⚠️ Editorial note: The open source ecosystem in China operates under a distinct institutional framework — characterized by state-led initiatives, intranet-like boundaries, and top-down governance. Readers should be aware that this context differs from the community-driven open source model common in other regions. The term “open source” as used in Chinese media may refer to practices that diverge from the conventional definition.

China Open Source Daily — 2026-10-25

⚖️ Legal & Licensing — Weights in Nine Days: What Kimi K3.1 Pro’s Staged Release Says About Who Owns the Decision to Publish

1. The release and the date that matters. On 2026-10-23, Moonshot AI (月之暗面) released Kimi K3.1 Pro — described in the company’s own framing as “the first model in our new K3.1 series and our most capable 3T-class open-weight model to date” — together with a faster variant, Kimi K3.1 Pro Highspeed, said to run at two to three times the speed of the standard model. Both support a one-million-token context window. Both went live the same day across Kimi.ai, the Kimi mobile apps, Kimi Work, Kimi Code and the Kimi API. The weights did not.

The weights are scheduled for 2026-11-04. Every account of the launch reviewed here — the company blog as summarised by PANews and by 爱范儿, the English coverage from SiliconANGLE and The Economic Times, and the state wire copy from China News Service (中新社) on 2026-10-24 — states the same commitment: the complete model weights will be released before 2026-11-04. China News Service’s write-up, published under the headline “3-trillion-class parameter scale: the world’s largest open-source AI model is updated”, frames the model as having “retained the title (蝉联) of the world’s largest open-source model”, successor to July’s Kimi K3 at 2.8 trillion parameters.

2. What the numbers are, stated precisely, because the coverage is loose with them. Total parameters: 2.8 trillion, with 104 billion active per token across 896 experts — the architecture Kimi K3 established, post-trained further. The “3-trillion-class” (3万亿级) language in the state and trade press is a class label, not a parameter count, and this briefing uses the count. Published performance: 65.7 percent on Terminal-Bench 4.0, against 58.2 percent for GPT-6 Astra and 66.4 percent for Claude Opus 5.5; 92.7 percent on BenchCAD; an internal hallucination rate on single-statement fact tests falling from 23.4 percent (K3) to 8.3 percent; an Artificial Analysis Intelligence Index of 55, fourth globally, an eleven-point improvement on K3. Pricing on the API: USD 2 input / USD 10 output / USD 0.20 cached input per million tokens, one-third below K3.

3. The licence question, which is the one that decides what kind of event this is. Kimi K3 was published in July under a bespoke Kimi K3 licence — read in full by VentureBeat at the time — which is MIT-like in its grant and then adds two scale-triggered obligations. Clause 2 begins: “If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 20 million US dollars … in total over any consecutive 12 months, the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any commercial purpose.” Clause 3 requires that once a commercial deployment exceeds 100 million monthly active users or USD 20 million in monthly revenue, “Kimi K3” must be prominently displayed on the user interface. Both clauses are disapplied for strictly internal use. Whether K3.1 Pro’s weights ship under the same terms, a modified version, or Apache 2.0 has not been stated in any source reviewed for this briefing. That single unstated fact determines whether 2026-11-04 is a grant or a distribution.

4. The safety clause, which is a design fact rather than a marketing one. Moonshot states that to reduce the risk of cybersecurity misuse once the weights are open, it removed cybersecurity-related material from both the mid-training corpus and the reinforcement-learning environments, while retaining general coding tasks. The consequence is quantified: on xdev-bench-hard — a test requiring the agent to exploit recently disclosed vulnerabilities in software including the Linux kernel, Node.js and Exim, and to retrieve a secret string from a sandbox — K3.1 Pro scores 81 percent, while a build trained without the cuts scores 90.5 percent. Predecessor Kimi K3 scored 33.3 percent. The company states its aim: “We aim not to release open weights that would extend the absolute frontier of cyber capability,” and that it intends to “progressively raise the cyber capability available in open weights.” The benchmark chart places DeepSeek-V4.1-Flash at 85.7 percent and GLM-5.3 at 57.1 percent, with the caveat that both ran on a different harness; no score has been independently corroborated.

