Protocol
Governance
VCC is an experimental open protocol. CalcFleet is its first reference implementation. This is not a mature or ratified standard — publishing governance now is what makes the word “open” substantiable: anyone can implement VCC without CalcFleet’s services.
Licensing
- Code — reference implementation, verifier, schemas and test vectors are licensed Apache-2.0, which includes a patent grant so third parties can implement the protocol safely.
- Specification text — licensed CC-BY-4.0. Share and adapt with attribution.
- CalcFleet’s hosted services, brand and site content are not covered by either license.
Neutrality
The protocol must be implementable without using CalcFleet’s commercial services. Any part that cannot yet be implemented independently is declared experimental, with a documented path to fix it. Before each release we check: can an independent party issue and verify a VCC without calling CalcFleet? Where the answer is “not yet”, the dependency is declared and a mirror/export path is documented.
Decision process
Normative changes are recorded as ADRs (decision records) stating the problem, proposal, alternatives, security and privacy implications, compatibility and decision. Security- and privacy-affecting changes are not merged without an explicit section. Accepted changes update the specification, JSON Schema, test vectors and conformance corpus together, so they never drift.
Adoption gates
Public claims change only when objective gates are met. We are at the first level.
Public spec, schema, reference verifier, test vectors, reference implementation, security considerations
Allowed claim: “experimental open protocol”
≥2 independent verifiers, ≥1 independent issuer, cross-language conformance, public interop report, no mandatory CalcFleet dependency
Allowed claim: “interoperable open protocol”
≥3 external organizations, ≥2 use cases, documented dispute/review workflow, security review, key + receipt lifecycle tested
Allowed claim: “being piloted in real business workflows”
Independent governance participation, several interoperable implementations, public change process, stable core, external adoption, conformance suite, operational experience
Allowed claim: “candidate for broader standardization”
We do not use “standard” as a fait accompli before a formal process.
Versioning, security, contact
The protocol uses SemVer; the core data model is v0.x (unstable, breaking changes allowed with a changelog entry). A formula change is a version change — a receipt pins the exact formula version it used. Report security issues per our security policy. Governance contact: privacy@calcfleet.com.