From 3e6c643db6532c5852bf5d12d29b5dc6bfba79c0 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Wed, 19 Aug 2026 12:00:35 -0700 Subject: [PATCH 1/2] docs: stop asserting AAIF project status the charter says we do not have Same defect as the cA2A fix. GOVERNANCE.md stated "cMCP is a project of the Agentic AI Foundation" and that the Foundation holds the project's trademarks, while CHARTER.md in the same tree says hosting is "Proposed", the charter "has not yet been accepted by a host organization", and the marks are "currently held by OPAQUE Systems, Inc." Two clauses were worse than the header. Dispute resolution escalated to the Foundation for "binding resolution", and Amendments required "ratification by the Agentic AI Foundation" for any change to the document. Neither venue exists yet, so the amendment clause made this file formally unamendable. Both now name a fallback that works today and defer to the Foundation only on acceptance. NOTICE carried the same overclaim. cmcp-runtime 0.4.0 is already on PyPI with the old file, so the correction reaches users on the next release. Co-Authored-By: Claude Opus 5 (1M context) --- GOVERNANCE.md | 18 ++++++++++++++---- MAINTAINERS.md | 2 +- NOTICE | 2 +- 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 94843376..91f895bb 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -6,7 +6,15 @@ This document describes how cMCP is governed: who holds what role, how decisions ## Upstream governance body -cMCP is a project of the **Agentic AI Foundation**. The Foundation sets the overall direction for the agentrust-io ecosystem, holds the project's trademarks, and provides a neutral venue for resolving disputes that cannot be resolved within the project itself. Foundation policies supersede this document where they conflict. +AAIF hosting for cMCP is **proposed, not accepted**. [CHARTER.md](CHARTER.md) is the +authoritative record: it is a pre-acceptance draft, and the "cMCP" and "cMCP-compatible" +marks are currently held by OPAQUE Systems, Inc. + +On acceptance the Foundation would set overall direction for the agentrust-io ecosystem, hold +the project's trademarks, and provide a neutral venue for resolving disputes that cannot be +resolved within the project itself, and Foundation policies would supersede this document +where they conflict. Until acceptance, this document governs and nothing here should be read +as a binding foundation commitment. --- @@ -16,7 +24,7 @@ The project lead is responsible for the technical direction of cMCP, final say o | Name | Affiliation | GitHub | |------|-------------|--------| -| Imran Siddique | OPAQUE Systems | @imransiddique | +| Imran Siddique | OPAQUE Systems | @imran-siddique | The project lead role is subject to Foundation confirmation. Succession is decided by a 2/3 maintainer vote, ratified by the Foundation. @@ -69,10 +77,12 @@ An explicit vote is conducted by opening a GitHub Discussion tagged `vote`. It r ### Dispute resolution -If a PR or proposal reaches an impasse, any Maintainer may call for a formal vote. If the vote does not resolve the dispute, the project lead makes the final call. If the dispute involves the project lead, the matter is escalated to the Agentic AI Foundation for binding resolution. A 2/3 majority of Maintainers is required to override a project lead decision through Foundation escalation. +If a PR or proposal reaches an impasse, any Maintainer may call for a formal vote. If the vote does not resolve the dispute, the project lead makes the final call. A 2/3 majority of Maintainers is required to override a project lead decision. + +Where the dispute involves the project lead, there is currently no external venue: AAIF hosting is proposed and not accepted, so the Foundation cannot arbitrate for this project yet. Until acceptance such a dispute is resolved by a 2/3 majority of the remaining Maintainers. On acceptance, escalation to the Foundation for binding resolution replaces that fallback. --- ## Amendments -Changes to this document require an explicit vote (see above) and ratification by the Agentic AI Foundation. +Changes to this document require an explicit vote (see above). Ratification by the Agentic AI Foundation becomes an additional requirement only once AAIF hosting is accepted; requiring it today would make this document unamendable, since there is no Foundation relationship to ratify through. diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 0d1d1556..2af2df72 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -4,7 +4,7 @@ | Name | GitHub | Affiliation | Role | |------|--------|-------------|------| -| Imran Siddique | @imransiddique | OPAQUE Systems | Project Lead | +| Imran Siddique | @imran-siddique | OPAQUE Systems | Project Lead | ## Roles diff --git a/NOTICE b/NOTICE index 9684e723..2b5197eb 100644 --- a/NOTICE +++ b/NOTICE @@ -1,6 +1,6 @@ cMCP - Confidential MCP Gateway -Copyright 2026 Agentic AI Foundation contributors +Copyright 2026 cMCP contributors This project is licensed under the MIT License. From 5f419cb0afb0750fcf5df0139c70a3552beef751 Mon Sep 17 00:00:00 2001 From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:53:45 -0700 Subject: [PATCH 2/2] docs(governance): list the maintainers who can actually approve a change MAINTAINERS.md named one maintainer, the Project Lead. The same file says changes require approval by "an existing maintainer", and that a maintainer appointment needs "a 2/3 vote of the current maintainers". With one listed maintainer and a project rule that nobody self-approves, every pull request here structurally had no legitimate approver. Six accounts hold merge rights on the org and none but the Project Lead appeared in the file, so the documented process and the real one had drifted apart. Rishabh Poddar and Aaron Fulkerson are added. Neither is a new public assignment: both are already listed as Spec Editors in agentrust-io/trace-spec MAINTAINERS.md, both are at OPAQUE Systems, and both already hold merge rights here. This makes the file describe what is already true. Deliberately not added: the remaining org admins, including an external contributor at another company. Naming someone a maintainer of a public project is a real assignment, theirs to accept rather than ours to record. Also carries the Project Lead authority line from trace-spec so the three repositories describe the same structure. --- MAINTAINERS.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 2af2df72..e203723d 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -5,6 +5,11 @@ | Name | GitHub | Affiliation | Role | |------|--------|-------------|------| | Imran Siddique | @imran-siddique | OPAQUE Systems | Project Lead | +| Rishabh Poddar | @podcastinator | OPAQUE Systems | Maintainer | +| Aaron Fulkerson | @AaronRoeF | OPAQUE Systems | Maintainer | + +The Project Lead has final decision authority on architecture, conformance +requirements, and Maintainer appointments. ## Roles