5. Two commercial details that belong in the record. The company states that the Kimi enterprise edition does not enable the new model by default — an organisation’s administrator must switch it on. And this release arrives under an IPO process this series has tracked: Moonshot reached a USD 50 billion valuation in October, with a Hong Kong listing targeted for early 2027, and a shareholder dispute with a former investor unresolved as of the Reuters reporting of 2026-10-11.

Institutional Analysis & Commentary:

The interesting object here is not the model. It is the nine-day gap, and the reason it is interesting is that this ecosystem has spent the past fortnight building a formal vocabulary around exactly this decision.

Start with what the gap actually is. Kimi K3.1 Pro is available, in full, to anyone with a Kimi account, an API key, or an enterprise contract. It is not available as files. Between 2026-10-23 and 2026-11-04 the same artefact exists in two legal forms: a service that Moonshot operates and meters, and a work that will shortly belong to whoever downloads it. Chinese law has names for these and has had them for years — the distinction between a service (服务) and a content product (内容产品), between provision of computing and provision of a thing, is the same distinction MOFCOM’s Q&A drew ten days ago when it said that serving overseas users through an API, a web application or SaaS does not constitute exporting a restricted technology, while overseas deployment of the model does. On that reading, 2026-11-04 is not a marketing beat. It is the day the artefact crosses from one regulatory category into another.

Which is why the timing is worth stating without insinuation and without naivety. Announcement No. 48’s consultation closes 2026-11-15. Its operative treatment of open source is a scope exclusion for technology that has “already entered the public domain by means of open sourcing”, and a separate automatic licence — “basically immediate report, immediate release” — for open source within the restricted categories. A 2.8-trillion-parameter release lands above the draft’s 2-trillion-parameter threshold, which means Kimi K3.1 Pro is not a marginal test of the exemption: it is the first release by a major Chinese lab that the exemption was, plausibly, written to accommodate. Publishing on 2026-11-04, eleven days before the comment period closes and before the Catalogue is formally revised, puts the weights into the public domain inside the window in which being in the public domain is dispositive.

This is the “stockpiling” reading, and it should be offered with its own caveat. If firms believe the exclusion will survive the final text, publishing early and publishing late are equivalent and the date is a product schedule. If firms believe the exclusion may be narrowed in revision, publishing early is strictly dominant, because a published weight cannot be recalled and the exemption is written in the past tense — “technologies that have already entered the public domain”. Under that second belief, the rational move for every lab above the threshold is to publish before November 15, and the aggregate effect of the draft would be a deadline that produced a wave of disclosure. Nothing in the sources reviewed here shows Moonshot reasoning this way; the nine-day gap is equally explainable as a normal serverless-to-serverless rollout with a safety card. But the date is public, the incentive is public, and the opening of the observation window costs nothing: count how many Chinese open-weight releases above two trillion parameters land between 2026-10-16 and the day the revised Catalogue is published. If the count is zero or one, the window thesis is wrong and the draft is simply a regime. If it is three or four, the draft has functioned as an accelerator of openness, and everyone describing it as a restriction will have to explain that.

Now the licence, which is where the actual institutional change of 2026 is happening, and it is happening in the opposite direction to the one the policy conversation assumes. The Interconnects open-artifacts log put the pattern plainly this month: Western labs loosened in 2026 — Google’s Gemma-4 and Meta’s Muse-Glimmer moved to Apache 2.0 — while Chinese frontier labs tightened. Kimi K3 requires a commercial agreement above USD 20 million for Model-as-a-Service operators. MiniMax M3 carries a revenue threshold plus prohibited use cases; MiniMax M3.1 Flash, released on 2026-10-23 at 428 billion parameters, has not had its licence terms established in the sources this series has reviewed. Zhipu’s GLM-5.3 switched from MIT — which GLM-5.2 and everything before it used — to a bespoke licence under which a Model-as-a-Service operator with affiliates’ aggregate revenue above USD 10 billion over twelve months “must pass Z.AI’s security review before using the Software or its derivative works for any commercial purpose,” with “the scope and method of the security review … reasonably determined by Z.AI.” And Alibaba’s Qwen3.8-2.4T-A95B arrived, unexpectedly, under a custom licence rather than the Apache 2.0 the Qwen line has used.

