Governance.Who keeps the rules, and how.

Publisher

The publisher of this specification is wefetch. wefetch is a product of GreenCore Solutions Corp.

The publisher keeps the specification text, the receipt format, the conformance suite and the keyring. It is the first conforming implementation and the first issuer of receipts. It is not the owner of the words "Barcode verified": they are free to any conforming implementation.

Version policy

• A version is a number, major.minor. This is version 0.1.
• A minor version adds evidence, adds a field or clarifies text. A receipt issued under an earlier minor version stays reproducible under the version it pins.
• A major version may change what "verified" means. It is announced on this site before it applies, and the earlier version stays published.
• Every receipt pins two versions: this specification's and the market profile's. Neither is ever rewritten after publication; a change is a new version.
• Every published version stays at /versions.

How a market profile is added

1. The node's authority table names, for each field, who may assert it in that market.
2. Its references name the regulator and the rules the label and claims fields are read against, in the original language.
3. Its naming conventions and conformance scope are written from that market's record.
4. It is published only when its authority table has rows and the record holds products for that market (the gate). Until then its host forwards to the mark's home.
5. A profile adds evidence. It can never weaken this specification.

How a key is retired

Keys are listed on the keyring at rco-barcodeverified.org with their issuer, key id, status and the date since. A key is retired by changing its status, never by removing it. Receipts signed under a retired key still verify against it; a receipt is never revoked, and a later receipt supersedes it. Nothing is deleted.

A second publisher

There is one publisher today. Should a second organisation wish to publish this specification with wefetch, a consortium would open: a shared keyring, a joint version policy and a published list of members, set out here before it applies. None exists until then.

Contact

Questions about the specification. One form, read by a person.