From e3b6c20140e28b4a48fd6970ddbf3438f0d92e17 Mon Sep 17 00:00:00 2001
From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com>
Date: Sat, 22 Aug 2026 21:31:49 -0700
Subject: [PATCH] docs: document project sponsorship roles

Signed-off-by: Imran Siddique <45405841+imran-siddique@users.noreply.github.com>
---
 README.md                   |  4 ++++
 SPONSORS.md                 | 20 ++++++++++++++++++++
 claude-code/PRIVACY.md      |  2 +-
 scheduled-agents/PRIVACY.md |  2 +-
 4 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 SPONSORS.md

diff --git a/README.md b/README.md
index 8cd9236..76f557c 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,10 @@
 
 The ecosystem front door for cMCP, TRACE, and Agent Manifest. Vendors and community projects integrate here, on their own terms, under published rules - while the core repos stay first-party.
 
+Project support is recognized in [SPONSORS.md](SPONSORS.md). Sponsorship is
+separate from marketplace listing, verification tier, maintainership, and
+project governance.
+
 ## Where things live
 
 | Repo | What belongs there | Who contributes |
diff --git a/SPONSORS.md b/SPONSORS.md
new file mode 100644
index 0000000..582e3bb
--- /dev/null
+++ b/SPONSORS.md
@@ -0,0 +1,20 @@
+# Sponsors
+
+AgenTrust Integrations is an open-source project. Sponsors provide funding,
+engineering time, infrastructure, or other in-kind support. Sponsorship does
+not confer project ownership, governance authority, marketplace preference, or
+control over technical decisions.
+
+## Current sponsors
+
+### OPAQUE Systems
+
+Founding engineering and infrastructure sponsor, and contributor to the
+AgenTrust integration ecosystem.
+
+## Recognition policy
+
+Sponsor recognition is separate from integration vendors, maintainers, and
+marketplace tiers. Sponsored products receive no automatic listing,
+verification, featured placement, or exception from the published contribution
+rules.
diff --git a/claude-code/PRIVACY.md b/claude-code/PRIVACY.md
index f041019..0b97b91 100644
--- a/claude-code/PRIVACY.md
+++ b/claude-code/PRIVACY.md
@@ -2,7 +2,7 @@
 
 The AgenTrust Claude Code plugin collects and transmits no personal data.
 
-It runs locally as a Claude Code plugin. It processes only your local Claude configuration, entirely on your machine, and sends no telemetry, analytics, or usage data to agentrust-io, OPAQUE, or any third party. There is no account, login, or tracking, and no cookies or background network calls.
+It runs locally as a Claude Code plugin. It processes only your local Claude configuration, entirely on your machine, and sends no telemetry, analytics, or usage data to the plugin project or any third party. There is no account, login, or tracking, and no cookies or background network calls.
 
 All Agent Manifest and TRACE records, and the drift baseline, are written to files on your machine; nothing is sent anywhere. Signing uses a local key.
 
diff --git a/scheduled-agents/PRIVACY.md b/scheduled-agents/PRIVACY.md
index f6aa954..974754e 100644
--- a/scheduled-agents/PRIVACY.md
+++ b/scheduled-agents/PRIVACY.md
@@ -2,7 +2,7 @@
 
 The AgenTrust scheduled-agents plugin collects and transmits no personal data.
 
-It runs locally as a Claude Code plugin. It processes only your local routine specs and Claude configuration, entirely on your machine, and sends no telemetry, analytics, or usage data to agentrust-io, OPAQUE, or any third party. There is no account, login, or tracking, and no cookies or background network calls.
+It runs locally as a Claude Code plugin. It processes only your local routine specs and Claude configuration, entirely on your machine, and sends no telemetry, analytics, or usage data to the plugin project or any third party. There is no account, login, or tracking, and no cookies or background network calls.
 
 It records names and fingerprints only (routine, tool, MCP, and hook-command names, and SHA-256 hashes of prompts and settings). It never stores secrets, never reads your credentials file, and never records a hook command's output. The drift baseline and any TRACE record are written to files on your machine; nothing is sent anywhere. Signing uses a local key whose private half never leaves the machine.