Read the Zhipu clause slowly, because it is the most consequential sentence in this week’s material. A licence condition that grants permission subject to a review whose scope and method are set by the licensor is not a condition. It is a discretion. In Hohfeld’s terms, it is not a right with a correlative duty; it is a power, held by one party, whose exercise the other party cannot predict, bound, or appeal. And the reason this matters beyond contract law is that a commons is defined by the absence of exactly this: the founding move of open source was to replace a permission that someone could grant or withhold with a permission that is granted in advance, to everyone, permanently, unconditionally. MIT and Apache 2.0 are not generous; they are impersonal. They cannot be administered. A bespoke licence with a discretionary review, a revenue threshold, a naming obligation at scale, and an undefined term (“affiliates”, which the Chinese text renders 关联方 and which, unlike the English, has a statutory definition) is a different instrument in kind.

The counterweight is real and should be stated plainly. Every one of these labs publishes something a stranger can download, run offline, fine-tune and study, and that is a genuine and large public good that did not exist three years ago. The custom-licence turn is also not inexplicable: an inference provider that resells a frontier model at scale is capturing the lab’s own margin, and the labs are attempting, in a legal instrument, what the GPL attempts in a different register — to prevent a downstream party from enclosing the commons. There is a respectable copyleft-style argument here, and the fairness of a revenue-triggered clause is not something this briefing can settle. What it can say is that the objection to GPL was never that it imposed conditions; it was that the conditions were knowable in advance by anyone, including a competitor, without negotiation. A condition whose scope is set after the fact by the party it benefits is not that.

Which brings the analysis to the one thing this release demonstrates that no licence clause can, and it cuts the other way. The ecosystem work is substantial and it was done before the grant was made. Moonshot’s July release shipped weights plus the 47-page technical report plus inference infrastructure, optimised attention kernels, MoE communication libraries and deployment components, with day-one support in vLLM and SGLang — independent, globally governed serving frameworks whose maintainers owe Moonshot nothing. Portability, in the sense this series has used the word — the recipient can run the thing without the originator — was engineered, not merely permitted, and it was engineered by a firm that also wrote a licence its competitors cannot easily live under. That combination is not incoherent. It is precise about which forms of openness cost the firm nothing and which cost it a reseller.

The checkable question. Three observables, all public within a month. First: the licence text on 2026-11-04. If the weights ship under Apache 2.0 or MIT, the tightening story is wrong about the largest Chinese model, and the custom-licence pattern lives only at the second tier. If they ship under Kimi K3’s terms unchanged, the frontier of Chinese open weights is now conditional at the top and open at the tail — and the practical question for every non-Chinese integrator becomes not “is it open source” but “am I over the revenue line, and who decides”. Second: whether the cyber-capability decision is documented. Moonshot has made a substantive choice — deliberately removing a capability class from its own model before publishing — and has published numbers for what it cost (81 vs 90.5 on xdev-bench-hard). A benchmark that a firm invents, runs on its own checkpoints, and reports only in aggregate is not verifiable. If the xdev-bench-hard harness and evaluation code are published, this becomes a practice others can be held to. If they are not, it is a press release with a number in it. Third, and the one that will actually be used: does GLM-5.3’s security-review clause get exercised? No published case exists of a lab invoking a discretionary review against a named licensee. The first one will tell everyone whether these clauses are governance or whether they are reservation-of-rights boilerplate meant never to be used.

Sources:

🏛️ Policy & Regulation — “Participating and Integrating”: What CCF’s Chengdu Seminar Says About the Gap It Has Already Measured

