diff --git a/.github/ISSUE_TEMPLATE/membership-agreement.yml b/.github/ISSUE_TEMPLATE/membership-agreement.yml index 2a78ec9..7f0581a 100644 --- a/.github/ISSUE_TEMPLATE/membership-agreement.yml +++ b/.github/ISSUE_TEMPLATE/membership-agreement.yml @@ -1,22 +1,24 @@ name: "OpenDKG membership and agreement" -description: "Request OpenDKG organization membership after reviewing and accepting the versioned policies." +description: "For future non-founder members: request membership after reading and accepting the versioned policies." title: "[Membership request] " body: - type: markdown attributes: value: | - ## OpenDKG membership request — version 1.0 + ## OpenDKG membership request — version 1.0 (non-founder applicants) + **The three original equal cofounders must use [Founders' Issue #3](https://github.com/OpenDKG/.github/issues/3) instead, whether or not they have already joined the organization. This form is for other applicants, and submitting it does NOT make anyone a cofounder or administrator.** + **Only applications filed in [OpenDKG/.github](https://github.com/OpenDKG/.github/issues/new?template=membership-agreement.yml) are processed.** This template can also be visible as an organization default in other repositories; do not file there. **Read these pinned documents before checking any boxes:** - - [Contributor Agreement v1.0](https://github.com/OpenDKG/.github/blob/12b4e5bfb23285f66127cfb979ed1327eaab8e64/CONTRIBUTOR_AGREEMENT.md) - - [Governance v1.0](https://github.com/OpenDKG/.github/blob/12b4e5bfb23285f66127cfb979ed1327eaab8e64/GOVERNANCE.md) - - [Contribution guidelines v1.0](https://github.com/OpenDKG/.github/blob/12b4e5bfb23285f66127cfb979ed1327eaab8e64/CONTRIBUTING.md) - - [Developer Certificate of Origin](https://github.com/OpenDKG/.github/blob/12b4e5bfb23285f66127cfb979ed1327eaab8e64/DCO.md) + - [Contributor Agreement v1.0](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/CONTRIBUTOR_AGREEMENT.md) + - [Governance v1.0](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/GOVERNANCE.md) + - [Contribution guidelines v1.0](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/CONTRIBUTING.md) + - [Developer Certificate of Origin](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/DCO.md) - **Exact agreement revision:** `12b4e5bfb23285f66127cfb979ed1327eaab8e64`. The forms refer to this specific version, not to future changes. NetPetra is excluded from all coverage. + **Exact agreement revision:** `2e429d904db1059a678085792ad44f1d732d7ea1`. The forms refer to this specific version, not to future changes. NetPetra is excluded from all coverage. - These terms are a **proposal until the three initial founders expressly adopt them**. Do not use this form to grant membership until adoption is confirmed. Filing this public issue is not an automatic invitation, a qualified electronic signature, or proof of civil identity. + These terms are a **proposal until the three original equal cofounders each personally adopt them**. Do not use this form to grant membership until adoption is confirmed. Filing this public issue is not an automatic invitation, a qualified electronic signature, or proof of civil identity. This issue and your GitHub username are public. **Do not provide legal names, addresses, identity documents, personal email, passwords, secrets, or sensitive personal information.** - type: input @@ -42,14 +44,14 @@ body: attributes: label: "Contributor Agreement v1.0 — explicit acceptance" options: - - label: "I have read and affirmatively accept OpenDKG Contributor Agreement v1.0 at commit 12b4e5bfb23285f66127cfb979ed1327eaab8e64 for my authorized contributions to present and future Covered Repositories. NetPetra is excluded. I understand that existing valid outbound open-source licenses remain effective if I leave." + - label: "I have read and affirmatively accept OpenDKG Contributor Agreement v1.0 at commit 2e429d904db1059a678085792ad44f1d732d7ea1 for my authorized contributions to present and future Covered Repositories. NetPetra is excluded. I understand that existing valid outbound open-source licenses remain effective if I leave." required: true - type: checkboxes id: governance-v1 attributes: label: "Governance v1.0 — explicit acceptance" options: - - label: "I have read and accept OpenDKG Governance v1.0 at commit 12b4e5bfb23285f66127cfb979ed1327eaab8e64 for my requested role, including contribution review, decision-making, access control, and departure." + - label: "I have read and accept OpenDKG Governance v1.0 at commit 2e429d904db1059a678085792ad44f1d732d7ea1 for my requested role, including contribution review, decision-making, access control, and departure." required: true - type: checkboxes id: contributing-dco-v1 diff --git a/CLA_SETUP.md b/CLA_SETUP.md index f865fe9..521d7b0 100644 --- a/CLA_SETUP.md +++ b/CLA_SETUP.md @@ -10,8 +10,8 @@ The [CLA Assistant service](https://cla-assistant.io/) can prompt an external pu ## Configuration by a GitHub organization owner -1. First complete the **unanimous founding adoption** of the proposed [Contributor Agreement](CONTRIBUTOR_AGREEMENT.md) and [Governance](GOVERNANCE.md). -2. Prepare