Governance

Maintainers

The project is run by its maintainers, listed in the repository. Maintainers review and merge pull requests, cut releases, review trusted modules for the registry, and handle security reports and namespace disputes. A contributor becomes a maintainer by invitation of the existing maintainers after sustained, good-quality contributions.

Decisions

Decisions are made in public, in issues and pull requests. Small changes need one maintainer's approval; changes to the contract (packages/shared), the licence, this governance or the trademark policy need agreement among the maintainers. Disagreements are resolved by discussion; if that fails, by a majority of maintainers.

Contributions

Every contribution is licensed under the licence of the package it lands in (AGPL-3.0 for the server and admin, MIT for the contract, blocks and kits) and carries a Developer Certificate of Origin sign-off. There is no contributor licence agreement and no copyright assignment.

Releases

Spillway is built in phases; each phase ships as a usable release. Versions follow semver. Before 1.0, minor versions may break things and say so in the release notes; from 1.0, breaking changes wait for a major version and ship with an upgrade path. Only the latest release receives security fixes. The release calendar is published with the roadmap once dates are settled; dates are not promised before that.

The registry

Sandboxed extensions, themes and kits are listed after automated checks. Trusted modules, which run in the server process, are listed in default search only after a maintainer has reviewed them. Publishers can deprecate or yank their versions with a reason; maintainers can attach security advisories and remove packages that violate the code of conduct, the trademark policy or the law. The index is signed with the project key, which is held by the maintainers.

Code of conduct and security

The code of conduct applies everywhere the project happens, including the registry. Security reports follow the security policy.

Agents

AI agents may contribute code and content under the same rules as people and with a person accountable for what they submit. The rules for agents are part of this governance.