The Foundation question.

What a Foundation would operate if one were formed, the five named risks such a path would have to clear, and why deferring it is the current default.

The current planning default is to defer foundation incorporation unless funding circumstances make it necessary. A 501(c)(3) SLF Foundation as a sister entity to Lexenne is one of four legitimate options for stewarding the spec, vocabularies, conformance suite, and trademarks, alongside an SLF project inside an established neutral host (LF Decentralized Trust, OpenWallet Foundation), publication through a W3C Community Group or IETF Internet Draft, and deferring all of it until Patina ships to a paying customer. The four alternatives are surveyed in Section D below.

This page is a study of the standalone-foundation path, what it would operate if taken, the five named risks it would have to clear, and the alternatives it should be compared against. The point is to make the structural decision legible, not to pre-empt it. The dominant realistic outcome of any foundation-led path, per the impartial evaluation, is best described as "alive but niche," well short of a dominant standard. Naming that up front is the point of the page.

The architectural commitment is mission-lock: the protocol's regulatory and individual-sovereignty semantics must survive commercial pressure from any single implementer. The clearest way to make mission-lock structural rather than aspirational is to separate the entity that owns the spec from any entity that profits from implementing it.

That points to a nonprofit. The 501(c)(3) form has three concrete properties the project needs: (1) tax-exempt fundraising, which is the realistic path to multi-year operational funding; (2) IRS-anchored mission-lock language in the articles and bylaws, harder to unwind than a corporate decision; (3) standing as the trademark holder, which means conformance certification is a legitimate revenue stream tied to a Foundation rather than to any implementer.

The sister-entity choice, rather than a parent-corporation-with-foundation, is more conservative. Lexenne exists today as a commercial company; a Foundation, if formed, would be designed from scratch. Operating them as siblings, both at arm's length, with IP transfer from Lexenne to the Foundation at formation, then a trademark license back to Lexenne for conformant use, would preserve Foundation independence without restructuring the commercial entity. It is the Mozilla pattern in shape, not in aspiration.

That distinction matters, and the rest of this page leans into it.

The point is not to fence off the spec. The spec is meant to spread; standards bodies adopt good primitives whether or not the originator stays involved. What a steward would actually carry is operational, the work that keeps an open standard usable:

1. Federated vocabulary registries for gates, scope predicates, and reason codes. A steward would curate a tiny core; domain bodies (healthcare standards organizations, financial-services groups, government identity authorities) steward extensions. The pattern is IANA / MIME / DNS: registrar-of-registries, not curator-of-every-entry. Keeps the maintenance load minimal and prevents the spec from becoming a committee chokepoint.
2. A conformance suite with paid certification. Executable tests that verify a claimed SLF implementation against the spec and against named composition surfaces. Certification covers enforcement-tier declarations: an implementation must carry an honest T0/T1/T2/T3 tier label in every receipt; a T3 deployment cannot assert T0 prevention guarantees. Procurement teams close on certifications; this is the protocol's primary revenue line in steady state.
3. Reference implementations and adapters across the major language ecosystems. Apache-2.0 licensed, Foundation-stewarded. The first already exists: slf-core, an Apache-2.0 library whose conformance suite runs green. Adapters into the converging stacks, OID4VP, AP2, AATWG drafts, MCP, Microsoft Entra Agent ID, live here too. Code that runs beats specs that don't.
4. A cross-protocol composition layer. SLF is designed to ride above whatever set of identity, delegation, and credential-format stacks the broader ecosystem converges on. No single standards body owns the composition surface across bodies. A steward could.
5. A trust list and rating system. Federated governance for counterparty behavior, vulnerability disclosure, and lens-provider reputation. Nobody else operates one of these across protocols.

Each of these is something standards bodies do not do. They publish documents; they do not run registries, ship code, certify implementations, or maintain trust lists. That is the operational layer a Foundation would occupy. It is also, the impartial evaluation flagged, the same layer that several incumbents already occupy. Section D covers that.

An impartial-evaluation pass on the foundation strategy (dated 2026-05-25) named five risks the proposed path must clear. They are the realistic shape of the failure modes, grounded in how comparable efforts went.

The proposed direction is Option A: a standalone 501(c)(3). The impartial evaluation explicitly named four alternatives that have not been scored against Option A on credibility speed, grant-funding ease, mission-lock durability, or regulatory-mandate positioning. A 60-day comparison of A through E with board involvement is on the recommended pre-commit list before capital is spent on incorporation.

Option E: defer foundation incorporation. Ship Patina with paying customers first; let standards work follow deployments rather than precede them. Reverses the typical order; loses the 2026 AATWG window; strengthens the strategic position by 2027–2028 by arriving at standards bodies with deployed customers rather than ideas.

The page advocates no specific alternative. It notes that the impartial evaluation flagged the comparison as unscored, and that scoring it honestly is one of the gates before capital commits.

The impartial evaluation's closing recommendation was specific. Before $5K–$15K in legal, filing, and trademark costs is spent on Option A, three things should clear:

• A 60-day comparison of Options A through E with board involvement and explicit scoring criteria: credibility speed, grant-funding ease, adopter friction, mission-lock durability, regulatory-mandate positioning. The eval found this comparison had not yet been done. Until it has, Option A is the assumed direction, not the chosen one.
• Verification of the FIDO standards-engagement path. The competitive-landscape work assumes a warm introduction into the FIDO AATWG. Until that path is confirmed rather than assumed, a foundation timeline should not depend on it. Treat AATWG access as something to validate, not a given.
• A binary decision on Patina's commercial deliverability in 2026. The eval's argument: if Patina can ship with a paying customer in 2026, the foundation's strategic calculus changes fundamentally, non-grant revenue, deployed reference implementation, conversation-changing fact for every regulatory and standards conversation. If not, the foundation path becomes substantially more dependent on philanthropic grants and standards-body credibility alone. The decision is binary, and it should be made deliberately rather than discovered after the fact.

• Mozilla is not the model. Mozilla is structurally what is proposed and operationally a cautionary tale. Citing it as proof the structure works requires selective reading.
• Standalone incorporation is not the chosen answer. It is the proposed direction. Four alternatives are unscored. The 60-day comparison is a gate, not a formality.
• Strong success is not the planning anchor. It is the upside case. The realistic anchor is "alive but niche," mission-aligned.
• Founder bandwidth is not "being managed." It is the single largest unresolved risk. One of three resolutions has to be chosen.
• A Foundation would not protect the mission from commercial pressure on its own. Structure is necessary; it is not sufficient. Mozilla's structure didn't prevent fifteen years of single-counterparty financial dependence.
• The operational role is not guaranteed. It depends on domain stewards emerging, conformance suites staying current, standards bodies not shipping competitive certification, and incumbent foundations (LFDT, OpenWallet) not absorbing the layer. Each of those is a live variable.

If you are reading this with a governance, philanthropy, or standards-body lens and the framing looks wrong, if a risk is overplayed, an alternative is underplayed, or a mitigation is weaker than presented, that is the feedback the draft needs. The page is designed to surface critique, not deflect it.