Governance Model
PTI ecosystem governance combines practices proven in open internet standards and cloud-native foundations, adapted for regulated-adjacent trust infrastructure. This model is inspired by bodies such as the IETF, W3C, and CNCF — not a copy of any single organization's bylaws.
Design goals
The governance model MUST:
- Separate specification authority from implementation and operations
- Enable rough consensus among diverse stakeholders
- Provide escalation paths for architecture, security, and legal-adjacent questions
- Support a multi-phase transition from founder stewardship to mature ecosystem (Ecosystem Roadmap)
- Remain vendor-neutral in normative outcomes
Structural overview
Layers of authority
Layer 1 — Community (informal)
Anyone MAY participate in public review: comment on RFC drafts, file issues, run conformance self-assessments, and publish independent implementations. Community input SHOULD influence Working Group decisions but does not alone constitute approval.
Layer 2 — Working Group (normative process)
The Working Group owns the RFC process, specification lifecycle, and decision-making rules. It MUST publish meeting notes and decision logs for substantive votes.
Layer 3 — Review boards (specialized)
| Board | Mandate | Binding power |
|---|---|---|
| Architecture Review Board (ARB) | Cross-RFC coherence, layering, breaking-change impact | SHOULD block Accepted → Stable promotion without sign-off on architectural RFCs |
| Security Review Group (SRG) | Threat models, crypto choices, disclosure coordination | MUST review all RFCs touching authentication, encryption, or trust exchange |
| Conformance Program Board | Profiles, test suites, certification policy | MUST approve profile changes affecting certified implementations |
Review boards RECOMMEND; the Working Group MUST respond publicly to blocking recommendations.
Layer 4 — Stewardship (transitional)
During early phases, a Stewardship Council (initially aligned with the founding steward) MAY:
- Fund infrastructure for RFC publication and test harnesses
- Appoint initial Maintainers and board members
- Execute trademark policy pending foundation transfer
The Stewardship Council MUST NOT unilaterally change Stable RFCs. Specification changes MUST follow Layer 2 process.
Comparison to familiar models
| Aspect | IETF-style influence | W3C-style influence | CNCF-style influence | PTI adaptation |
|---|---|---|---|---|
| Document unit | Internet-Draft → RFC | Recommendation track | Project sandbox → incubating | PTI RFC lifecycle |
| Consensus | Rough consensus, running code | Group decision, AC review | Technical oversight committee | WG + ARB for architecture |
| Implementation proof | Interoperability demos valued | Implementation report | 至少 two adopters for graduation | Conformance tests + pilot implementations |
| Membership | Individual participation | Member organizations | Vendor-neutral foundation | Open participation; no fee for RFCs |
| IP policy | Royalty-free standards | W3C patent policy | CNCF CLA | RF terms for normative contributions (see Contribution Process) |
PTI does not adopt any external body's membership fees, patent pools, or trademark rules wholesale. Implementers SHOULD consult counsel for IP implications in their jurisdiction.
Decision types and forums
| Decision type | Primary forum | Appeal path |
|---|---|---|
| New RFC acceptance | Working Group | Re-open with new evidence; ARB review |
| RFC status promotion | Working Group + relevant board | Stewardship Council audit (Phase 1–2 only) |
| Profile / test change | Conformance Program Board | Working Group ratification |
| Security advisory | SRG → Working Group | Public disclosure timeline |
| Trademark dispute | Trademark policy owner | Documented escalation (Phase 3+) |
| Governance rule change | Working Group supermajority | Public comment period (minimum 28 days) |
Transparency requirements
The following MUST be publicly accessible:
- Active RFC drafts and status history
- Accepted governance documents in this section
- Conformance profile definitions and test suite versions
- Security advisories after coordinated disclosure
- Annual stewardship report (from Phase 2 onward)
The following MAY be restricted temporarily:
- Embargo-stage vulnerability details
- Personal data in contribution attribution
- Pre-decision legal advice
Phase-dependent governance
Governance authority expands with ecosystem maturity:
| Phase | Working Group | Stewardship | Independent foundation |
|---|---|---|---|
| Phase 1 | Convened; Maintainers appointed | Strong operational role | Not yet |
| Phase 2 | Elected Maintainers; partner seats | Shared funding | Exploratory |
| Phase 3 | Community-elected leadership | Advisory | Forming |
| Phase 4 | Foundation-directed | Minimal | Primary legal home |
See Ecosystem Roadmap and Future Foundation Model.