Status: Accepted (2026-07-04)
Decision: Apache 2.0 for semver-trust-go, the JSON Schemas, and the conformance vectors; CC BY 4.0 for specification prose and design documents. Control is exercised through three non-license levers: (a) a TRADEMARK.md name-use policy — the name and the claim “SemVer-Trust conformant” are gated on passing the conformance suite for a stated spec version; (b) spec-repo governance — sole editor pre-1.0; (c) copyright — the CLA-vs-DCO decision is deferred until, and MUST be made before merging, the first external contribution.
Rationale: the license is the wrong lever for the desired control. Name and conformance control is trademark, direction is governance, relicensing flexibility is copyright ownership — none weakened by a permissive license, and Apache 2.0 §6 explicitly withholds trademark rights from its grant. Apache 2.0 matches the sigstore/in-toto/SLSA neighborhood and enterprise patent-grant expectations; conformance vectors must be maximally permissive because every implementation vendors them into its test tree; CC BY matches spec-prose precedent (SemVer itself is CC BY). The near-term risk is obscurity, not theft — fragmentation is a problem earned by succeeding, and trademark + conformance gating is the tool sized for it. A trust-evidence scheme published under a license its own audience reads as a rug-pull hedge would undercut its thesis.
Rejected: CC BY-ND pre-1.0 (also blocks translations and annotated copies; signals distrust); BSL/FSL-style source-available (fatal to a zero-traction standard — cf. HashiCorp→OpenTofu, and that was a product with traction); GPL/AGPL (CI-embedding friction contradicts adoption); CC0 (waives copyright and attribution — the inverse of the deferred-control intent, despite being the only CC option in GitHub’s picker).
Implementation notes (verified/decided during setup): GitHub’s new-repo license picker (checked against the live UI, July 2026) offers no CC BY option — CC0 is its only CC entry — so the spec repo’s root LICENSE is a manual verbatim paste of the CC BY 4.0 legal code (title: “Attribution 4.0 International”; beware the SA/ND/NC sibling variants). GitHub’s Licensee detection recognizes verbatim text and badges it. Arrangement: root LICENSE (CC BY 4.0) + LICENSE-APACHE; Apache LICENSE copies inside conformance/ and schemas/ so vendored copies carry their license; SPDX headers (Apache-2.0 / CC-BY-4.0) per file; a README path→license map. TRADEMARK.md is drafted (§7) and implements lever (a) — policy, not a new decision, hence no separate ADR.
Revisit trigger: first external contribution (CLA/DCO); sustained commercial pressure (a new superseding ADR, never an edit).