1. The meeting. On 2026-10-23 in Chengdu, the CCF Open Source Development Technical Committee (CCF开源发展技术委员会, CCF ODTC) held a seminar titled, in the committee’s own account, an exploration of growth-style construction of the open-source ecosystem and future development paths (开源生态成长式构建探索与未来发展路径研讨会). The record was published by the committee’s own WeChat account and reached this briefing through the manual WeChat input channel that supplies this section. The participant list is the part a foreign reader should not skip, because it is the roster of the institutions that actually teach open source in China: Wang Huaimin (王怀民), Academician and professor at the National University of Defense Technology, who chairs the committee; Zhou Minghui (周明辉), professor at Peking University; Wu Fan (吴帆), distinguished professor at Shanghai Jiao Tong University; Guo Bin (郭斌), professor at Northwestern Polytechnical University; Li Xiaowei (李晓维), researcher at the Institute of Computing Technology, Chinese Academy of Sciences; Tian Cong (田聪) of Xidian University; Zhang Lei (张蕾) of Sichuan University; Tian Ling (田玲) of the University of Electronic Science and Technology of China; Yang Liyun (杨丽蕴), senior engineer at the China Electronics Standardization Institute; Yin Gang (尹刚), associate researcher at Hunan Zhixing Technology; Wang Tao (王涛), associate researcher at NUDT; and Zhang Yuxia (张宇霞), associate professor at the Beijing Institute of Technology.

2. The judgement, in the chair’s words as the committee reported them. Wang Huaimin assessed that China’s open-source development has entered the key stage of “participating and integrating” (参与融入); that open source is a strategic fulcrum of artificial intelligence innovation and of technological competition; and that in the course of advancing toward “global open-source leadership” (全球开源引领者), the country still faces bottlenecks in platform-grade projects, international communities and long-term mechanisms (平台标杆项目、国际社区、长效机制). That last clause is the sentence worth quoting back at the ecosystem, and this briefing will return to it.

3. Zhou Minghui’s framing, which is the analytical core of the meeting. Her keynote report proposes that ecosystem construction be organised around three core elements — participating subjects, open-source artefacts and open-source communities (参与主体、开源制品、开源社区) — and that around those three, the cooperation chain, supply chain and value chain (协作链、供应链、价值链) be systematically mapped, with the resulting concept described as the “three elements and three chains” (三要素三链条) framework.

4. The consensus, and it is unusually specific. The experts are reported to agree that the era of intelligent computing presents open source with both new challenges and an important opportunity to catch up (重要的赶超机遇); that the country should rely on distinctive tracks to shape differentiated advantages (依托特色赛道塑造差异化优势); and that it should improve the systems for talent training, community incentives, licence governance and risk prevention and control (完善人才培养、社区激励、许可证治理与风险防控体系), the better to advance open-source development with high quality and a global layout.

Institutional Analysis & Commentary:

There is a habit, in commentary on Chinese open source, of treating a document like this as rhetoric and moving on. That would be a mistake here, for a simple reason: the chair of the committee named the bottleneck correctly, and the bottleneck he named is the one this series has been documenting from the outside for months.

“Platform-grade projects, international communities, long-term mechanisms.” Take those three in order and hold them against the record. On platform-grade projects, the past fortnight alone produced: a 48-member agent community convened by a standards institute with a council-executive-advisor structure and no maintainer tier; a national openness-grading framework (SJ/T 12304-2026) and an enterprise-governance maturity model, both standards rather than software; and a research report measuring contribution across 22 technology domains. On international communities, the 2025 China Open Source Development Deep Report — published by the OpenAtom Foundation in June 2026 and reviewed by this series — records that China’s active open-source developers reached 2.63 million with a 77.06 percent retention rate, and that India’s 2.83 million active developers overtook China’s for the first time, with the report’s own reading being that China’s strength is in retention while India’s is in new-developer expansion. On long-term mechanisms, the funding question at the base of the stack is unaddressed in every instrument in this series’ file.

What Wang Huaimin has done, whether or not he intended it as such, is to state the diagnosis inside the venue rather than outside it. That is not a small thing. The prevailing register in this ecosystem’s public documents is achievement — results released, standards launched, groups founded, reports compiled, practices recognised — and a document whose headline term is a stage (“participating and integrating”) is a document that has declined to claim arrival. “Participating and integrating” is a subordinate position, stated by the person best placed to know. Whether it survives into the next official formulation is a different question, and an observable one.

