Governance at OpenPX™ means specific commitments, not a policy document. These are the ones behind everything we operate: the protocol, your data, your keys, the mappings, the log, and how decisions get made. Each one is something you can hold us to.
Our commitments
The spec and the schema are versioned. A published version never changes: a new one is published beside the old ones, and old versions stay available. Every version carries a digital fingerprint, so anyone can confirm they have the exact released file.
Your product data lives in repositories with clear boundaries: public for anyone to verify, partner for one trading partner, internal for your team. Data moves outward only on your instruction, and if you leave, it leaves with you, with its full history and signatures.
Your organization's public keys are published in your repository; private keys never are. A key is rotated by adding a new one beside the old, so records signed with a retired key still verify. A compromised key is revoked and marked as revoked, and anything signed with it after revocation is not trusted.
Mapping profiles and crosswalks to external taxonomies, such as a channel's categories, are versioned and announced, never changed silently. A silent mapping change can break listings, so every change has a version and a notice.
Every change is recorded in an append-only log: entries are added, never edited or removed. Anyone with access to a repository can audit its full history. For a public repository, that is everyone.
Conformance means passing published tests: a document validates against its schema version, and its signatures verify. Before OpenPX certifies any connector or implementation, the tests are published, so the bar is public and anyone can run it.
Deciding changes
Open an issue on openpx-org/openpx-schema describing what you need, and why.
The proposal is discussed in public, with the brands, channels and developers it affects.
The OpenPX maintainers decide, and say why. Today that is the OpenPX team. Once there are independent implementations of the schema built outside OpenPX, decision-making opens to a wider group that includes them.
An accepted change ships as a new version, with its own address and fingerprint, and is announced. Nothing already published changes.
What you can count on
License