the complete, unchanged effective **Contributor Agreement v1.0** as a public GitHub Gist linked to the adopted exact revision. Do not silently rewrite substantive terms. The reference OpenDKG agreement revision in this initial package is `12b4e5bfb23285f66127cfb979ed1327eaab8e64`; if it changes before adoption, pin and review the actual adopted revision instead. +1. First have **all three equal original cofounders**, including current technical owner `@a-51-50`, personally confirm acceptance (outside members can comment before joining) and complete the **unanimous founding adoption** of the proposed [Contributor Agreement](CONTRIBUTOR_AGREEMENT.md) and [Governance](GOVERNANCE.md). +2. Prepare the complete, unchanged effective **Contributor Agreement v1.0** as a public GitHub Gist linked to the adopted exact revision. Do not silently rewrite substantive terms. The reference OpenDKG agreement revision in this initial package is `2e429d904db1059a678085792ad44f1d732d7ea1`; if it changes before adoption, pin and review the actual adopted revision instead. 3. Sign in at **https://cla-assistant.io/** with an authorized GitHub account. Link OpenDKG or each of its covered repositories to that Gist, and approve the requested GitHub authorization/installation as required by the service. Install/use it only for **OpenDKG covered repositories**, not NetPetra. 4. Open a harmless test PR from a **different GitHub account that has not signed**. Check that the service requests explicit agreement and posts the expected pending/failing status. Sign once, verify it changes to success and that the recorded version matches the approved text. Confirm it does not silently exempt authors who should sign. 5. In each covered repository, configure **Settings → Rules → Rulesets** (or Branch protection) to **require the CLA check** before merging into the protected branch. Select the actual check name shown by your test PR, not a guessed name. Require at least one independent review and restrict bypass permissions. GitHub Free supports branch protection for public repositories; review plan limitations for private repos. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 81f0696..efd86aa 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -6,6 +6,8 @@ Welcome to OpenDKG. These contribution guidelines are the **organization default Read our [Contributor Agreement](https://github.com/OpenDKG/.github/blob/main/CONTRIBUTOR_AGREEMENT.md), [Governance](https://github.com/OpenDKG/.github/blob/main/GOVERNANCE.md) and [DCO](https://github.com/OpenDKG/.github/blob/main/DCO.md). +**Founders:** The three original equal OpenDKG cofounders, including `@a-51-50`, record their initial agreement through [Issue #3](https://github.com/OpenDKG/.github/issues/3), even before joining the organization. Ordinary future members use the [membership procedure](MEMBERSHIP.md). Founder status is not conferred by requesting membership. + ## Before your first contribution 1. Check the specific repository's `LICENSE`, `README`, third-party notices, and any special rules. If its license differs from Apache-2.0, obtain explicit permission to submit under the stated license. diff --git a/CONTRIBUTOR_AGREEMENT.md b/CONTRIBUTOR_AGREEMENT.md index 7138167..c75f46c 100644 --- a/CONTRIBUTOR_AGREEMENT.md +++ b/CONTRIBUTOR_AGREEMENT.md @@ -4,7 +4,7 @@ **Maintained at:** https://github.com/OpenDKG/.github/blob/main/CONTRIBUTOR_AGREEMENT.md **Project operator:** the individual volunteer maintainers collaborating through the OpenDKG GitHub organization; **OpenDKG is not represented by this document as a registered company or separate legal person**. -> **Adoption requirement.** Publishing this document is not agreement. Every founding maintainer and later contributor must affirmatively accept the exact version before the team treats it as binding on that person. The initial three maintainers must separately record unanimous adoption of the initial governance terms. Existing code is not retroactively licensed without permission from the relevant rightsholders. This is a draft for legal review in applicable jurisdictions, not a guarantee of enforceability or immunity from liability. +> **Adoption requirement.** Publishing this document is not agreement. Every founding maintainer and later contributor must affirmatively accept the exact version before the team treats it as binding on that person. The three original equal cofounders must each independently record acceptance of the same revision before relying on unanimous initial governance adoption. The first GitHub Organization Owner is a temporary technical custodian, not a sole legal founder or sole guarantor of other people's activities. Existing code is not retroactively licensed without permission from the relevant rightsholders. This is a draft for legal review in applicable jurisdictions, not a guarantee of enforceability or immunity from liability. ## 1. What repositories are covered @@ -53,7 +53,7 @@ Before their first contribution under this policy, the contributor must post an > I, the GitHub account signing this comment, affirmatively accept **OpenDKG