RFC-0003 acceptance vote: Policy Bundle Schema Stability

[zoahdev]

Ballot for KGP-RFC-0003: Policy Bundle Schema Stability (https://github.com/zoahdev/kinegrant-protocol/blob/main/docs/rfcs/0003-policy-bundle-schema.md).

Freeze the \kinegrant:PolicyBundle\ schema version 0.1 as the stable policy distribution format (byte-stable bundles, current-version selection, per-registry fleet acknowledgements, normative ODRL mapping).

Voting window

Comment period: 14 days, closes 2026-08-29 23:59 UTC+8. Steering committee supermajority required. Vote by commenting below:

• APPROVE / REJECT
• Q1: keep \schema_version\ 0.1 with a frozen guarantee (recommended) or move to 1.0 (keep 0.1 verification for one release)?
• Q2: freeze fleet distribution reports in this RFC (recommended: defer to a follow-up RFC) or include now?

Minimum acceptance requirements (RFC process)

• Motivation grounded in real deployments: fleets and independent implementations depend on byte-stable bundles.
• Security-property changes: none; existing fail-closed behavior is preserved.
• Compatibility: additive fields only; unknown obligations/constraints/authorities remain rejected.
• Test plan: existing conformance (23/23), MPT (22/22), JS/Go cross-verification, and browser verifier tests keep covering the frozen surface.

[zoahdev]

Steering committee vote (owner):

• APPROVE RFC-0003.
• Q1: keep \schema_version\ 0.1 with a frozen guarantee; defer a 1.0 migration to a follow-up RFC.
• Q2: defer fleet distribution report freezing to a follow-up RFC.

Rationale: the frozen 0.1 surface is already verified fail-closed across Python/JS/Go and in the browser verifier; keeping 0.1 avoids a two-version migration today and preserves the release cadence.

[zoahdev]

How to review RFC-0003 in a few minutes, without trusting this thread:

1. Clone and run the conformance + MPT suites (byte-stable bundles and current-version selection are exercised there):

git clone https://github.com/zoahdev/kinegrant-protocol
cd kinegrant-protocol
pip install -e .
python -m kinegrant.conformance
python -m kinegrant.mpt

2. Independently re-verify a signed policy bundle and its ODRL mapping in the browser: https://kinegrant.com/verify/policy-bundle-verifier.html

3. The RFC text (including its test plan and the exact freeze being proposed) is at docs/rfcs/0003-policy-bundle-schema.md.

If anyone sees a compatibility or fail-closed regression this freeze would introduce, a REJECT with a concrete counterexample is exactly what we need. Voting closes 2026-08-29 23:59 UTC+8.

[zoahdev]

APPROVE

Q1: keep schema_version 0.1 with a frozen guarantee (recommended)
Q2: defer fleet distribution reports to a follow-up RFC (recommended)

理由：frozen 0.1 保持字节稳定，改动全是 additive，安全行为不变，现有 conformance 23/23、MPT 22/22、JS/Go 交叉验证继续覆盖冻结面。

[zoahdev]

RFC-0003 acceptance vote — status and rules

Draft: docs/rfcs/0003-policy-bundle-schema.md (2026-08-15)

Vote record so far

• Interim chair (zoahdev): APPROVE — keep schema_version 0.1 frozen; defer fleet-distribution-report freezing to a follow-up RFC.

Process (per docs/RFC-PROCESS.md)

• Comment window: at least 14 days from the draft date; window closes 2026-08-29.
• Decision: a supermajority of the steering committee accepts, rejects, or supersedes.
• Current interim committee: 1 seat occupied (interim chair), external seats open (see docs/community/STEERING-COMMITTEE.md).
• Conflicts of interest must be disclosed; interested parties do not cast the deciding vote on their own proposal.

Who may vote

• Steering committee members (seats are being nominated — see Discussion Call for input: steering committee seats, first external contributor, neutral governance #246).
• Independent reviewers and implementation authors are invited to record their position as advisory comments on this thread before the window closes; advisory votes do not count toward the committee supermajority but are recorded and considered.

How to review without trusting this thread

1. Clone and run python -m kinegrant.conformance and python -m kinegrant.mpt (byte-stable bundles and current-version selection are exercised).
2. Re-verify a signed policy bundle in the browser verifier (https://kinegrant.com/verify/policy-bundle-verifier.html).
3. Read the exact freeze proposed in docs/rfcs/0003-policy-bundle-schema.md.

Votes and advisory comments are public; the outcome will be recorded in docs/community/DECISION-LOG.md.

[zoahdev]

Halfway status — RFC-0003 acceptance vote

Window: 2026-08-15 draft → closes 2026-08-29 (9 days remaining).

Current record:

• Interim chair: APPROVE (freeze schema_version 0.1; defer fleet-distribution-report freezing to a follow-up RFC).
• Advisory votes: none yet.

Reminder to reviewers: advisory comments on this thread are recorded publicly and considered in the final decision. Five-minute participation path:

1. Read docs/rfcs/0003-policy-bundle-schema.md (中文版：.zh-CN.md).
2. Verify: python -m kinegrant.conformance + python -m kinegrant.mpt.
3. Comment your position + conflict-of-interest statement.

Tally and decision recording will follow the process in docs/community/RFC-VOTING.md after the window closes.