diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 59948b0..6b0a243 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -154,10 +154,11 @@ This is not an anti-AI policy. It is a "stand behind your work" policy. ## What belongs in this repository -Everything. Socair is developed entirely in the open, with no closed or paid -edition: the engine and checks, the report format, signing and verification, -the airlock, the integrations, and the reference data a feed carries. Checks -that need GPUs or the network land here too, behind an explicit opt-in. +Everything Socair does. It is developed in the open, and no check is held +back for anything else: the engine and checks, the report format, signing and +verification, the airlock, the integrations, and the reference data a feed +carries. Checks that need GPUs or the network land here too, behind an +explicit opt-in. ## Code of conduct diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 830b04b..a3e86c9 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -52,8 +52,11 @@ can alter a verdict. These hold for as long as Defilan maintains Socair: -- **No paid edition.** Every feature is in this repository under Apache-2.0. - Nothing is held back for a commercial version. +- **The engine stays free and open.** Every check, and everything needed to + scan, sign, verify, and gate a model, is in this repository under + Apache-2.0, and stays here. Defilan may offer products and services built + on Socair. They are not a paid edition of it, and none of them holds a + check back from this repository. - **Defilan never issues attestations for others.** The issuer of an attestation is whoever signs it, with their own key. An unsigned report says that no one has signed it. Socair, the tool, is never the issuer of a diff --git a/README.md b/README.md index eaa5686..291e1dc 100644 --- a/README.md +++ b/README.md @@ -235,9 +235,9 @@ what they do not check. Socair is open source under the Apache License 2.0, all of it: the engine and every check, the report format, signing and verification, the airlock, signed -acceptances and feeds, the wizard and console, and the integrations. There is -no paid edition and no feature held back. The work still to come, including -checks that run the model on your own GPUs, is built here in the open. +acceptances and feeds, the wizard and console, and the integrations. It is +free, and every check stays here. The work still to come, including checks +that run the model on your own GPUs, is built here in the open. ## Documentation diff --git a/ROADMAP.md b/ROADMAP.md index 7a2c573..db4aee6 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -132,7 +132,8 @@ Still to come: - **Scanning agent skills, MCP servers, or other agent artifacts.** Socair checks model artifacts. -- **A hosted service or a paid edition** ([GOVERNANCE.md](GOVERNANCE.md)). +- **A paid edition of the engine.** Every check stays here, free + ([GOVERNANCE.md](GOVERNANCE.md)). - **Saying a model is free of backdoors.** Socair reports what it inspected and lists what it cannot see in its [detection ceiling](docs/detection-ceiling.json). diff --git a/SUPPORT.md b/SUPPORT.md index ae75fa7..6896a5b 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -12,5 +12,4 @@ [SECURITY.md](SECURITY.md) describes. Never in a public issue, discussion, or pull request. A malicious file that earns a PASS is a detection bypass. -Socair has few maintainers, so an answer can take a few days. There is no paid -support. +Socair has few maintainers, so an answer can take a few days. diff --git a/docs/brand.md b/docs/brand.md index 9ee3ccb..c3002f9 100644 --- a/docs/brand.md +++ b/docs/brand.md @@ -20,8 +20,10 @@ Socair and the cairn logo are trademarks of Defilan Technologies. ## Positioning Socair is an open-source project from Defilan Technologies, under -Apache-2.0, with no paid edition. The trademark keeps the name: anyone may use, -change, and ship the code, but only the project ships something called Socair. +Apache-2.0. The engine and every check stay free. Defilan may offer products +built on it under the same name; they build on the open engine and hold no +check back from it. The trademark keeps the name: anyone may use, change, and +ship the code, but only Defilan ships something called Socair. LLMKube remains the open-source serving platform. Socair carries its own name under Defilan, not an LLMKube prefix, which leaves room for a product family