Contributor Agreement v1.0**, at the exact revision linked in this comment, for my authorized contributions to **all current and future Covered Repositories owned by OpenDKG**, excluding **NetPetra**. I understand that valid outbound licenses I grant on accepted contributions cannot be revoked solely because I leave the team. I retain ownership of my original work. My previously submitted work is included **only** if I list the relevant commits or PRs here. Covered earlier work: **none / links**. Agreement revision (commit SHA): **[paste commit]**. -A DCO `Signed-off-by` trailer is **not** acceptance of this separate agreement. Acceptance of a materially revised agreement requires a new explicit acknowledgment; changed terms cannot retroactively replace prior public licenses. The initial three maintainers must each individually accept this agreement and record adoption of `GOVERNANCE.md` before they claim these rules are in force. +A DCO `Signed-off-by` trailer is **not** acceptance of this separate agreement. Acceptance of a materially revised agreement requires a new explicit acknowledgment; changed terms cannot retroactively replace prior public licenses. The three original equal cofounders must each personally accept this agreement and record adoption of `GOVERNANCE.md` before the three-person council claims its collective rules are in force. Founding status is not decided by the order of GitHub invitations. ## 7. Previous contributions diff --git a/FOUNDER_ONBOARDING.md b/FOUNDER_ONBOARDING.md new file mode 100644 index 0000000..102952d --- /dev/null +++ b/FOUNDER_ONBOARDING.md @@ -0,0 +1,33 @@ +# OpenDKG — three equal cofounders: onboarding and acceptance + +**Status: proposal.** This document describes the team's intended founding arrangements. It does not bind someone who has not personally agreed, create a company, transfer intellectual property, or distribute legal liability. + +## Founding relationship + +OpenDKG is intended as a project **cofounded from the outset by three equal individuals**: + +- `@a-51-50` — one of the three equal cofounders; presently the **technical GitHub Organization Owner** because this account created the organization. +- Original cofounder 2 — **GitHub handle not yet provided or personally confirmed**. +- Original cofounder 3 — **GitHub handle not yet provided or personally confirmed**. + +These are **three equal founding seats**. Who created the GitHub account first does not confer additional votes, project copyright, founders' ownership rights, or permanent control. The other original cofounders are not ordinary later-stage applicants merely because their GitHub invitations have not yet been sent. However, **do not claim that anyone is contractually bound until they personally accept** the relevant agreement. + +**Exact proposed Governance and Contributor Agreement revision for acceptance:** `2e429d904db1059a678085792ad44f1d732d7ea1`. The underlying documents remain v1.0 proposals and were clarified before any of the three original cofounders had accepted. An outdated revision is not adequate consent to this clarified version. + +**NetPetra is explicitly excluded**, even if it later moves into OpenDKG. + +## How each of the three accepts (including the initial technical Owner) + +1. Read [Contributor Agreement v1.0 at the pinned revision](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/CONTRIBUTOR_AGREEMENT.md) and [Governance v1.0 at the same revision](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/GOVERNANCE.md). +2. Each of the original three individually opens [founding acceptance Issue #3](https://github.com/OpenDKG/.github/issues/3) **from their own GitHub account**. You can comment **without being an organization member** because the repository is public. +3. Each personally posts the declaration provided in Issue #3 after actually reading the documents. No owner, agent or bot may post acceptance for another person. A GitHub comment is evidence of an attributable public action, not verified civil identity or a qualified electronic signature. +4. The current GitHub Owner checks that exactly three **different original-cofounder accounts** submitted explicit acceptance of the **same pinned revision**. Record three comment permalinks in the issue and only then mark the full founding council as formed. If the text changes substantially, collect agreement to the final version again. +5. For each original cofounder who has accepted, `@a-51-50` may invite their account to the organization; there is **no need to wait until all three are already GitHub members**. Joining as a **Member** is acceptable until the full founder roster is agreed and organizational permissions are reviewed. +6. After unanimous adoption, assign GitHub privileges by an explicit, documented founders' decision. If all three are meant to have equal technical control, **Organization Owner** for all three is more equivalent than giving two people only **Repository Admin**. But GitHub Owners have powerful unilateral platform capabilities, so all three should understand this risk and use MFA, separate recovery methods, least