Identity · rights · governance · evidence · security · provenance
Active · pre-stableGoose ARWP does not use a single trust or readiness score. This page exposes who maintains the project, what rights and naming boundaries apply, how collaboration and governance work, what evidence it uses, how corrections are handled, how releases can be verified, what remains external or planned, and what none of those signals prove.
The Project hub separates copyright/reuse, project-reserved names and marks, partnership/collaboration, governance and privacy. Existing security, corrections and history complete the current project maturity surface set. The machine-readable manifest records roles without pretending page count is maturity.
Goose ARWP is maintained by Dzmitryi Kharlanau. The canonical source repository and project site are linked below; citation metadata lives in CITATION.cff.
The resolver accepts public URLs and parses untrusted web metadata, so network boundaries and read-only behavior are security-relevant. Reports should follow the repository security policy rather than public exploit disclosure.
Material published factual errors are recorded in a public ledger. Benchmark improvements are preserved as revisions rather than relabeled as corrections, and superseded claims remain discoverable.
The npm workflow uses GitHub OIDC/trusted publishing. The next npm publish is configured to pack the exact tarball, generate a CycloneDX dependency SBOM, attest provenance and the SBOM to that same tarball, then publish that exact artifact.
gh attestation verify <tarball> -R dkharlanau/agent-ready-web-profile
The MCP Registry publisher dependency is also version- and SHA-256-pinned before execution.
Boundary: provenance and SBOM attestations prove scoped build/dependency facts; they do not prove that the artifact is vulnerability-free or correct.
The repository is prepared for Zenodo archiving through CITATION.cff. No DOI is claimed yet. A DOI will be published here only after the repository is externally enabled/archived and Zenodo actually issues one.
OpenSSF Scorecard ran successfully on main on 5 September 2026, published its results and uploaded SARIF to GitHub code scanning. Goose treats that as an external repository-practice signal, not as proof of correctness or a security certificate. OpenSSF Best Practices self-certification remains a separate external task.
Current software is licensed under PolyForm Strict 1.0.0; earlier Apache-2.0 revision grants remain valid. Designated Goose-authored press/research/media material is available under CC BY 4.0, including explicit AI/ML reuse permission where covered by the rights manifest. Other content and third-party material keep their own rights boundary.
The naming policy publishes current and legacy project naming roles but does not assert registered-trademark status or completed legal clearance. The research catalog reuses the existing dataset entities and links to actual data, sources and limitations. No dataset DOI is claimed.
The optional evidence inventory checks static artifact, project-surface and dataset-page consistency. The measurement plan defines discovery, resource intent and independent adoption. Baselines are unknown; custom events are specified, not instrumented. Neither file proves search impact.
It does not prove that Goose ARWP is legally compliant in every jurisdiction, vulnerability-free, universally adopted, endorsed by upstream protocol owners, guaranteed to rank in search/AI systems, or correct outside each claim's stated evidence and date. Trust signals are useful because they are inspectable and bounded, not because they remove judgment.