Now the harder reading, and it is the one that makes this document more than a status report: the “three elements and three chains” framework is a supply-chain framework, and supply chains are not commons. Zhou Minghui’s three elements — subjects, artefacts, communities — are the right three. But the three chains she hangs them on — cooperation, supply, value — are the vocabulary of an industrial production system, in which the question is where in the chain value is captured and who can be squeezed out of it. That vocabulary is not wrong; open source genuinely has supply chains, as the xz backdoor proved to everyone at once. But it is the vocabulary of a value chain with a top, and a commons has no top. The distinction shows up in what each framework cannot express. A supply-chain framework has no place for the contribution that never gets merged, for the fork that succeeds by not talking to upstream, or for the maintainer in another country who fixes something because it is broken. All three are load-bearing in a functioning commons and all three are invisible to a chain diagram, because a chain is defined by the links someone can identify in advance.

Then there is the fourth item in the consensus list, which is more interesting than its position suggests: licence governance (许可证治理). This briefing has now spent three consecutive days on licences — the export-control scope exclusion, the Model-as-a-Service revenue clause, the discretionary security review — and the committee has put “licence governance” into a consensus statement alongside talent and incentives. That is either a forecast or a response. If it is a forecast, it is right, and the intellectual work now needed in Chinese open source is precisely the work the OSI does badly and slowly: what a licence must contain to be a licence rather than a permission, what a discretionary approval clause does to a downstream user’s ability to plan, and whether a set of conditions can be written that is knowable in advance by a competitor who has no relationship with the licensor. If it is a response, then the committee has noticed that the most consequential open-source documents in China this year were licences written by labs, not standards written by institutes — and that no institution in the country has published a view on whether those licences are open source.

The honest counterweight, and it is not decoration. That list of eleven participants is, by any measure, a serious group: the people who built the evaluation infrastructure for China’s open-source ecosystem, drawn from the universities that train its developers and the standardisation institutes that write its rules. A seminar of that composition producing a consensus that names its own gaps, and puts licence governance on the same list as talent and incentives, is doing the work that a technical community’s governance committee is supposed to do. And the “distinctive tracks” (特色赛道) formulation — shape differentiated advantages on tracks where you are strong rather than compete head-on everywhere — is an unglamorous and defensible strategy, of the kind that reads differently depending on whether one has decided in advance that the strategy is evidence of exclusion or of comparative advantage.

The checkable question. Two observables. First: does “participating and integrating” survive in the next official formulation? The 2026 Deep Report and the annual OSCAR conference materials are the venues. If the framework reappears at national level, then a committee chair has successfully moved a self-assessment into the policy vocabulary, and the open question becomes whether the bottlenecks travel with it — a stage assessment without the bottleneck list is a slogan; with it, it is a work programme. Second, and decisive: what does a “platform-grade project” turn out to be? The committee says China lacks them. The ecosystem’s candidate answers so far are all things a foundation incubated — openEuler at 2,000万套 installs, OpenHarmony, M-Robots, LoongArch community — and none of them is a project that a maintainer in São Paulo or Berlin contributes to because it solves their problem. If the answer to “platform-grade” is “the platform our own industry needs”, the bottleneck is not a bottleneck but a category error, and it will not be closed by more platforms. If the answer is “a project the world runs”, then the only instrument that reliably produces one is the least discussable thing in any of these documents: paying maintainers and letting them decide what merges.

Sources:

🏗️ Institutional Change — Eleven of Twenty-Three: What a Reddit Count of Maintainers Says That No Chinese Report Says

1. The count, and its method. In October 2026, a Reddit user posting as u/Mastbubbles published a tabulation of the maintainers of 23 core open-source projects on which smartphones, browsers and servers broadly depend. The window was 2025-10-07 to 2026-10-07. Merge commits and bot commits were excluded; a developer was counted as a regular contributor on at least 10 changes in the period. On those criteria, 11 of the 23 projects had been maintained over the year by one or two people. The count was reported in the Chinese technology press on 2026-10-21 — by 驱动中国, with the IT之家 account — and circulated under headlines such as “23 core open-source projects, 11 maintained by only one or two people”.

2. The specific cases, which carry the weight. xz, the compression utility whose upstream was backdoored in 2024: Lasse Collin was the only regular contributor in the period, completing roughly 97 percent of the year’s changes, and the project had not confirmed new funding since the backdoor event. sudo, which grants administrator privileges on Linux and macOS: between 2008 and 2018 the repository saw 5,409 changes, of which 5,408 were made by Todd Miller. The IANA time zone database — tzdata, which Android, iOS and most servers read to compute local time — is maintained by Paul Eggert, senior lecturer in computer science at UCLA; in the measurement window it received 251 changes, 218 of them by Eggert.