privilege and review controls. This process **does not automatically grant any account Owner or Admin**. +7. Ordinary later contributors apply via [the membership form](https://github.com/OpenDKG/.github/issues/new?template=membership-agreement.yml) or submit PRs as external contributors. They have **no cofounder status**, no governance vote and no automatic admin permissions. + +## Accountability and limits + +No statement in GitHub governance makes the three persons automatically jointly liable for each other's activities, automatically shields `@a-51-50` from liability, or turns a GitHub organization into a limited-liability company. This must be addressed separately under the relevant jurisdictions and in actual contracts, if any. Do not represent an unregistered collaboration as an LLC. + +These documents are for organization operations and permission/provenance evidence. For legally enforceable founder duties and financial or IP allocation across jurisdictions, have appropriate counsel review the arrangement. Never post passports, addresses, private contact information, cryptographic secrets or identity documents publicly. diff --git a/GOVERNANCE.md b/GOVERNANCE.md index d39d0a6..3fe5a1f 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -5,24 +5,38 @@ > OpenDKG is presently treated here as an **informal collaboration of individuals**, not a registered company, employer, partnership, or separate legal person. This document sets voluntary operating rules; it does not determine ownership of a personal domain, trademark, bank account, wallet, signing certificate or other asset. It cannot override GitHub's technical permissions or applicable law. -## 1. Founding maintainers and effective date +## 1. Three equal cofounders and staged technical onboarding -The initial council consists of **three individual founders using their established GitHub handles**. They must identify themselves in one linked, publicly auditable **adoption issue or pull request** in `OpenDKG/.github`, explicitly accept `CONTRIBUTOR_AGREEMENT.md` and these governance rules at a pinned commit revision, and agree which accounts hold organization-owner permissions. Their three acceptance links form the **founder roster**, without public disclosure of legal names. **Until all three accept, this document is a proposal rather than an agreement among the three.** +**OpenDKG was established as a collaboration of three equal cofounders from the outset.** All three founding seats have the same proposed governance status. The fact that `@a-51-50` created the GitHub organization first and is currently its only technical Organization Owner **does not grant superior founder status, extra votes, exclusive project copyright, a permanent veto, or unilateral ownership of other people's contributions**. GitHub's actual technical permissions remain effective until separately changed. -Public aliases may be used, but a GitHub handle is not proof of legal identity. Protect any privately verified identity information outside public git history. Never put passwords, recovery codes or civil identity documents in an issue. +The founding group comprises `@a-51-50` and **two other original cofounders**, whose GitHub handles will be recorded only when those people personally confirm their involvement. Do not invent their handles, declare consent for them, or list an unconsenting person as contractually bound. The three founding seats are **reserved for this original group**; a later unrelated member cannot claim founder status by checking an application box. -A founder may resign by a dated written message recorded in the governance log. Past validly granted licenses remain effective. New maintainers may be added by **2/3 of active maintainers, rounded up**, and must affirmatively accept the current rules before receiving privileged access. Admission to GitHub membership alone does not provide a governance vote. +**Each of the three cofounders must independently and affirmatively accept** the exact version of this Governance document and `CONTRIBUTOR_AGREEMENT.md`, using their **own GitHub accounts**, in the [founding adoption record](https://github.com/OpenDKG/.github/issues/3). They can read and comment on that public issue **before** joining the GitHub organization. The initial three-cofounder governance agreement takes effect **among those who have validly accepted**, and the council's collective operating rules are treated as fully adopted when **all three** have accepted the same pinned revision. A GitHub invitation, PR merge, checkbox submitted on another person's behalf, or existing membership is not acceptance. + +### Bootstrap sequence (no founder has extra standing) + +1. `@a-51-50` is **temporary technical custodian**, solely because GitHub requires an existing owner to create the organization and send invitations. This is not a legal designation of sole founder and is not an agreement imposing all project liabilities on that person. +2. All three cofounders review the same version-pinned documents and personally post their acceptance in **Issue #3**. Any substantive pre-adoption change requires