Skip to content
Menu

Waiver registry

A repository's administrators can waive the fee for a named organisation. Every waiver is public, repository-scoped, and free — selling one costs the persons responsible their registry powers, and can cost the project its listing (statutes Art. 10 para. 5), because a private exemption is exactly the side-deal this movement exists to make impossible.

No waivers exist yet

Waivers require the claim flow, which does not exist at v0. An empty list is the correct state, not a missing feature and not a failed fetch — a waiver is granted from the claim flow by a verified repository administrator and can never enter the registry by pull request, so there is no other way for one to appear here.

How waivers behave

A waiver is the project steward's licence-vested power to exempt a named organisation from the Purpose Condition for their repository. The Association is registrar and witness: the administrators grant it, we record it and witness it, and the beneficiary receives a signed Waiver Certificate — never a licence from us, because we hold no rights in the code we register for others and could not grant one.

  • Public, always. Never per-organisation and never private. A private waiver would make coverage unanswerable, and an invisible exemption is the side-deal scandal vector this rule exists to close. Publicity also protects administrators: a corporation cannot lobby quietly for something that appears on this page.
  • Gratis, always. An administrator who sells an exemption loses their registry powers, and the project its listing where its administration as a whole is responsible (statutes Art. 10 para. 5). There is no fee a waiver can carry, so there is nothing to negotiate.
  • Repository-scoped. A waiver covers the repository that granted it and nothing else. Any verified administrator of that repository may grant or revoke one.
  • Revocation is prospective. Once the cooling window has closed, every part the waiver covers that was public by the revocation stays usable by the beneficiary forever — the same rule every Entitlement follows (licence §9), with the revocation or expiry as the end. A part counts as public from the day anyone can first get it, for example from a public commit; it does not need to be in a release. Revocation and expiry reach only parts made public afterwards, and use the waiver allowed before stays lawful (a revocation inside the cooling window vests nothing — see below).
  • A 72-hour cooling window. A waiver is effective immediately — coverage answers yes from the moment of grant — but permanent vesting attaches only when the window closes. A waiver revoked inside the window vests nothing, because nothing had time to; what the waiver permitted before the revocation stays lawful, as after any revocation. That is the answer to a compromised administrator account, which live re-verification cannot detect: the window kills the permanence of the attack without making the ordinary case slow.
  • Step-up re-authentication at grant, every co-administrator notified, one shared per-repository audit log, and an optional two-administrator approval for repositories that want it. Disputes between co-administrators are the project's own governance: we record outcomes and never arbitrate.
  • Unclaimed repositories have no waivers. Waiving requires the claim, because a waiver has to be attributable to a verified administrator to mean anything.
  • A waived organisation gets a licence-status certificate only — never a supporter or impact certificate. They funded nothing, and a certificate implying otherwise would be a misleading claim we handed them ourselves.

Machine access: /v1/waivers/all.json and /v1/waivers/{node_id}.json, both ETagged; same-origin static copies at /artifacts/waivers/all.json. See the API reference.