Governance
How this project is governed
Every rule below is written down in the repository before it is relied on, and each one names the file it lives in.
Open never becomes paid
Subscriptions, renewals, dunning, mandates, payment recovery, and the transactional messaging engine are open core and will not be paid tiers.
DCO, not CLA
There is no CLA, and there will not be one. You keep the copyright in your contribution.
AI-assisted contributions are welcome. They are not banned, and they will not be banned.
What the words mean here
- Open core
- Everything published under Apache-2.0. Open is a licence state, not a maturity or support label.
- Adopter
- A business that runs OpenLup for its own store. velipet.com is the author’s shop, not an independent adopter.
- Port
- A narrow interface a provider sits behind. An adapter naming a vendor is a reference implementation, not a dependency of the core.
- Admission state
- private, community, official-experimental, official-stable or core. Promotion is explicit and needs a named maintainer with real capacity.
- Development preview
- The current channel, published on npm for evaluation, with no support window. Every incompatible preview names the affected contract and gives upgrade notes.
- P1-SF gate
- The stable-framework gate. Stable begins only after it has produced a versioned platform release, public extension contracts and upgrade tooling.
What happens next, and what you may do
When does versioning start?
Stable semantic versioning starts with the first stable release, after the P1-SF gate. Until then OpenLup ships development previews on npm, now 0.37.0.
What is the support window?
Once stable exists, the current stable major and the previous stable major are supported. Development previews have no support window.
How do I report a vulnerability?
Through GitHub Private Vulnerability Reporting, or by e-mail to dev@openlup.com if that route is unavailable. Never in a public issue. There is no bug bounty.
Can I fork it?
Yes. Apache-2.0 and a fresh-history root. The name and logo are not part of the licence, so a fork takes its own name.
Will you accept my module?
Promotion needs usefulness across adopters, tests and documentation, and a named maintainer with real capacity. An accepted pull request alone is not enough.