties and Disclaimers.** Contributor and Licensee represents and warrants that 1) it is legally entitled to grant the rights set forth in this License and 2) it will not intentionally include any third party materials in any Contribution unless those materials are available under terms that do not conflict with this License. IN ALL OTHER RESPECTS ITS CONTRIBUTIONS ARE PROVIDED "AS IS." The entire risk as to implementing or otherwise using the Contribution or the Specification is assumed by the implementer and user. Except as stated herein, CONTRIBUTOR AND LICENSEE EXPRESSLY DISCLAIM ANY WARRANTIES (EXPRESS, IMPLIED, OR OTHERWISE), INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, FITNESS FOR A PARTICULAR PURPOSE, CONDITIONS OF QUALITY, OR TITLE, RELATED TO THE CONTRIBUTION OR THE SPECIFICATION. IN NO EVENT WILL ANY PARTY BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Any obligations regarding the transfer, successors in interest, or assignment of Necessary Claims will be satisfied if Contributor or Licensee notifies the transferee or assignee of any patent that it knows contains Necessary Claims or necessary claims under this License. Nothing in this License requires Contributor to undertake a patent search. If Contributor is 1) employed by or acting on behalf of an employer, 2) is making a Contribution under the direction or control of a third party, or 3) is making the Contribution as a consultant, contractor, or under another similar relationship with a third party, Contributor represents that they have been authorized by that party to enter into this License on its behalf. + +**8.2. Distribution Disclaimer.** Any distributions of technical information to third parties must include a notice materially similar to the following: “THESE MATERIALS ARE PROVIDED “AS IS.” The Contributors and Licensees expressly disclaim any warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to the materials. The entire risk as to implementing or otherwise using the materials is assumed by the implementer and user. IN NO EVENT WILL THE CONTRIBUTORS OR LICENSEES BE LIABLE TO ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF ACTION OF ANY KIND WITH RESPECT TO THIS DELIVERABLE OR ITS GOVERNING AGREEMENT, WHETHER BASED ON BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR NOT THE OTHER MEMBER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.” + +**9. Definitions.** + +**9.1. Affiliate.** “Affiliate” means an entity that directly or indirectly Controls, is Controlled by, or is under common Control of that party. + +**9.2. Approved Specification.** “Approved Specification” means the final version and contents of any Draft Specification designated as an Approved Specification as set forth in the accompanying Governance.md file. + +**9.3. Contribution.** “Contribution” means any original work of authorship, including any modifications or additions to an existing work, that Contributor submits for inclusion in a Draft Specification, which is included in a Draft Specification or Approved Specification. + +**9.4. Contributor.** “Contributor” means any person or entity that has indicated its acceptance of the License 1) by making a Contribution to the Specification, or 2) by entering into the Community Specification Contributor License Agreement for the Specification. Contributor includes its Affiliates, assigns, agents, and successors in interest. + +**9.5. Control.** “Control” means direct or indirect control of more than 50% of the voting power to elect directors of that corporation, or for any other entity, the power to direct management of such entity. + +**9.6. Draft Specification.** “Draft Specification” means all versions of the material (except an Approved Specification) developed by this Working Group for the purpose of creating, commenting on, revising, updating, modifying, or adding to any document that is to be considered for inclusion in the Approved Specification. + +**9.7. Exclusion Notice.** “Exclusion Notice” means a written notice made by making a pull request or commit to the repository’s Notices.md file that identifies patents that Contributor is excluding from its patent licensing commitments under this License. The Exclusion Notice for issued patents and published applications must include the Draft Specification’s name, patent number(s) or title and application number(s), as the case may be, for each of the issued patent(s) or pending patent application(s) that the Contributor is excluding from the royalty-free licensing commitment set forth in this License. If an issued patent or pending patent application that may contain Necessary Claims is not set forth in the Exclusion Notice, those Necessary Claims shall continue to be subject to the licensing commitments under this License. The Exclusion Notice for unpublished patent applications must provide either: (i) the text of the filed application; or (ii) identification of the specific part(s) of the Draft Specification whose implementation makes the excluded claim a Necessary Claim. If (ii) is chosen, the effect of the exclusion will be limited to the identified part(s) of the Draft Specification. + +**9.8. Implementation.