Licensing, trademark, and conformance

Status: ruled 2026-09-07. This file replaces the earlier LICENSE-PENDING.md, which held the question open. The ruling covers the spec/ directory only. Everything else in this repository stays under the proprietary license at the repository root, which grants nothing.

The split

Copyright holder for both: Eformogi, Inc.

The specification is prose, tables, and worked examples, so it takes a documentation license. You may copy it, quote it, translate it, publish it, and build a competing product from it, including commercially, as long as you say where it came from. The verifier and the vectors are software, so they take a software license. Apache-2.0 carries the patent grant and the warranty disclaimer that a receiver's counsel will look for before letting anyone run our code against their records.

The code license applies only under spec/verifier/. It does not reach api/, shared/, frontend/, scripts/, or any other directory, and no file outside spec/ becomes open source by being described in a chapter that is. A reader who wants the algorithm has the chapters and the verifier. A reader who wants our product has to build it.

Two files in this directory are neither published nor licensed: the coordinated-disclosure policy, which is awaiting counsel, and the trust report, which reports numbers rather than specifying anything. They stay under the repository root license until they are ruled on separately.

Attribution

CC BY 4.0 asks for attribution. A copy, an excerpt, or a translation of the specification should carry a line like this:

Based on The Record: protocol specification, copyright Eformogi, Inc., used under CC BY 4.0. Original at https://eformogi.com/spec

Apache-2.0 asks that you keep the LICENSE file and any NOTICE file with a redistributed copy of the verifier, and that you state what you changed.

Trademark

The licenses above cover copyright. They do not license any trademark.

"Eformogi", the Eformogi logo, and Witness Transcript (ruled 2026-09-12) are not licensed by CC BY 4.0, by Apache-2.0, or by anything in this repository. You may say that your software implements or is compatible with the specification. You may not use the operator's name or marks in a way that suggests the operator built, endorsed, reviewed, or certified your implementation.

The receipt (tr_) a family issues to a receiver is named Witness Transcript. "The Record" stays the generic term for everything a family holds (entries, courses, receipts of every kind) and carries no mark. An implementation may call its own output a Witness Transcript only under the conformance policy below; it may not use the mark in a company name or a product name, and it may not use it for records that do not pass conformance.

Conformance

Chapter 10 defines the vectors and what passing them proves. Passing them is a factual claim about software, so anyone may run the suite and report the result without asking the operator. The honest sentence is "passes N of the M conformance vectors in version X of the specification", with the version named, because a claim that outruns the version is a claim about a document nobody can check.

Passing the suite also carries a naming right (chapter 10, section 10.8). An implementation whose records pass the conformance vectors in the version of the specification it claims may call the resulting artifact a Witness Transcript and may use the name in its own prose; an implementation that has not passed may not. This is a trademark license conditioned on a technical suite, not a certification program: nobody, including the operator, may describe an implementation as "certified", "official", or "accredited" against this standard.

Where these files are published

The chapters are at eformogi.com/spec. The verifier, the vectors, and both license texts are at eformogi.com/spec/verifier, so a receiver can obtain and run the whole standard without cloning anything and without an account.