# Open Source and Open Standards Policies

## Open Standards Mandate

Company infrastructure and projects MUST use open standards where possible.
Proprietary/non-standard options: only when no suitable open standard exists.
Products released: must use open standards both internally and at external APIs.
When no suitable API standard exists: create new open standards, publish freely.

**Open standards definition:** publicly available specs, free of patents/fees, published by agency allowing public review, vetted before publication.

### Recognized Standards Bodies

- IEEE (Institute of Electrical and Electronics Engineers)
- W3C (World Wide Web Consortium)
- NIST (National Institute of Standards and Technologies)
- IANA (Internet Assigned Numbers Authority)
- IEC (International Electrotechnical Commission)
- ANSI / ISO
- OpenGroup

## POSIX Compliance

- All computer systems: run POSIX-compliant OS when possible
- Non-POSIX OS: requires specific justification + COO approval
- Development tools: prefer POSIX-compliant tooling

## FOSS (Free and Open Source Software) Governance

### Using FOSS Libraries

1. Review license for compatibility with CleverThis requirements
2. If uncertain → request OOC review before incorporating
3. All FOSS usage must comply with relevant licenses

### Contributing to External FOSS

1. Follow documented approval process
2. Verify no conflicts with existing IP or confidentiality agreements
3. Comply with TCRC (Technical Community Relations Committee) guidelines

### Creating a New FOSS Project

1. Register with OOC (document: scope, repositories, license, maintenance plan)
2. Include: recognized open source license file (GPL, MIT, Apache, etc.)
3. Include: README, contributor guidelines, license files in repository
4. Host on BOTH: internal (Forgejo) AND external platform (GitHub/GitLab)
5. Mirror: must be synchronized and operational at all times

### Releasing Proprietary Code as FOSS

- Requires explicit approval from: EP or EVP AND OOC
- Verify: IP rights, confidentiality obligations, contractual obligations intact

### Discovering License Non-Compliance

- Report to OOC immediately
- Submit remediation plan to ELB immediately

## Open-Source Community Engagement (TCRC Rules)

- Prioritize education and support over marketing
- Maintain authenticity and professionalism
- Controversial/sensitive topics: pre-approval from ELB required
- All presentations/workshops: align with CleverThis branding
- Confidential information: must not be disclosed during community engagement
- At least 2 external technical events per quarter (for TCRC members)

## FOSS Repository Requirements

- Must include: detailed README, contributor guidelines, license files
- Contribution guidelines: include coding standards and documentation requirements
- All external contributions: pass thorough review (automated checks + manual approval)
- Respond to community inquiries and merge requests within defined timeframe
- Major changes to project structure/licensing/governance: OOC majority vote required
- External mirrors: OOC responsible for keeping them synchronized and functional

## Bounty Management

OOC manages bounties placed on issues and related policies and procedures.