** “Implementation” means making, using, selling, offering for sale, importing or distributing any implementation of the Specification 1) only to the extent it implements the Specification and 2) so long as all required portions of the Specification are implemented. + +**9.9. License.** “License” means this Community Specification License. + +**9.10. Licensee.** “Licensee” means any person or entity that has indicated its acceptance of the License as set forth in Section 2.1.3. Licensee includes its Affiliates, assigns, agents, and successors in interest. + +**9.11. Necessary Claims.** “Necessary Claims” are those patent claims, if any, that a party owns or controls, including those claims later acquired, that are necessary to implement the required portions (including the required elements of optional portions) of the Specification that are described in detail and not merely referenced in the Specification. + +**9.12. Specification.** “Specification” means a Draft Specification or Approved Specification included in the Working Group’s repository subject to this License, and the version of the Specification implemented by the Licensee. + +**9.13. Scope.** “Scope” has the meaning as set forth in the accompanying Scope.md file included in this Specification’s repository. Changes to Scope do not apply retroactively. If no Scope is provided, each Contributor’s Necessary Claims are limited to that Contributor’s Contributions. + +**9.14. Working Group.** “Working Group” means this project to develop specifications, standards, best practices, guidelines, and other similar materials under this License. + + + +*The text of this Community Specification License is Copyright 2020 Joint Development Foundation and is licensed under the Creative Commons Attribution 4.0 International License available at https://creativecommons.org/licenses/by/4.0/.* + +SPDX-License-Identifier: CC-BY-4.0 diff --git a/Governance/License.md b/Governance/License.md new file mode 100644 index 00000000..8931b4c9 --- /dev/null +++ b/Governance/License.md @@ -0,0 +1,27 @@ +# Licenses + +This repository contains specification materials, source code, and documentation. Different licenses apply to each category. + +## Specification License + +TRACE specification materials are subject to the [Community Specification License 1.0](COMMUNITY-SPECIFICATION-LICENSE.md). This category includes: + +- normative specification text under `spec/`; +- the normative TRACE JSON Schema at `schema/trace-claim.json`; and +- other files expressly identified as part of a Draft Specification or Approved Specification. + +Earlier specification publications remain available under the licenses stated when they were published. See the repository [LICENSE](../LICENSE) for that history. + +## Source Code License + +Source code, SDK code, test code, examples, workflows, and sample or reference code included in specification materials are subject to the [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0), unless a file states otherwise. + +This category includes `src/`, `tests/`, `examples/`, and `.github/`. + +## Documentation License + +Documentation other than specification materials is subject to the [Creative Commons Attribution 4.0 International License](https://creativecommons.org/licenses/by/4.0/), unless a file states otherwise. + +This category includes `README.md`, `CHANGELOG.md`, `docs/`, and project-process documents. + +If a file combines specification text and source code, the Community Specification License applies to the specification text and Apache-2.0 applies to the source-code portions, unless the file states otherwise. In the event of a conflict about whether material forms part of a TRACE Draft Specification or Approved Specification, the Community Specification License controls for that material. diff --git a/Governance/Notices.md b/Governance/Notices.md new file mode 100644 index 00000000..6fe8c6c6 --- /dev/null +++ b/Governance/Notices.md @@ -0,0 +1,44 @@ +# Notices + +## Code of Conduct + +Contact for Code of Conduct issues or inquiries: + +- Imran Siddique, Project Lead — imran.siddique@opaque.co + +Reports are handled under the project [Code of Conduct](../CODE_OF_CONDUCT.md). + +## License Acceptance + +Under Community Specification License 1.0 Section 2.1.3.3, a Licensee may indicate acceptance of the Community Specification License by submitting a pull request to this file that includes the Licensee's name, the authorized individual's name and system