3. The two counter-examples in the same count, which are the analytically useful part. curl receives roughly USD 89,700 per year through Open Collective — about RMB 600,000 at the reporting exchange rate — and in 2026 has 11 regular contributors. OpenSSL, funded at USD 5.4 million after the 2014 Heartbleed vulnerability, went from 6 regular contributors in 2013 to 32 in 2026. The same window, the same methodology, two projects with money and eight-plus contributors each; one project without money and one contributor doing 97 percent of the work.

Institutional Analysis & Commentary:

This is a Reddit post, not a peer-reviewed study, and its methodology is crude in ways that matter: ten changes is an arbitrary line, “maintained” is not the same as “depended upon”, and a project with one regular contributor is not necessarily fragile — one competent person with good tests and a slow-moving specification is a more stable arrangement than twelve people with no tests and a fast-changing one. All of that should be said first, because the point of the item is not the number.

The point of the item is that the two counter-examples are in the same table, and they are an experiment nobody designed. curl and OpenSSL and xz and tzdata are drawn from the same population, measured by the same criteria, over the same twelve months. Two of them have money and 11 and 32 contributors; two of them do not and have 1. This is about as close to a controlled comparison as this literature ever gets, and the direction is unambiguous. Money does not produce contributors by itself. Money buys the redundancy that converts a single point of failure into a maintainable project — and redundancy is the specific thing that a one-maintainer project lacks, and precisely the thing that its dependent population has no mechanism to purchase.

Put the institutional question in the form that makes it answerable: a one-maintainer project is not a governance failure, it is a governance form, and nobody signed up for it. Ostrom’s design principles are routinely invoked in this literature and are usually the wrong tool here, because they describe common-pool resources governed by a bounded community of users with a shared stake, and the projects above are not that. What they are is closer to a proprietary asset held in trust without a trust instrument: the single maintainer holds effective control over an artefact that hundreds of millions of users depend on, and there is no document anywhere that says what the dependent population may expect of them, what happens when they stop, or who has standing if they behave badly. The 2024 xz episode was a demonstration of that — and note what the response to it actually was. Not a change in the governance form. An increase in attention from the largest downstream consumers, and, by the count above, no confirmed funding.

This is where the Chinese policy conversation and this count intersect, and the intersection is uncomfortable for both sides. The instruments this series has documented over the past month are overwhelmingly directed at the top of the stack: export-control catalogues, model openness grading, maturity models, 48-member agent communities, foundation incubations of operating systems at 20 million installs, contests with RMB 200,000 prize pools that allocate money according to a contribution-ranking algorithm tied to a national standardisation institute’s governance standard. Every one of those instruments is a mechanism for allocating recognition and access among organisations that already have legal personality, a bank account and a seat at a table. Not one of them is a mechanism for paying Lasse Collin. And the competitive logic that produced them is the logic that treats open source as a supply chain and a set of strategic capabilities — which is exactly the framing in which a maintainer doing 97 percent of the work on a compression library is not a subject at all, but a link.

Which is not a claim that any government should pay foreign maintainers. It isn’t, and the framing that would make it one — that states are responsible for the global commons — is a claim this series has no basis to make. The observation is narrower and applies everywhere: every organisation in this ecosystem is measured on what it contributes to projects it can name, and none is measured on whether the projects it depends on can survive the departure of one person. Procurement scores, openness gradings, maturity tiers and contribution rankings all count outgoing activity. None counts incoming risk. The reporting that carried this count is a Reddit post, in English, before it reached Chinese technology media — which is itself the finding: the fragility of the base layer was documented outside the institutions that are constituted to care about it, by a stranger with a scraper.

The counterweight, and it is genuinely strong. Open source’s most important structural property is that a fork is always available, and that is not a slogan: tzdata has been forked, OpenSSL has been forked, and the reason a single maintainer’s bus factor is survivable is that the licence already granted everyone the right to take it over. The commons is not fragile in the way a company is fragile. It is fragile in the way a library is fragile: the books do not burn, and the catalogue is what disappears. And the count’s own most encouraging number is the one nobody quotes — OpenSSL went from 6 to 32 contributors in thirteen years after a disaster and USD 5.4 million. That is what the mechanism looks like when it works, and it worked after the failure, at the cost of the failure.