acceptance of the final revision by all three. Pseudonymous public GitHub identities are permitted, but are not legal identity verification. +3. Once each candidate has personally accepted and confirmed that they are one of the **original three**, `@a-51-50` may send a GitHub invitation to that person. They may initially join with the **Member** role while the remaining acceptances or organizational setup are being completed. Signing is never replaced by accepting an invitation. +4. When all three have accepted, record the three comment URLs and the agreed **founder roster**. The initial unanimous adoption documents the group's equal standing, independently of invitation order. Subject to the founders' recorded decision and each account's consent, grant the agreed GitHub administrative permissions (ideally three distinct Organization Owners for equal platform administration, if all three intend that role). **Repository Admin is not the same as Organization Owner**. No privilege is granted automatically by a GitHub Issue. +5. From that point, ordinary majority or two-thirds council rules govern new appointments, according to the sections below. Ordinary members and external contributors **are not cofounders** and receive no council vote or Organization Owner access by default. + +Each cofounder keeps their pre-existing personal assets and their own copyrights unless a separate, valid agreement says otherwise. A statement that there are three cofounders **does not automatically apportion all personal legal liability equally**, establish an LLC, or protect anyone from claims. Legal responsibility depends on actual conduct, contractual parties, and applicable law. + +Public aliases may be used, but a GitHub handle is not proof of legal identity. Protect any privately verified identity information outside public git history. Never put passwords, recovery codes, or civil identity documents in an issue. + +A cofounder may resign by a dated written message recorded in the governance log. Past validly granted licenses remain effective. Subsequent maintainers may be appointed by **two-thirds of active voting cofounders/maintainers, rounded up**, and must affirmatively accept applicable rules before receiving privileged access. Admission to GitHub membership alone does not provide a governance vote. ## 2. Approval rules -For the initial three-maintainer council: +Once the three-cofounder council is constituted, the three equal cofounders use the following rules: | Action | Required approval | | --- | --- | | Normal pull request | At least one other qualified maintainer reviewer, passing checks | | Security-sensitive code, privileged code or update mechanism | At least two maintainers, including one other than the author | | Publishing official executable releases or changing release-signing credentials | At least two maintainers and a documented release check | -| Adding organization owners, changing account custody, or changing domain/service control | At least two maintainers and a recorded handover plan | +| Adding organization owners after initial cofounder onboarding, changing account custody, or changing domain/service control | At least two active council members and a recorded handover plan | | Changing governance, brand policy, accepted license defaults, or donations policy | Two of the three, documented in a public PR/issue where safe | | Removing a maintainer for cause | Both other founders (when three are active), with notice and opportunity to respond unless security requires temporary suspension | | Relicensing another contributor's copyrighted work | **Not authorized by a vote**; obtain the relevant rightsholders' permissions | @@ -42,7 +56,7 @@ With two remaining active maintainers, require both for official releases and ir ## 4. Security and access control -- At least **two distinct organization owners**, separate MFA, individual credentials and recovery methods. Avoid shared passwords. +- The three initial cofounders are intended to have **equal governance standing**. During setup one temporary technical custodian may remain the only GitHub Owner. After personal acceptance and an agreed handover, aim for **three distinct Organization Owners if all three cofounders approve that technical role**, each with separate MFA and recovery. GitHub Owners can technically act unilaterally despite voluntary two-thirds rules; use independent reviews and written asset-custody arrangements. Avoid shared passwords. - Protect default and release branches where the GitHub plan allows: pull-request reviews, CI checks, no force-pushes or deletion, restricted bypass and required DCO sign-offs. - Store CI credentials as scoped secrets, minimize permissions of automation, review all external dependencies and publish auditable releases. - Record who actually owns each domain, trademark filing, signing certificate, hosting contract, payment account or wallet. An unincorporated GitHub organization is not itself automatically the legal owner. @@ -50,7 +64,7 @@ With two remaining active maintainers, require both for official releases and ir ## 5. Decisions and amendments -Record