identifier (for example, a GitHub ID), and the specification version. + +A Licensee may accept the current Community Specification License version or any future version by writing "or later" after the specification version. + +### Acceptance template + +- Licensee's name: +- Authorized individual and system identifier: +- Specification version: + +## Withdrawals + +A Contributor may withdraw from the Project by submitting a pull request that records: + +- Name of party withdrawing: +- Date of withdrawal: + +Existing commitments and obligations through the date of withdrawal remain in effect as provided by the Community Specification License. + +## Exclusions + +This section records Exclusion Notices made under the Community Specification License. Each notice must identify: + +- name of the party making the Exclusion Notice; +- name of the patent owner; +- specification and version; +- for issued patents or published applications, the patent number or the title and application number; and +- the specific part of the Specification whose implementation makes the excluded claim a Necessary Claim. + +For an unpublished patent application, the notice must instead provide either the text of the filed application or identify the specific part of the Specification whose implementation makes the excluded claim a Necessary Claim. + +No Exclusion Notices have been recorded. diff --git a/Governance/Scope.md b/Governance/Scope.md new file mode 100644 index 00000000..fbb4b385 --- /dev/null +++ b/Governance/Scope.md @@ -0,0 +1,26 @@ +# Scope + +The TRACE Specification Project develops technical specifications for portable, independently verifiable evidence about governed AI-agent and confidential-workload execution. + +The Project's Scope includes normative requirements for: + +- the structure, syntax, semantics, and serialization of TRACE Trust Records; +- cryptographic signing, integrity protection, key binding, verification, and freshness of those records; +- claims that identify workloads, policies, data classifications, tools, execution sessions, and verification results; +- profiles that bind TRACE evidence to trusted-execution-environment attestation and other authenticated evidence; +- transparency, receipt, and anchoring mechanisms used to make TRACE evidence independently verifiable and durable; +- conformance levels, verification procedures, registries, and testable requirements necessary to implement the specification; and +- compatibility and composition with external standards expressly profiled by TRACE. + +The Scope includes required and optional portions of TRACE specifications only to the extent they are described in detail in a Draft Specification or Approved Specification. A reference to an external standard does not bring that external standard into Scope. + +The following are outside Scope: + +- source code, SDKs, test harnesses, examples, and reference implementations, which are licensed separately; +- the internal design or implementation of processors, trusted execution environments, cryptographic libraries, transparency services, or external standards; +- AI-model architecture, training, safety, quality, or semantic behavior except where TRACE defines evidence fields about those properties; +- runtime policy-enforcement products, credential brokers, gateways, or hosted services except for the interfaces and evidence semantics expressly specified by TRACE; +- hardware side-channel mitigations and physical security; and +- business, regulatory, or operational requirements that are not expressed as normative TRACE conformance requirements. + +Any changes to Scope are not retroactive. diff --git a/LICENSE b/LICENSE index 62132178..bbb0dba2 100644 --- a/LICENSE +++ b/LICENSE @@ -1,20 +1,24 @@ TRACE Specification, a Series of LF Projects, LLC. -PROJECT LICENSE -=============== +SPECIFICATION LICENSE +===================== +Community Specification License 1.0 +Governance/COMMUNITY-SPECIFICATION-LICENSE.md + +TRACE specification materials are made available under the Community +Specification License 1.0. This covers normative specification text under +spec/, the normative JSON Schema at schema/trace-claim.json, and other +materials expressly identified as part of a Draft Specification or Approved +Specification. + +SOURCE CODE LICENSE +=================== Apache License, Version 2.0 https://www.apache.org/licenses/LICENSE-2.0 -Except as described below, all code and specification contributions to the -project are made under the Apache License, Version 2.0 (the "Project -License"), and all outbound code and specifications are made available under -the Project License. This covers: - - spec/ specification text - schema/ JSON Schema - examples/ example Trust Records - src/, tests/ reference implementation and tests - .github/ workflows and templates +Source code, SDK