The checkable question. Two, both cheap. First: does the count get reproduced anywhere with money attached? The test of whether maintainer sustainability is a real policy object in China is not a report. It is whether any Chinese foundation, company or standards body publishes a funding commitment to a dependency it does not control — grants to a project whose upstream is elsewhere, with no licence or governance condition — and reports the balance sheet annually. The Deep Report’s ten chapters include commercialisation, OSPO, vulnerabilities and education; maintainer sustainability is not among them, and its inclusion with numbers next year is a testable commitment. Second, and sharper: does the 2026 xz funding figure exist? The count says no confirmed funding since 2024. If a funding arrangement has since been concluded and simply is not tracked, the number is wrong in an instructive way — it would mean the ecosystem cannot see its own support flows. If no arrangement has been concluded, then two years after the most consequential supply-chain near-miss in the history of free software, the project at the centre of it is still one person and no budget, and every subsequent instrument built on top of that stack is built on that.

Sources:

🔍 Commentary — Good News in This System Arrives as a Date, and Bad News Arrives as a Count

Three documents this week, and they have nothing to do with each other. Read them anyway.

A model released to the world on a schedule — available to every user immediately, and to every stranger in nine days. A committee of eleven professors who named the gap in their own country’s ecosystem and listed licence governance among the fixes. A count, made by an anonymous stranger with a scraper, of how many people stand between a functioning internet and the absence of it: eleven of twenty-three, one or two each.

The first two are about institutions, and both are more honest than their genre usually allows. Announcement No. 48 publishes its thresholds in numbers and opens a comment period; the CCF committee publishes its own bottleneck list. In a system where the dominant register is achievement, the appearance of a date you can hold someone to and a gap you can quote back is the beginning of accountability. Good news in this system arrives as a date.

The third arrives as a count, and the count is the one that will actually determine the outcome. Two years after xz, the compression library at the centre of the near-miss has one maintainer and, per this count, no confirmed funding. OpenSSL, after Heartbleed and five million dollars, has thirty-two. Nothing about the second fact was produced by any of the instruments this series has spent a month documenting — the catalogues, the gradings, the maturity models, the 48-member communities, the incubations, the prize contests — and not because those instruments are hostile to maintainers, but because none of them has a line item for one. A contribution ranking measures what an organisation sends; a maturity tier measures what an organisation has; neither measures what an organisation’s dependency would lose if a stranger stopped answering email.

The unifying claim of the week, then, and it is about direction of attention rather than about any particular country. This ecosystem — these ecosystems — have become extraordinarily good at governing what is published: who may release, under what terms, into which category, with what attestation. They remain almost entirely blind to what is maintained: whether the thing that was published can be kept alive by someone who is not the publisher. And the two are not merely different questions. They pull in opposite directions, because the instruments of publication governance reward large organised actors who can file, licence, certify and be graded, and the object of maintenance governance is small disorganised actors who cannot be filed, licensed, certified or graded, and whose absence is only visible after it has already cost something.

A fair objection, stated because it is fair. Every one of the maintainers in that count is there by choice, in a tradition that has produced fifty years of software no institution could have commissioned, and treating them as a policy problem to be solved is its own kind of disrespect. The correct ambition is not to administer them. It is the much narrower one: make it possible for the next Lasse Collin to be paid without having to become a company, a foundation, or a national asset. Nobody in the current wave of instruments has solved that, in any jurisdiction. But it is worth noticing which instruments at least try, and that the ones which try are the ones written by people who have maintained something.

The checkable question, one number this quarter. Not the parameter count, not the number of members, not the workshop count. Does any Chinese foundation, company or standards body publish a grant to an upstream project it does not control — with no governance condition attached, for a maintainer to spend as they see fit — and put it in a line item that recurs next year? One arrangement would not fix anything. It would, however, be the first piece of evidence that the ecosystem has noticed that the layer it is all standing on has a headcount of one or two, and that the entities who depend on it are the only ones who can change that. Every other number on this page is downstream of whether that one appears.

Sources: