Skip to content
Blockchain LabTHE VENTURE STUDIO

Operating handbook

Open source and AI, as this studio will actually run it.

Rules for people building on Blockchain Lab. Not a counsel opinion, and not a sign-off. The public statement is the export policy.

This is an operating framework, not legal advice. It is not a finding by counsel. Non-commercial, demo, or test use does not remove copyright, licence, patent, contract, or export-control duties. A public repository is not permission to copy it. Last reviewed as an operating note: 2026-10-01.

Public export policycarries the class table, the matrix, and the manifest. This page is how a person applies them.

Ingestion

  1. Add an official repository, not a search-result dump. A fork is its own row. Anchor stays amber until the maintainer is confirmed. otter-sec is not silently treated as the unquestioned upstream.
  2. Read the GitHub licence API. If it returns NOASSERTION, read the licence file. Record the date. Do not invent a hash, a DOI, or an author.
  3. Assign a licence tier and a source class. Public does not mean S4. No row in this registry is S4 or S5 except Blockchain Lab’s own writing.
  4. Do not paste upstream source into a page, a blueprint, or a model prompt.
  5. Conflicting files stay grey. Missing licence stays S1.
  6. The least permissive dependency wins. One GPL file keeps the pack out of “MIT”.

What may be published

  • Original analysis, pattern notes, decision records, threat lists, and test outlines that do not reproduce restricted text or code.
  • A link, the recorded SPDX status, and the day it was checked.
  • An E3 or E5 file that is Blockchain Lab text, marked NOT_FOR_PRODUCTION, with copied_source false.

What may not

  • E6 adapted code, E7 full archives, E8 datasets of upstream text, E9 training packs, E10 production packs.
  • A green badge that says demo export is available.
  • A fake SBOM, a fake secret-scan pass, or a fake human approval.
  • Private customer code, and anything the constructor already refuses: drainers, rugs, laundering, sanctions evasion, fake reserves, theft, malware.

Generated, forked, vendored

  • Rules-engine blueprints are original. Model drafts are labelled drafts. A draft is not a licence clearance. The model is told not to invent a repository, a commit, or a permission.
  • A fork is not the upstream. Record both URLs if both matter.
  • Nothing is vendored in this release. A future vendored file gets its own URL, hash, and licence, and the pack takes the stricter class.

User-owned source

U1 exists so a private workspace cannot be confused with the public corpus. This site has no accounts and no upload vault. Do not build one in localStorage. A blueprint note stays in the browser that saved it. It is not training data. If a person pastes private code into the form, that was their browser, not a grant to us.

Training

Used for model training: no. There is no switch that turns the registry into a training corpus. E9 stays blocked. A model call, when a person asks for a draft, uses the catalogue of names and tiers. It does not receive source files.

Vulnerability reports

This release has not scanned the repositories. A report does not mean we have confirmed a flaw. Until a person checks, source export stays refused. Do not publish exploit steps. Write the usable fact, or say we do not have it.

Takedown

Notices go to info@blockchainlab.com. The API returns accepted: false and stores nothing, so nobody can think a POST filed a notice. On a credible claim, edit the registry the same day the claim is understood: S1 or S0, remove it from incorporate lists, and leave a correction. Do not silently rewrite a historic URL.

Production

E10 is refused. A company that wants something in production talks to the Development Lab. That conversation is a commercial scoping, not an audit certificate and not an export from this constructor. Counsel still has to read regulated, custodial, payments, and strong-copyleft uses.

Next 90 days

  • Now: this policy, E0–E5 only, E6–E10 refused with the unmet gates named.
  • By 2027-01-01: re-read the licence API and the licence files for the current registry. That re-read is not a commit pin and not a scan.
  • Not in this plan: a training corpus, a production pack, a private upload vault, or an automated legal approval.

When in doubt, link — do not copy.