K.2 Licensing and Governance

"No single company can own the standard. That includes us." The protocol site says it. Two documents make it checkable: the license files and GOVERNANCE.md. Both are read here as they stood on October 4, 2026, at commit c3e24cd, for what they permit, what they require and how the specification changes. This is not legal advice.

Two licenses, split on purpose

The README gives the split and the reason. "Code: Apache 2.0" and "Spec text: CC BY 4.0." Code is for anyone to "fork, vendor, and embed," and spec text is "reusable in books, articles, derivative specifications, and academic work without a separate negotiation." Every footer on both sites repeats it.

The repository's LICENSE file is the full Apache 2.0 text, with the copyright line filled in: "Copyright 2026 TranquilTech and Kindling contributors". Apache publishes the same text at https://www.apache.org/licenses/LICENSE-2.0. LICENSE-SPEC reads: "This specification text is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0)." package.json declares "license": "Apache-2.0". There is no NOTICE file.

Apache 2.0, for the code

Section 2 of the Apache License grants "a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form." Section 3 adds a patent license. It "shall terminate as of the date such litigation is filed" for anyone who sues claiming the Work infringes a patent.

Redistribute, and Section 4 sets 4 conditions:

Figures checked October 2026.

You may build a closed client. Section 4 ends: "You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions ... for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License." A proprietary Pool UI that embeds the reference validator is permitted, as long as the 4 conditions hold for the parts you took.

The name is held back. Section 6: "This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work." Section 7 provides the code "on an 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND." Neither the repository nor either Kindling site mentions a trademark, and neither publishes a trademark policy for the name "Kindling" (checked October 4, 2026). Describe your product as built on Kindling. Do not name it as if it were Kindling.

CC BY 4.0, for the specification text

Section 2(a)(1) of CC BY 4.0 grants "a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to: a. reproduce and Share the Licensed Material, in whole or in part; and b. produce, reproduce, and Share Adapted Material." LICENSE-SPEC adds: "for any purpose, even commercially."

The conditions are in Section 3(a)(1). When you share it, "including in modified form," you retain "identification of the creator(s)," "a copyright notice," notices referring to the license and the warranty disclaimer, and "a URI or hyperlink to the Licensed Material to the extent reasonably practicable." You must also "indicate if You modified the Licensed Material" and link or include the license. Section 3(a)(2) lets you do this "in any reasonable manner based on the medium, means, and context."

Section 2(b)(2) holds the rest back: "Patent and trademark rights are not licensed under this Public License."

So whoever quotes the specification, in a manual, a client's help pages or a charter, names the source ("Kindling Protocol Specification v0.1.1, Copyright (c) 2026 TranquilTech and Kindling spec contributors"), links the spec and the license, and says when the wording changed.

One gap. The README assigns "Code" to Apache 2.0 and "Spec text" to CC BY 4.0. The 6 JSON Schema files are normative (Appendix A of the spec) and also machine-readable code, and no file says which license governs them. The package as a whole declares Apache-2.0. Until the project says otherwise, meet both sets of conditions when you copy a schema.

Who decides today

GOVERNANCE.md names 5 roles, the fifth being a Working Group that does not exist until v1.0, and hands conduct to a committee. Their state on October 4, 2026:

Figures checked October 2026.

Remember the third principle: "Single-vendor capture is the failure mode to avoid." Every choice is tested by "does this make the protocol more or less ownable by any one entity?" and "The answer should always be 'less.'"

No legal body stands behind any of it. The FAQ: "Is Kindling a foundation? No. This site's address is kindling.foundation, but no foundation or other legal entity exists. TranquilTech publishes Kindling today."

How the specification changes

By RFC, "modeled on the Rust RFC repository." "RFC pull requests stay open for at least 14 days for substantive changes." Acceptance "requires support from at least two-thirds of active Spec Reviewers," where active means "a reviewer who has reviewed at least one RFC in the prior 90 days." There is a shortcut: "If no objection is raised in the comment period and at least two reviewers have explicitly approved, the RFC is accepted." Breaking changes need "at least one minor-version's notice before removal," as §12.3 also requires.

Now set the roster beside that process. With no Spec Reviewer named, the body that accepts RFCs had no listed members. The 7 seed RFCs are marked "Accepted (landed in v0.1)" and authored by "TranquilTech (initial maintainer)."

The road to a Working Group

GOVERNANCE.md stages the handover by version:

Figures checked October 2026.

The seats: "Two implementer seats," "One IndieWeb representative seat," "One Pool curator seat," elected "by registered curators," and "One advisory rotation seat." PR #4, the last commit before the research date, removed a reserved Mycelial seat: "Mycelial can compete for one like any other implementation, and no implementation holds a reserved seat."

The public texts match that list: the How page, the protocol site's timeline and glossary, docs/FRAMEWORK.md and the TranquilTech page all name the curator seat. Cite GOVERNANCE.md. It is the governing text.

Money stays out: "The project does not accept payment for spec changes, RFC acceptance, registry placement, or any other governance outcome."

Proposing a change, step by step

From CONTRIBUTING.md:

1. Decide whether you need an RFC. You do to "change normative behavior," add "a new field, schema, or section," or "deprecate or remove existing functionality." You do not for "Editorial fixes," "Adding examples," or tooling that changes no protocol behavior.
2. Fork and branch. For an RFC, "Copy RFCs/0000-template.md to RFCs/0000-your-short-title.md." Fill every section; "Sections you genuinely don't have an answer for can say 'I don't know yet, looking for input.'"
3. Run npm test, npm run lint and npm run format. "Every PR has to pass the test suite before merge."
4. Sign off every commit with git commit -s, the Developer Certificate of Origin.
5. Open the pull request. For an RFC, it stays open at least 14 days.
6. Thresholds: editorial, "one maintainer approval"; tooling and examples, "two reviewer approvals"; spec changes, "two-thirds support among active Spec Reviewers."

A curator's route is lighter. CONTRIBUTING.md invites "Field reports from Pool curators, in any form (a blog post, a talk, a thread, a journal)" and points to GitHub Discussions for "curator coordination." Private questions go to maintainers@kindling.foundation. Conduct reports go only to conduct@kindling.foundation.

Field exercises

1. List every Kindling file your product redistributes and the notice each needs. Done when each file has its license named, the full Apache text ships with your build, and changed files are marked.
2. Write the attribution line you will put under any quoted spec text. Done when it names the creator, the version, the copyright notice, a link to the spec and a link to CC BY 4.0, and says whether you changed the wording.
3. Decide whether a change you want needs an RFC, using CONTRIBUTING.md's 2 lists. Done when you can name the list item that decides it.
4. Draft an RFC from the template for one real ambiguity you found in K.1's exercises. Done when every section is filled or says "I don't know yet, looking for input."
5. Write down which licensing assumption you are making for the JSON Schemas and why. Done when the note is dated and filed where your next release checklist will find it.