# How this project is governed

_Governance_

Every rule below is written down in the repository before it is relied on, and each one names the file it lives in.

In force · Reviewed 2026-11-06

On this page: [Tiers and the ratchet](#tiers) · [Contributions](#contributions) · [Definitions](#definitions) · [Versioning and EOL](#versioning) · [Security](#security) · [Fork](#fork)

## Open never becomes paid

_Tiers and the ratchet_

- **One-way ratchet** — Anything published under Apache-2.0 stays open (TIER_POLICY.md)
- **Paid value, if ever** — In the operational layer, never in withheld code (TIER_POLICY.md)
- **No SLA, said plainly** — Nothing in this project carries a service-level agreement (SUPPORT.md)

> Subscriptions, renewals, dunning, mandates, payment recovery, and the transactional messaging engine are open core and will not be paid tiers.
>
> — TIER_POLICY.md · reviewed 2026-11-06

**Not a promise about hosting.** The commercial model is open core plus a hosted service.

## DCO, not CLA

_Contributions_

> There is no CLA, and there will not be one. You keep the copyright in your contribution.
>
> — GOVERNANCE.md · reviewed 2026-11-06

AI-assisted contributions are welcome. They are not banned, and they will not be banned.

**Allowed.** Agent-assisted work, disclosed in the pull request, with one human author who signs off under the DCO.

## What the words mean here

_Definitions_

- **Open core** — Everything published under Apache-2.0. Open is a licence state, not a maturity or support label.
- **Adopter** — A business that runs OpenLup for its own store. velipet.com is the author’s shop, not an independent adopter.
- **Port** — A narrow interface a provider sits behind. An adapter naming a vendor is a reference implementation, not a dependency of the core.
- **Admission state** — private, community, official-experimental, official-stable or core. Promotion is explicit and needs a named maintainer with real capacity.
- **Development preview** — The current channel, published on npm for evaluation, with no support window. Every incompatible preview names the affected contract and gives upgrade notes.
- **P1-SF gate** — The stable-framework gate. Stable begins only after it has produced a versioned platform release, public extension contracts and upgrade tooling.

## What happens next, and what you may do

_Versioning, security and fork_

**When does versioning start?**

Stable semantic versioning starts with the first stable release, after the P1-SF gate. Until then OpenLup ships development previews on npm, now 0.37.0.

**What is the support window?**

Once stable exists, the current stable major and the previous stable major are supported. Development previews have no support window.

**How do I report a vulnerability?**

Through GitHub Private Vulnerability Reporting, or by e-mail to dev@openlup.com if that route is unavailable. Never in a public issue. There is no bug bounty.

**Can I fork it?**

Yes. Apache-2.0 and a fresh-history root. The name and logo are not part of the licence, so a fork takes its own name.

**Will you accept my module?**

Promotion needs usefulness across adopters, tests and documentation, and a named maintainer with real capacity. An accepted pull request alone is not enough.