significant votes and policy changes in GitHub issues/PRs, including participants, date, version, approvals and the resulting commit SHA. A change to this policy requires two of three active founding maintainers; after new maintainers join, two-thirds of active maintainers rounded up. A material change to the **Contributor Agreement** requires renewed affirmative acceptance by each contributor to whom the new terms are to apply; prior license grants remain intact. +Record significant votes and policy changes in GitHub issues/PRs, including participants, date, version, approvals and the resulting commit SHA. A change to this policy requires two of three active cofounders; after new maintainers join, two-thirds of active maintainers rounded up. A material change to the **Contributor Agreement** requires renewed affirmative acceptance by each contributor to whom the new terms are to apply; prior license grants remain intact. Decisions about real-world contracts, personal property, taxes, jurisdiction, domain custody and trademarks require separate arrangements with identifiable parties where necessary. A governance vote cannot make someone else liable for a personal obligation or transfer their assets without legally effective consent. diff --git a/MEMBERSHIP.md b/MEMBERSHIP.md index b3ae180..cdd81ab 100644 --- a/MEMBERSHIP.md +++ b/MEMBERSHIP.md @@ -1,14 +1,20 @@ # OpenDKG membership and acceptance procedure -**Status: proposed until the three founding maintainers expressly adopt the v1.0 governance and Contributor Agreement.** This procedure covers repositories owned by [OpenDKG](https://github.com/OpenDKG), **excluding NetPetra** even if it is transferred to this organization. It is not a legal-person registration or a guarantee of enforceable e-signatures. +**Status: proposed until the three original equal cofounders each personally accept the v1.0 Governance and Contributor Agreement.** This procedure covers repositories owned by [OpenDKG](https://github.com/OpenDKG), **excluding NetPetra** even if it is transferred to this organization. It is not a legal-person registration or a guarantee of enforceable e-signatures. ## Automated intake checks See [MEMBERSHIP_AUTOMATION.md](MEMBERSHIP_AUTOMATION.md). A GitHub Actions workflow validates form structure, matches the claimed username to the actual issue author, checks pinned acknowledgments, adds a validation label, and posts a timestamped body-hash receipt. **It never sends invitations or grants GitHub permissions.** The current three-founder adoption requirement remains mandatory. -## For applicants +## Original three cofounders — separate acceptance path -1. Read the **immutable v1.0 revision** of [Contributor Agreement](https://github.com/OpenDKG/.github/blob/12b4e5bfb23285f66127cfb979ed1327eaab8e64/CONTRIBUTOR_AGREEMENT.md), [Governance](https://github.com/OpenDKG/.github/blob/12b4e5bfb23285f66127cfb979ed1327eaab8e64/GOVERNANCE.md), [Contribution Guidelines](https://github.com/OpenDKG/.github/blob/12b4e5bfb23285f66127cfb979ed1327eaab8e64/CONTRIBUTING.md), and [DCO](https://github.com/OpenDKG/.github/blob/12b4e5bfb23285f66127cfb979ed1327eaab8e64/DCO.md). Version reference: `12b4e5bfb23285f66127cfb979ed1327eaab8e64`. +OpenDKG has **three equal cofounders from the outset**; the initial technical GitHub Organization Owner `@a-51-50` is not the sole founder. Each of the other two cofounders may **sign from their own GitHub account before joining** OpenDKG: visit [Founders' adoption Issue #3](https://github.com/OpenDKG/.github/issues/3), read the pinned exact revision, and personally post the prescribed acceptance. The same requirement applies to `@a-51-50`. Do not treat an invitation, membership, or this documentation as consent. + +After each original cofounder accepts, the current technical owner can send that cofounder an organization invitation. Joining as Member is sufficient for onboarding. Once all three accept, the initial roster is documented and the agreed administrative roles can be assigned **manually**; no GitHub Action promotes accounts. These three founder seats do not become available to outside applicants. Refer to [GOVERNANCE.md](GOVERNANCE.md) and [FOUNDER_ONBOARDING.md](FOUNDER_ONBOARDING.md). + +## For applicants (future non-founder contributors) + +1. Read the **immutable v1.0 revision** of [Contributor Agreement](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/CONTRIBUTOR_AGREEMENT.md), [Governance](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/GOVERNANCE.md), [Contribution Guidelines](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/CONTRIBUTING.md), and [DCO](https://github.com/OpenDKG/.github/blob/2e429d904db1059a678085792ad44f1d732d7ea1/DCO.md). Version reference: `2e429d904db1059a678085792ad44f1d732d7ea1`. 2. From the account that will join OpenDKG, [open the membership form](https://github.com/OpenDKG/.github/issues/new?template=membership-agreement.yml) **in OpenDKG/.github** and complete all required consent checkboxes. Pseudonymous public GitHub accounts are allowed. 