code, test code, examples, workflows, and sample or +reference code are made available under Apache License 2.0 unless a file +states otherwise. This covers src/, tests/, examples/, and .github/. Copyright 2026 OPAQUE Systems, Inc. and the TRACE Specification contributors. @@ -57,9 +61,8 @@ CC BY 4.0. Those grants stand: is forward-looking and does not withdraw a grant already made. Portions of spec/trace-v0.1.md carried forward into later specification -versions remain available under CC BY 4.0 until the contributors of those -portions have recorded their consent to the Project License. Where both -licenses apply to the same text, a recipient may rely on either. +versions remain available under CC BY 4.0. Where both licenses apply to the +same text, a recipient may rely on either. PATENT PROMISE ============== @@ -68,5 +71,7 @@ license under any patent claims it controls that are necessarily infringed by a conforming implementation of this specification, for the purpose of implementing or operating a product that conforms to this specification. This promise applies to v0.1 and all subsequent versions of TRACE. It is -made in addition to, and does not narrow, the patent grant in Section 3 of -the Apache License, Version 2.0. +made in addition to, and does not narrow, patent rights granted under the +Community Specification License or the Apache License, Version 2.0. + +For a concise file-by-file license map, see Governance/License.md. diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 681512be..3d9847b4 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -4,7 +4,7 @@ | Name | Affiliation | GitHub | Contact | |---|---|---|---| -| Imran Siddique | OPAQUE Systems | @imran-siddique | maintainers@agentrust.io | +| Imran Siddique | OPAQUE Systems | @imran-siddique | imran.siddique@opaque.co | The Project Lead has final decision authority on specification changes, AAIF/CoSAI submission scope, conformance requirements, and Maintainer appointments. diff --git a/README.md b/README.md index 86d76808..a2648b77 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,8 @@ Reference Impl

-[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-lightgrey.svg)](LICENSE) +[![Specification: Community Specification License 1.0](https://img.shields.io/badge/Specification-Community_Specification_License_1.0-blue.svg)](Governance/COMMUNITY-SPECIFICATION-LICENSE.md) +[![Code: Apache 2.0](https://img.shields.io/badge/Code-Apache_2.0-lightgrey.svg)](LICENSE) [![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.2.md) [![PyPI](https://img.shields.io/pypi/v/agentrust-trace)](https://pypi.org/project/agentrust-trace/) [![CI](https://github.com/agentrust-io/trace-spec/actions/workflows/ci.yml/badge.svg)](https://github.com/agentrust-io/trace-spec/actions/workflows/ci.yml) diff --git a/spec/trace-v0.1.md b/spec/trace-v0.1.md index e54d49a3..54e90b81 100644 --- a/spec/trace-v0.1.md +++ b/spec/trace-v0.1.md @@ -6,7 +6,7 @@ |---|---| | Version | 0.1 — Draft | | Status | RFC — Request for Comments | -| Authors | Rishabh Poddar, Aaron Fulkerson (OPAQUE Systems) | +| Authors | Imran Siddique, Rishabh Poddar, Aaron Fulkerson (OPAQUE Systems) | | Target announcement | Confidential Computing Summit, San Francisco — 23 June 2026 | | Reference implementation | [agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) — Confidential MCP | | License | CC BY 4.0 | diff --git a/spec/trace-v0.2.md b/spec/trace-v0.2.md index b3253f1e..215f5d3f 100644 --- a/spec/trace-v0.2.md +++ b/spec/trace-v0.2.md @@ -4,10 +4,10 @@ |---|---| | Version | 0.2 — Draft | | Status | RFC — Request for Comments | -| Authors | Rishabh Poddar, Aaron Fulkerson (OPAQUE Systems) | +| Authors | Imran Siddique, Rishabh Poddar, Aaron Fulkerson (OPAQUE Systems) | | Target announcement | Confidential Computing Summit, San Francisco — 23 June 2026 | | Reference implementation | [agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) — Confidential MCP | -| License | Apache 2.0 (see [LICENSE](../LICENSE)) | +| License | Community Specification License 1.0 (see [LICENSE](../LICENSE)) | > **Note:** This is a pre-ratification draft. Fields, wire formats, and conformance requirements are subject to change before v1.0. Send feedback to: open an issue on this repository. @@ -430,7 +430,7 @@ Anthropic, NVIDIA, Intel, AMD, Microsoft, Google, Linux Foundation, Confidential ### 6.3 IP and licensing -- **Specifications:** Apache 2.0, the Project License. Text carried forward from v0.1 also remains available under CC BY 4.0. +- **Specifications:** Community Specification License 1.0. Earlier publications and carried-forward text remain available under the licenses stated when they were published. - **Reference code:** Apache 2.0. - **Test suite:** Apache 2.0, mandatory for conformance claims. - **Conformance mark:** managed by host org.