From ec139fbe04462f0ac5997870ceec18f8681a67fe Mon Sep 17 00:00:00 2001 From: DIDX Date: Fri, 19 Jun 2026 15:47:45 +0800 Subject: [PATCH] Document OSS funding use and roadmap --- FUNDING_USE.md | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++ README.md | 10 ++++++++++ ROADMAP.md | 46 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 109 insertions(+) create mode 100644 FUNDING_USE.md create mode 100644 ROADMAP.md diff --git a/FUNDING_USE.md b/FUNDING_USE.md new file mode 100644 index 0000000..ecea195 --- /dev/null +++ b/FUNDING_USE.md @@ -0,0 +1,53 @@ +# Funding Use: Codex Open Source Fund + +Passpod TASK Core is a public open-source standard layer for sensitive-action control: **no receipt, no sensitive action**. + +This repository provides schemas, examples, validator/CLI tooling, OpenAPI references, and documentation for Trust Action Receipts and decision states such as `allow`, `deny`, `review_required`, `freeze`, and `revoke`. + +## Why API credits matter + +Passpod TASK Core is security-sensitive OSS. Developers may copy its schemas, examples, and validation patterns when building AI-agent, automation, approval, or sensitive-action workflows. Weak examples or inconsistent validation could spread unsafe patterns. + +API credits would help maintain and harden the public OSS layer as a solo maintainer. + +## Planned use of API credits + +Credits would be used for public repository maintenance only: + +- Codex-assisted schema validation checks +- Validator and CLI test generation +- OpenAPI consistency checks +- Example receipt generation and review +- Regression tests for valid and invalid receipts +- Detection of unsafe or ambiguous examples +- Documentation drift checks +- Release note and changelog drafting +- Issue and pull request triage automation +- Security review of receipt, state, and revocation flows + +## Not for private commercial use + +Credits requested for this repository would not be used for private customer operations, private pilot data, commercial backend execution, or production key issuance. + +Commercial and private systems remain separate from this public OSS standard layer. + +## 30 / 60 / 90 day plan + +### First 30 days + +- Harden validator examples +- Add invalid and replay-risk test cases +- Improve README quickstart +- Add clear public/private boundary notes + +### First 60 days + +- Expand receipt gallery +- Add OpenAPI/schema drift checks +- Add issue templates for schema, security, docs, and validator feedback + +### First 90 days + +- Add maintainer automation for pull request review +- Publish release workflow notes +- Improve standards crosswalk notes for OWASP, NIST, OpenID, W3C DID/VC, EUDI, MCP, and FIDO diff --git a/README.md b/README.md index 6633b0e..3596baf 100644 --- a/README.md +++ b/README.md @@ -46,3 +46,13 @@ Request Pilot Access: pilots@passpod.io ## Public/private boundary This repo does not contain production signing keys, scoped key generation internals, buyer-specific workflows, real customer receipts, or Passpod Hub backend code. + + +## Open source maintenance + +Passpod TASK Core is maintained as a public OSS standard layer for sensitive-action control. + +- [Roadmap](ROADMAP.md) +- [Funding Use](FUNDING_USE.md) + +Credits or OSS support requested for this repository are intended for public maintenance only: schema checks, validator/CLI improvements, OpenAPI consistency, examples, tests, documentation, release workflows, and security hardening. diff --git a/ROADMAP.md b/ROADMAP.md new file mode 100644 index 0000000..5511d6e --- /dev/null +++ b/ROADMAP.md @@ -0,0 +1,46 @@ +# Passpod TASK Core Roadmap + +Passpod TASK Core is an open-source Trust Action Standard Kit for sensitive-action control. + +The goal is to help developers test safer patterns before high-risk actions execute. + +## Current scope + +- Trust Action Receipt schema +- Example receipts +- Validator / CLI tooling +- OpenAPI reference +- Demo-only implementation guidance +- Public/private boundary documentation + +## Near-term milestones + +### v0.1.x — OSS clarity and testability + +- Make the README understandable in 30 seconds +- Ensure fresh-clone validation works +- Add valid and invalid example receipts +- Document decision states clearly +- Improve OpenAPI/schema consistency + +### v0.2.x — Security hardening + +- Add replay-risk examples +- Add revocation and freeze examples +- Add unsafe-example checks +- Add regression tests for validator edge cases +- Improve security reporting and maintainer workflow + +### v0.3.x — Maintainer automation + +- Add issue triage workflow notes +- Add pull request review checklist automation +- Add release checklist automation +- Add documentation drift checks +- Add standards crosswalk notes + +## Non-goals for this public repo + +This repository does not issue production receipts, production keys, customer credentials, private pilot records, or commercial access. + +Production and hosted workflows belong in a separate private/commercial boundary.