Governance and Constitution Source Pack

Source pack version 0.1 — verified 2 August 2026
These sources provide governance patterns and technical controls. They do not automatically establish ANUKA legal authority, democratic legitimacy, nonprofit status, fiduciary compliance, or regulatory approval.

Status labels

Normative process reference — a mature process suitable as a strong baseline.
Implementation control — a platform capability used to enforce part of governance.
Institutional pattern — a first-party governance example that informs ANUKA design.
Security baseline — current authoritative incident or risk-management guidance.
Conceptual reference — useful reasoning that is not adopted wholesale.
Legal watch — requires entity- and jurisdiction-specific review.

Open standards governance

W3C Process Document

Publisher: World Wide Web Consortium
URL: w3.org/policies/process
Published version observed: 18 August 2025
State: Normative process reference
Used for: Participation rules, group charters, consensus building, review, Formal Objections, appeals, technical-report maturity, amendments, records, and institutional roles.
Relevant principle: W3C describes quality and fairness as supported by consensus, review, implementation experience, and formal approval processes.
ANUKA boundary: W3C Membership, Team, Advisory Committee, Councils, and legal structure are not copied as ANUKA institutions.
Checked: 2 August 2026

W3C 2025 Process update announcement

Publisher: W3C
URL: w3.org/news/2025/w3c-updates-its-process-document
Date: 18 August 2025
State: Current-status reference
Used for: Confirmation that the 2025 Process took effect and for understanding current changes around charter refinement, objections, appeals, and amendment categories.
Checked: 2 August 2026

RFC 2026 — The Internet Standards Process

Publisher: RFC Editor / IETF process
URL: rfc-editor.org/info/rfc2026
BCP: BCP 9
Published: October 1996; updated by later RFCs
State: Normative process reference with update tracking required
Used for: Open standards goals, maturity stages, revision, retirement, notices, records, conflict resolution, and appeals.
Important limitation: RFC 2026 has numerous updates; implementation must check the current BCP 9 document set rather than treating the original text as the complete current process.
Checked: 2 August 2026

RFC 7282 — On Consensus and Humming in the IETF

Publisher: RFC Editor
URL: rfc-editor.org/info/rfc7282
Published: June 2014
State: Conceptual consensus reference
Used for: Rough consensus as resolution of issues rather than simple vote counting; distinction between understanding objections and satisfying every preference.
Important limitation: Informational RFC, not an ANUKA voting rule.
Checked: 2 August 2026

RFC 8789 — IETF Stream Documents Require IETF Rough Consensus

Publisher: RFC Editor
URL: rfc-editor.org/info/rfc8789
State: BCP update reference
Used for: Tracking current IETF consensus requirements relevant to BCP 9.
Checked: 2 August 2026

Apache governance patterns

A Primer on ASF Governance

Publisher: Apache Software Foundation
URL: apache.org/foundation/governance
State: Institutional pattern
Used for: Separation between corporate governance and project governance; boards, officers, committees, and Project Management Committees; delegated project autonomy with foundation-wide legal, brand, and infrastructure constraints.
ANUKA implication: Community and technical authority should not be confused with corporate authority.
Checked: 2 August 2026

Apache Board Charter

Publisher: Apache Software Foundation
URL: apache.org/foundation/governance/board-charter.html
State: Institutional pattern
Used for: Transparent board procedures, legal and fiduciary oversight, delegation, reporting, conflicts, and the rule that bylaws and law take precedence over a governance guide.
ANUKA boundary: ANUKA has not adopted ASF bylaws, nonprofit status, or board structure.
Checked: 2 August 2026

Apache Board of Directors

Publisher: Apache Software Foundation
URL: apache.org/foundation/governance/board.html
State: Institutional pattern
Used for: Conflict disclosure and recusal, periodic reports, broad policy oversight, and delegation of technical direction to projects.
Checked: 2 August 2026

Apache Project Management Committees

Publisher: Apache Software Foundation
URL: apache.org/foundation/governance/pmcs
State: Institutional pattern
Used for: Independent product/project governance within common foundation requirements, active membership, release authority, and direct reporting.
ANUKA implication: Resident products can govern local direction while complying with shared constitutional and protocol boundaries.
Checked: 2 August 2026

The Apache Way

Publisher: Apache Software Foundation
URL: apache.org/theapacheway
State: Conceptual and institutional reference
Used for: Earned authority, public decisions, consensus, responsible oversight, and vendor-neutral project governance.
ANUKA boundary: ANUKA reputation remains contextual and does not adopt the proposition that merit never expires in all contexts.
Checked: 2 August 2026

How the ASF Works

Publisher: Apache Software Foundation
URL: apache.org/foundation/how-it-works
State: Institutional pattern
Used for: Asynchronous archives, do-ocracy within scope, lazy consensus, negative-vote reasoning, project autonomy, and separation of board and technical direction.
Checked: 2 August 2026

Apache Product Name Usage Guide

Publisher: Apache Software Foundation
URL: apache.org/foundation/marks/guide
State: Trademark governance reference
Used for: Separation between open-source rights and trademark/affiliation claims, independent project governance, and accurate powered by or compatibility language.
ANUKA implication: Forkability does not grant ANUKA marks or verified resident status.
Checked: 2 August 2026

Repository governance and enforcement

GitHub — About CODEOWNERS

Publisher: GitHub
URL: docs.github.com — CODEOWNERS
State: Implementation control
Used for: Path-specific responsible reviewers and required code-owner review when combined with branch protection or rulesets.
Critical note: GitHub documentation recommends protecting the CODEOWNERS file or its directory because changing it can change approval authority.
ANUKA boundary: CODEOWNERS provides repository review controls; it does not create legal ownership or governance legitimacy beyond the repository.
Checked: 2 August 2026

