argand-site-registry/GOVERNANCE.md

# Governance

Nic Weyand is the initial code maintainer. Maintainers review implementation,
dependency, format, provenance and source-license changes. There is no established
multi-party review board or centrally operated public dataset implied by this repo.
Maintainer additions and changes to this policy should be reviewed in public Git
history, with conflicts of interest disclosed.

Dataset publishers operate independently. Each publisher names its reviewers,
publishes its evidence and review policy, and distributes trusted signing keys
through a channel separate from the dataset. Consumers decide which publisher
identities they accept. Code-maintainer status does not grant authority to change
a consumer's accepted destinations or signing keys.

Policy, license, normalization, source-allowlist and signature changes receive
explicit maintainer review and complete acceptance checks. Additional independent
review is appropriate for trust-boundary changes when another qualified reviewer
is available. The software authenticates each decision to an allowed SSH reviewer
identity, but does not enforce a multi-reviewer quorum.

Corrections and appeals must identify the exact assertion or review fingerprint
and supply contrary evidence. Retain the original claim and decision, append the
correction or revocation, and explain its scope. Urgent suspected malicious
destinations may be revoked pending investigation. A release signer must not hide
revocations by selecting an old generation.

No payment, source popularity or contributor reputation buys destination approval.
Repeated deceptive submissions can be rejected while their supporting incident
record remains available to affected publishers. Avoid public exposure of secrets
or personal information when documenting abuse; follow SECURITY.md.