docs(governance): adopt LF Projects policies and Community Specification structure - #127
Merged
Merged
Conversation
…ion structure Brings GOVERNANCE.md into the shape the Linux Foundation requires to host TRACE Specification as a Series of LF Projects, LLC, per formation guidance from Jory Burson (LF VP of Standards). Required by LF: - Insert the "General Project Policies" block verbatim at the top of GOVERNANCE.md, establishing the series, pointing at lfprojects.org/policies, and setting Apache-2.0 as the Project License for code and specifications with CC BY 4.0 for other documentation. Community Specification alignment (the three sections LF named), with Maintainer -> Project Lead, Working Group Participants -> Project Contributors, Working Group -> Project: - Decision Making: consensus-based decision making and appeal process. - Specification Development Process: Pre-Draft, Draft, Final, Deprecated, with what stability each status implies for implementers. - Non-Confidential, Restricted Disclosure. Also: - Contributor and Project Lead role text replaced with LF's wording. - New Backward compatibility section. TRACE does not break compatibility in a Final spec; states the conditions under which a breaking change would be considered at all, and raises the breaking-change review from 14 to a minimum 30 days, matching CHARTER.md. - Comment periods are now stated as minimums so a live discussion is not expired by a clock. Maintainer response targets stay as targets. - Normative-text conditions move from GOVERNANCE.md to CONTRIBUTING.md, where they belong as conditions on a type of contribution. - Foundation transition section rewritten; it named CoSAI and the LF entity hosting MCP, which is no longer where this is going. Relicensing: LICENSE, README badge, CHARTER.md and spec/trace-v0.2.md move specification text to Apache-2.0 and non-spec documentation to CC BY 4.0. Grants already made under CC BY 4.0 are not withdrawn. spec/trace-v0.1.md stays CC BY 4.0, and text carried forward from it into v0.2 remains dual available pending relicense consent from its contributors. Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
2 tasks
Member
Author
|
Holding this open until the Linux Foundation responds. The text on this branch is what was shared with them on 7 August, so merging before sign-off would change the version under review. Not blocked on anything our side. Will merge on explicit LF approval. |
imran-siddique
added a commit
that referenced
this pull request
Aug 8, 2026
The Later section said "CoSAI / Linux Foundation" and my first pass replaced it with AAIF. Neither is right. TRACE is being formed as its own LF series, "TRACE Specification, a Series of LF Projects, LLC", which #127 is preparing GOVERNANCE.md for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
imran-siddique
added a commit
that referenced
this pull request
Aug 8, 2026
* docs(roadmap): bring the roadmap up to what actually shipped ROADMAP.md opened with "Now - v0.1 draft (June 2026)" and listed the MCP profile, the A2A profile and cMCP Phase 2 under "Next - v0.2 (Q3 2026)", while the repository ships spec v0.2, SDK 0.6.0 and a 0.4.1 conformance suite. The roadmap is the second file a serious evaluator opens and it said the project was two months behind where it is. Now/Next/Later re-cut against the code. Shipped lists the profile URI cutover and its enforcement, the delegation link block, transparency optional below Level 2, the azure-cvm-sev-snp platform, revocation at verification time, the OWASP and Acta cross-walks, and the AGT/cMCP/sandbox producer adapters. Two corrections of substance rather than dates. The delegation block is described as the foundation the A2A profile binds to and not as the profile, because the normative binding rules are the outstanding work. And the anchor and inclusion-proof format (#111) is named as the highest priority item on the page, since without it "verifiable without trusting the operator" is a claim about the future. The platform bullet says what this repository does rather than what the stack does: the SDK verifies the record, and verification of attestation evidence lives in cmcp and agent-manifest. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(roadmap): name the actual standards home, the LF series The Later section said "CoSAI / Linux Foundation" and my first pass replaced it with AAIF. Neither is right. TRACE is being formed as its own LF series, "TRACE Specification, a Series of LF Projects, LLC", which #127 is preparing GOVERNANCE.md for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 8, 2026
imran-siddique
added a commit
that referenced
this pull request
Aug 8, 2026
… places (#133) Three documents named three different standards homes. Section 6.1 proposed splitting TRACE between CoSAI and the Linux Foundation entity hosting MCP, the README said "Targeting AAIF", and the roadmap said something else again. TRACE is being formed at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC", which #127 is preparing GOVERNANCE.md for. Section 4.1 described the MCP and A2A profiles as "targeted for v0.2" inside the v0.2 document. Neither shipped in v0.2. Both now say v0.3, and the A2A entry names what did land: the delegation link block, as the foundation the binding rules attach to. The two open questions those changes answer, Q1 host organization and Q6 A2A timing, are marked resolved in place rather than deleted, so a reader tracking them can see how they landed. The section heading moves from "before v0.2" to "before v1.0". Section 6.3 licensing is deliberately untouched. It still says CC BY 4.0 for specifications, and the LF relicensing question is live on #127. No normative text, schema, or record field changed. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
jorydotcom
reviewed
Aug 10, 2026
| @@ -1,54 +1,109 @@ | |||
| # Governance | |||
There was a problem hiding this comment.