3. The membership request is a **public GitHub issue**. Never post legal names, identity documents, emails, tokens, or sensitive information. Do not impersonate another account or submit on somebody else's behalf. 4. A maintainer reviews the issue; if accepted, an organization owner sends an invitation **after** recording explicit approval. Until then, the applicant has no organization membership or privileged access. @@ -16,13 +22,13 @@ See [MEMBERSHIP_AUTOMATION.md](MEMBERSHIP_AUTOMATION.md). A GitHub Actions workf ## For maintainers: manual admission gate -**Do not send invitations first.** GitHub's standard invitation flow does not natively force a candidate to execute this form before accepting an invite; organization owners can technically bypass this process. Accordingly, use the following operational policy, not a claim of platform enforcement. +**Do not send invitations before a candidate's own consent.** For the original three cofounders follow the acceptance sequence above; for other applicants use the membership form below. GitHub's standard invitation flow does not natively force a candidate to execute this form before accepting an invite; organization owners can technically bypass this process. Accordingly, use the following operational policy, not a claim of platform enforcement. -1. Check the founding adoption issue/PR for affirmative acceptance by all **three founding maintainers** of the exact applicable revision. If that is not complete, do not treat the v1.0 agreement as effective. +1. For an **ordinary, non-founder application**, check the founding adoption record for affirmative acceptance by **all three equal cofounders** of the exact applicable revision. If that is not complete, do not treat the v1.0 agreement as effective. 2. Confirm the issue was created in **OpenDKG/.github** by the **same GitHub account** seeking access; confirm that all checkbox answers are affirmatively selected and that the agreement version is the pinned revision above. **Issue bodies can be edited**, so record the issue URL, current content and observation time at review. If material consent is ambiguous or was edited, obtain a new unambiguous confirmation from the applicant and preserve the evidence. 3. Record a maintainer review comment, for example: - `Membership reviewed: @HANDLE; Agreement v1.0 at 12b4e5bfb23285f66127cfb979ed1327eaab8e64; original issue #NUMBER; review UTC YYYY-MM-DDTHH:MM:SSZ; approval by @REVIEWER; approved role MEMBER; authorization for invite only. This comment does not certify civil identity or rights ownership.` + `Membership reviewed: @HANDLE; Agreement v1.0 at 2e429d904db1059a678085792ad44f1d732d7ea1; original issue #NUMBER; review UTC YYYY-MM-DDTHH:MM:SSZ; approval by @REVIEWER; approved role MEMBER; authorization for invite only. This comment does not certify civil identity or rights ownership.` 4. Obtain the minimum maintainer approvals required by [GOVERNANCE.md](GOVERNANCE.md) for the role/access being granted. In particular, adding owners requires at least two maintainers, per the proposed v1.0 rules. 5. Only then issue the GitHub invitation. Prefer a normal organization member with **no default write privilege**. Grant per-repository permissions using least privilege; promote to maintain or owner only via the documented governance approval. @@ -31,7 +37,7 @@ See [MEMBERSHIP_AUTOMATION.md](MEMBERSHIP_AUTOMATION.md). A GitHub Actions workf ## Founders and existing contributors -- The **three founders must each explicitly accept** the original governance and Contributor Agreement at a specific revision, with a recorded link. Their approval cannot be inferred merely from merging a PR or from existing GitHub membership. +- The **three original equal cofounders** must each explicitly accept the original governance and Contributor Agreement at the same pinned revision, with a recorded link. The technical owner who created the organization has no extra governance vote or status. Their approval cannot be inferred merely from merging a PR or from existing GitHub membership. - Existing OpenDKG members should follow this process before the organization relies on these terms for them. - Code submitted **before** adoption needs a separate, traceable permission review; this process does not retroactively license third-party work. - Material changes to the Contributor Agreement need **new affirmative acceptance** for the new version before relying on it for new submissions. Previous licenses are not revoked. diff --git a/MEMBERSHIP_AUTOMATION.md b/MEMBERSHIP_AUTOMATION.md index 7b85189..ed17e53 100644 --- a/MEMBERSHIP_AUTOMATION.md +++ b/MEMBERSHIP_AUTOMATION.md @@ -2,10 +2,16 @@ The `OpenDKG/.github` repository has a GitHub Actions workflow that automatically validates the **structure** of a membership application, records a GitHub Actions comment with the acceptance version and body SHA-256, and adds either `intake:format-validated` or `intake:needs-correction`. It does **not** invite people, grant permissions, assert legal enforceability or certify identity. +## Who uses this automation + +The **three original equal cofounders**, including `@a-51-50`, personally accept via [Issue #3](https://github.com/OpenDKG/.github/issues/3) even