GitHub — Creating rulesets

Publisher: GitHub
URL: docs.github.com — Creating rulesets
State: Implementation control
Used for: Targeting protected branches and tags, requiring status checks, requiring up-to-date branches, and limiting bypass authority.
Checked: 2 August 2026

GitHub — Available rules for rulesets

Publisher: GitHub
URL: docs.github.com — Available rules
State: Implementation control
Used for: Pull-request requirements, status checks, force-push blocking, code scanning, code-quality controls, and path restrictions.
Operational note: Bypass permissions are governance-sensitive and must be narrowly granted and logged.
Checked: 2 August 2026

Security and emergency governance

NIST SP 800-61 Rev. 3

Publisher: U.S. National Institute of Standards and Technology
URL: csrc.nist.gov/pubs/sp/800/61/r3/final
Published: April 2025
State: Security baseline
Used for: Integrating preparation, detection, response, recovery, and improvement into cybersecurity risk management across the NIST Cybersecurity Framework 2.0 functions.
Current status: Final; supersedes SP 800-61 Rev. 2.
ANUKA implication: Incident governance must be prepared before an incident and connected to ordinary risk governance, not improvised after compromise.
Checked: 2 August 2026

NIST Cybersecurity Framework 2.0

Publisher: NIST
URL: nist.gov/cyberframework
Published: February 2024
State: Security governance baseline
Used for: Govern, Identify, Protect, Detect, Respond, and Recover functions and organization-wide cybersecurity governance.
Checked: 2 August 2026

NIST Privacy Framework

Publisher: NIST
URL: nist.gov/privacy-framework
State: Privacy governance reference
Used for: Privacy-risk governance, data processing assessment, and balancing transparency with privacy.
Version note: Exact profile and version must be recorded by implementation.
Checked: 2 August 2026

NIST AI Risk Management Framework

Publisher: NIST
URL: nist.gov/itl/ai-risk-management-framework
State: AI governance reference
Used for: Govern, Map, Measure, and Manage functions, accountable AI deployment, and risk review.
Current-status note: NIST has stated that AI RMF 1.0 is being revised; recheck before ratification.
Checked: 2 August 2026

Authorization and delegation

OpenID AuthZEN Authorization API 1.0

Publisher: OpenID Foundation
URL: openid.net/specs/authorization-api-1_0.html
Status: OpenID Final Specification, approved January 2026
State: Implementation reference
Used for: Separation of policy decision points and policy enforcement points, structured authorization evaluation, and replaceable policy infrastructure.
ANUKA boundary: Governance authority still requires valid charters and legal bases; an authorization API only enforces encoded policy.
Checked: 2 August 2026

Open-source and fork rights

Open Source Definition

Publisher: Open Source Initiative
URL: opensource.org/osd
State: Normative licensing baseline
Used for: Determining whether software may accurately be called open source and whether fork and redistribution rights exist.
Checked: 2 August 2026

OSI Approved Licenses

Publisher: Open Source Initiative
URL: opensource.org/licenses
State: Normative licensing reference
Used for: Selecting approved open-source software licenses.
Checked: 2 August 2026

Creative Commons Attribution 4.0

Publisher: Creative Commons
URL: creativecommons.org/licenses/by/4.0
State: Documentation-license candidate
Used for: Sharing and adapting Foundation content with attribution if adopted.
Important limitation: Trademark, patent, privacy, publicity, and third-party rights are not automatically granted.
Checked: 2 August 2026

Adoption rules for ANUKA

Legal, corporate, protocol, product, repository, and operational governance remain distinct.
W3C and IETF processes inform proposal maturity, consensus, objections, records, and appeals without being copied institution-for-institution.
Apache patterns inform delegated product autonomy and the separation of corporate and technical governance.
GitHub controls enforce repository requirements but do not replace governance authority.
Emergency authority follows a published charter, strict scope, expiry, logs, and retrospective review.
Protected constitutional principles require a higher amendment process than ordinary policies.
Open-source and open-content fork rights remain separate from trademark and private-data rights.
Every role and council requires a charter, capability scope, expiry, conflicts, and review.
Shared treasury actions require a legal owner, authority map, ledger, and accounting controls.
Ratification requires more than merging Markdown into the default branch.

Review procedure

Before each governance release:

open every cited source;
confirm current status and publisher;
check updates, errata, and superseding versions;
confirm the source supports the exact governance claim;
separate institutional example from mandatory rule;
confirm legal-entity authority with applicable documents;
review constitutional compatibility;
review conflicts, participation, and affected parties;
test repository and authorization controls;
record verification date and responsible reviewer.

Known follow-up research

Before ratification or legal implementation, ANUKA needs dedicated work on:

chosen U.S. legal-entity structure and governing documents;
board, member, manager, and officer authority;
nonprofit, benefit-corporation, or foundation alternatives;
trademark and certification-mark governance;
antitrust risks in cross-company coordination;
lobbying and political-activity boundaries;
whistleblower and anti-retaliation obligations;
public-benefit and restricted-fund duties;
state charitable-solicitation requirements if donations are accepted;
cross-border governance, sanctions, privacy, and tax;
records retention, privilege, discovery, and litigation holds;
insurance and indemnification;
accessibility and translation of governance processes.

Registry maintenance

Last manual validation: 2 August 2026
Next review: Before Governance Pack v0.9 or within 90 days
Current status: Founding source pack