Some adds to this file if fully adopting the Community Specification License -
Section 3 Ways of Working surfaces the project's intention to operate in accordance with standards development principles.
imran-siddique
added a commit
that referenced
this pull request
Aug 10, 2026
The LF announcement describes TRACE as its own LF Projects series, but CHARTER.md still opened with the superseded plan to split the technical workstream to CoSAI and the spec, IP, and trademark to the LF entity hosting MCP. spec/trace-v0.2.md §6.1 already supersedes that; the charter had not caught up. PR #127 fixes GOVERNANCE.md and the license story; this covers the gaps it leaves. - CHARTER.md: hosting is the LF series, CoSAI is a WS4 technical-liaison partner and not a host; timeline row renamed to match - "hardware-enforced" -> "hardware-attested" in the charter mission and the spec abstract. CHARTER §2 puts runtime policy enforcement engines out of scope, so calling the record hardware-enforced contradicted the charter, and it is the term partner reviewers are most likely to challenge - MAINTAINERS.md: GitHub handle @imraan 404s, corrected to @imran-siddique - README.md and docs/index.md: use the acronym expansion from the spec titles, "Trust, Runtime Attestation, and Compliance Evidence", so the repo, the spec, and the press materials all read the same Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
Closed
2 tasks
imran-siddique
added a commit
that referenced
this pull request
Aug 11, 2026
#153) The LF announcement describes TRACE as its own LF Projects series, but CHARTER.md still opened with the superseded plan to split the technical workstream to CoSAI and the spec, IP, and trademark to the LF entity hosting MCP. spec/trace-v0.2.md §6.1 already supersedes that; the charter had not caught up. PR #127 fixes GOVERNANCE.md and the license story; this covers the gaps it leaves. - CHARTER.md: hosting is the LF series, CoSAI is a WS4 technical-liaison partner and not a host; timeline row renamed to match - "hardware-enforced" -> "hardware-attested" in the charter mission and the spec abstract. CHARTER §2 puts runtime policy enforcement engines out of scope, so calling the record hardware-enforced contradicted the charter, and it is the term partner reviewers are most likely to challenge - MAINTAINERS.md: GitHub handle @imraan 404s, corrected to @imran-siddique - README.md and docs/index.md: use the acronym expansion from the spec titles, "Trust, Runtime Attestation, and Compliance Evidence", so the repo, the spec, and the press materials all read the same Signed-off-by: Imran Siddique <imran.siddique@opaque.co> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings
GOVERNANCE.mdinto the shape the Linux Foundation requires to host TRACE Specification as a Series of LF Projects, LLC. Implements the formation guidance from Jory Burson (LF VP of Standards), 7 Aug 2026.Sources used: the LF formation instructions document (§ "General Project Policies") and CommunitySpecification/Community_Specification 05-governance.md.
Required by LF
The General Project Policies block is inserted verbatim at the top of
GOVERNANCE.md, unedited.Community Specification sections
The three sections LF named, with the substitutions requested (
Maintainer→Project Lead,Working Group Participants→Project Contributors,Working Group→Project):"Ways of Working" (the ANSI due-process section) was not adopted; it was not in the ask.
Other changes from the review
CHARTER.mdThe Foundation transition section is rewritten. It said TRACE was targeting CoSAI and the LF entity hosting MCP, which is not where this is going.
Licensing: please confirm
Two items for LF, both flagged rather than assumed.
1. The relicense. The required language makes Apache-2.0 the Project License for "all code and specification contributions" and puts CC BY 4.0 on "documentation (excluding specifications)". TRACE shipped the inverse: spec text CC BY 4.0, code Apache-2.0. This PR moves to the LF default rather than asking for the Maintainer exception.
LICENSE, the README badge,CHARTER.md§4 andspec/trace-v0.2.mdare updated. Grants already made under CC BY 4.0 are not withdrawn.2. Consent for carried-forward text.
spec/trace-v0.1.mdincludes §3.3.2, contributed by an outside contributor (@carloshvp, #92 and #94) under the CC BY 4.0 terms in force at the time. That text is present inspec/trace-v0.2.md. Relicensing it to Apache-2.0 needs their consent, which has not been sought yet. Until it is recorded,LICENSEstates that portions carried forward from v0.1 remain available under CC BY 4.0 and a recipient may rely on either license.spec/trace-v0.1.mditself stays CC BY 4.0 as a superseded version.Happy to take either as a review comment.
Not in this PR
CHARTER.mdbeyond the licensing sentence. LF is supplying the Technical Charter template, so the existing charter is left for that pass.MAINTAINERS.mdneeds no change; it already lists the Project Lead, as the new role text requires.