when they are not yet organization members. Their founding status does not depend on invite order. See [FOUNDER_ONBOARDING.md](FOUNDER_ONBOARDING.md). + +This automated Issue Form validator is for **other future members and contributors**, not the original founding trio. It validates a form's content but does not approve or invite anyone. + ## Applicant workflow 1. Read [Contributor Agreement v1.0](CONTRIBUTOR_AGREEMENT.md), [Governance v1.0](GOVERNANCE.md), [Contribution Guidelines](CONTRIBUTING.md), and [DCO](DCO.md). -2. Open the [membership form](https://github.com/OpenDKG/.github/issues/new?template=membership-agreement.yml) with your own GitHub account and check each required consent item. The form pins revision `12b4e5bfb23285f66127cfb979ed1327eaab8e64`. NetPetra is expressly excluded. +2. Open the [membership form](https://github.com/OpenDKG/.github/issues/new?template=membership-agreement.yml) with your own GitHub account and check each required consent item. The form pins revision `2e429d904db1059a678085792ad44f1d732d7ea1`. NetPetra is expressly excluded. 3. GitHub Actions runs on an opened, edited or reopened Issue. It checks that the claimed GitHub handle equals the actual Issue author and that all required checked statements include the correct agreement version. 4. The workflow comments with a timestamp, exact pinned policy SHA and SHA-256 of the submitted issue body. If the format is incomplete, edit the form or submit a new one. Editing a request is revalidated and a new receipt is appended for changed content. 5. A maintainer **must manually review the request and approve it before anyone sends an organization invitation**. Even a valid-format label is not an invitation or contract verification. Preserve the recorded receipt and the approver's separate comment. diff --git a/README.md b/README.md index 61a083f..3640760 100644 --- a/README.md +++ b/README.md @@ -28,6 +28,15 @@ No company or LLC is created by these documents, and they do not provide automat The [membership automation guide](MEMBERSHIP_AUTOMATION.md) explains the GitHub Actions intake checker, version-pinned consent receipts, and required human approval **before** an organization invitation. Form validation is not a legal-signature or membership approval. CLA checks for pull requests still require [separate configuration](CLA_SETUP.md). +## Three equal cofounders + +OpenDKG was started as a joint effort of **three equal cofounders**. The fact that `@a-51-50` currently holds the initial GitHub Organization Owner role is technical setup, **not** sole-founder or sole-liability status. All three must personally accept the same versioned documents from their own GitHub accounts before the full council operates under this proposed governance. The other two can accept *before* accepting an organizational invitation. + +- [Founding acceptance and onboarding](FOUNDER_ONBOARDING.md) +- [Founding adoption record (Issue #3)](https://github.com/OpenDKG/.github/issues/3) + +Future non-founder members use the separate membership form. No one is automatically promoted to admin/Owner based on a form or comment. Equal cofounder status does not automatically transfer assets or divide statutory liability. + ## Joining and signing OpenDKG uses a **manual pre-invitation membership gate** and a **separate pull-request CLA check**. These processes are not active solely because the templates are published. diff --git a/scripts/membership-validator.mjs b/scripts/membership-validator.mjs index d4158c1..9ee8d26 100644 --- a/scripts/membership-validator.mjs +++ b/scripts/membership-validator.mjs @@ -1,7 +1,7 @@ // OpenDKG membership Issue Form validator. No dependencies or privileged token. import { createHash } from "node:crypto"; -export const POLICY_SHA = "12b4e5bfb23285f66127cfb979ed1327eaab8e64"; +export const POLICY_SHA = "2e429d904db1059a678085792ad44f1d732d7ea1"; export const FORM_PREFIX = "[Membership request]"; export const VERSION = "1.0"; diff --git a/scripts/membership-validator.test.mjs b/scripts/membership-validator.test.mjs index 32f58d9..bc61c68 100644 --- a/scripts/membership-validator.test.mjs +++ b/scripts/membership-validator.test.mjs @@ -90,3 +90,16 @@ test("parses headings without treating unchecked text as acceptance", () => { assert.equal(sections.get("Your GitHub username"), "test-developer"); assert.equal(sections.get("Requested participation"), "Developer / member"); }); + +test("ordinary membership form does not recognize cofounder as an applicant role", () => { + const result = validateMembershipIssue(issue(sampleBody.replace("Developer / member", "Original cofounder"))); + assert.equal(result.valid, false); + assert.match(result.errors.join(" "), /participation role/); +}); + +test("policy revision in the public Issue Form matches the validator", async () => { + const { readFileSync } = await import("node:fs"); + const form = readFileSync(new URL("../.github/ISSUE_TEMPLATE/membership-agreement.yml", import.meta.url), "utf8"); + assert.ok(form.includes("at commit " + POLICY_SHA)); + assert.ok(form.includes("This form is for other applicants")); +});