Status: Accepted (2026-07-04)
Decision: the scheme is named SemVer-Trust, hosted under the github.com/semver-trust organization (created). Repositories: spec — the specification (semver-trust.md), this design record, JSON Schemas, and conformance vectors; semver-trust-go — Go reference implementation (module path github.com/semver-trust/semver-trust-go). Future implementations follow semver-trust-<lang>. Attestation predicate-type URIs bind to a project domain, to be registered before the first attestation is emitted.
Rationale: the spec/implementation split follows TOML / in-toto / SemVer precedent and was already a design-record commitment (the idea outlives any one repo). The org carries project identity, so the spec repo is spec (the in-toto/specification pattern) rather than doubling the name. The Go repo takes the -go suffix — the dedicated-org convention (grpc-go, protobuf-go, opentelemetry-go) — not the go- prefix, which is the personal-namespace convention; semver-trust/go fails outright because the module leaf would name the package go. Org hosting protects the effectively-immutable Go module path. Pre-1.0, the conformance test suite is the sync contract between repos: implementations pin a spec version and pass its vectors (level-assignment matrix, precedence cases, fixture repositories with expected verification outcomes and attestations) instead of chasing prose changes — making the suite the spec repo’s most important artifact after the spec itself.
Rejected: go-semver-trust (prefix-convention mismatch — Brad’s original proposal, amended by suffix precedent); semver-trust/semver-trust (name doubling buys nothing); semver-trust/go (package naming); personal-account hosting (module-path fragility); deferring the predicate domain (it binds at the first emitted attestation).
Supersedes: the §2 naming deferral; closes former open thread #4.