Governance

This repository starts from the Community Specification process and keeps the legal and contribution structure needed for an eventual standard.

The initial content is provisional and in active evaluation status. It is intended to be reviewed by OSERA starting members, patch providers, enterprise consumers, and the broader FINOS community. It has not been published as a formal FINOS standard.

Proposed path

1. Capture current OSERA patch-production practice as provisional markdown-backed standards.
2. Collect implementation feedback from providers and consuming banks.
3. Split stable requirements from examples, tooling profiles, and implementation notes.
4. Move mature requirements through the Community Specification governance process.

Contribution focus

Useful contributions include:

• evidence from additional backpatch providers;
• recipient requirements from enterprise remediation teams;
• feed examples for OpenVEX and CycloneDX;
• examples of “what changed” and “what surface area should we test” metadata;
• acceptance checks for bytecode level, baseline tags, provenance links, and version metadata.

Licensing note

The user proposal suggests starting with CC-BY-4.0 for draft written material, with the option to transition later to a formal standards license. The existing repository includes Community Specification governance documents that should be reviewed before ratification.