FORK-003

Baseline Tags

Every patch line identifies its unpatched starting source SHA with a `v+patch.baseline` tag.

Status: Ratified
Version: 0.1.0
Pack: OSERA-SP-0.1.0 ratified
Ratified: 2026-09-10
Fitness: Required check
Category: Fork Management
Applies to: Patch providers, Enterprise recipients
Machine-readable: YAML / JSON

Structured Requirements

FORK-003.REQ-001 MUST automated

Patch providers must tag the unpatched baseline source commit using v+patch.baseline.

Check	Severity	Evidence
FORK-003.CHECK-001 Baseline tag exists and resolves to a commit	blocking	baseline_tag, baseline_commit

Requirement

Patch providers MUST tag the commit that represents the unpatched baseline source state for a patched version.

The tag MUST use the form:

v<VERSION>+patch.baseline

This tag scheme applies regardless of the upstream project tag convention.

Rationale

Recipients need an unambiguous starting point for source comparison, provenance review, and audit evidence.

The +patch.baseline suffix is deliberately a source baseline marker. It does not identify an official patched release or artifact. Official OSERA patched releases are defined by REL-003 through the applicable ecosystem profile. Java release naming is defined in REL-003-JAVA.

The <VERSION> segment in v<VERSION>+patch.baseline SHOULD correspond to the source branch version in FORK-002 and the upstream version segment in the official patched-release identifier defined by REL-003.

Evidence

Patch evidence SHOULD include the baseline tag, the commit SHA it resolves to, and the corresponding upstream version or artifact.

Illustrative examples

Repository	Baseline tag
`patch-spring-framework`	`v5.3.39+patch.baseline`
`patch-gson`	`v2.8.8+patch.baseline`
`patch-activemq`	`v5.14.5+patch.baseline`

These examples show the ratified naming convention, not an inventory of published patches.