Governance.
SignedReceipts is maintained by an independent working group. No single vendor controls the specification, and no commercial entity owns the badge mark beyond its CC-BY-ND grant.
Structure
The SignedReceipts source archives hold every specification artefact and reference implementation. The current maintainer set is two engineers acting in their personal capacity, one external auditor from a GRC platform, and one external cryptographer. Maintainer status is merit-based, not vendor-based; merit is demonstrated through accepted contributions, not affiliation.
Licences
| Artefact | Licence | Why |
|---|---|---|
| Specification | CC-BY-4.0 | Attribution required; no sharealike friction for adopters. |
| JSON Schemas | CC0 | Maximum reuse without attribution overhead. |
| Reference implementations | Apache-2.0 | Patent grant; permissive. |
| Conformance corpus | Apache-2.0 (code) + CC0 (vectors) | Vectors must remain trivially redistributable. |
| Badge mark | CC-BY-ND | Prevents modification that dilutes the conformance signal. |
Contribution process
- Email the working group (badges@cloakapi.io) describing the proposed change before drafting a patch.
- Fork the repository, draft the change, and add or update conformance fixtures where applicable.
- Open the pull request. Normative changes require approval from two maintainers; one of those approvals must come from a maintainer not affiliated with the largest deployed implementation.
- Breaking format changes require a major version bump. Backward-compatible additions ride a minor version.
Badge revocation
Badges may be revoked when an implementation no longer passes the conformance suite, or when a vendor uses the mark to claim compatibility outside the conditions of /badge/. Revocations are tracked in signedreceipts/badges/REVOCATIONS.md. A revoked vendor receives 30 days' notice to remediate before public removal from /implementations/.
IETF Internet-Draft
Submitted as draft-cloakapi-signedreceipt-00 to SECDISPATCH. Mirrored at signedreceipts/draft-ietf. The working group's intent is to seek a chartered IETF working group during 2026 with the goal of progressing OpenReceipt along a Standards Track.
Roadmap
alg=ml-dsa-65 path. Conformance suite extension. PQC migration story.