Development Fund Proposal for Maintenance of Splice Open Source 47 March

2\. Milestones and Deliverables

In accordance with CIP-0100, this proposal utilizes a recurring "maintenance" milestone structure.

Ongoing Milestone: Monthly Maintenance

• Start Date: March 2026
• Frequency: Monthly
• Description: Digital Asset will provide comprehensive maintenance services for the Splice Open Source repository currently at https://github.com/hyperledger-labs/splice. This service will transition to a Canton Foundation managed repo when Splice moves across from Hyperledger.
• Detailed Services Rendered:

Security: Monitoring for vulnerabilities, applying security patches, and managing disclosure processes. Bugfixes: Triage and resolution of issues reported by the community or identified through internal testing. Releases: Management of the release lifecycle, including tagging, packaging, and publishing release notes for regular updates. CI/CD: Maintenance and optimization of Continuous Integration and Continuous Deployment pipelines to ensure build integrity. Testing: ongoing unit, integration, and system testing to prevent regressions. Community Engagement: Reviewing pull requests and working with other contributors to merge improvements. Upstream Management: Threading through upstream changes and dependencies to keep the codebase current. Issue Management: Tracking work items as GitHub issues, and organizing them in GitHub milestones and projects. Developer Docs: Documentation on how to build the software, how to test it locally and in CI, and how to contribute to it. Contributor Management: Management of permissioning on the repo per different levels of contributions, e.g. direct access to CI, permissions on protected branches, etc.

Acceptance Criteria

The Tech & Ops Committee (or the Core Contributor Group) can evaluate the completion of this milestone quarterly based on the following evidence:

• Publication of release notes for any new versions deployed during the period.
• Visible activity in the public repository (commits, merged PRs, issue responses).
• Activity in the contributor and community help-channels \#splice-contributions-external, \#supervalidator-operations, \#validator-operations. Response to community technical inquiries by qualified contributors on \#splice-contributions-external within 24 hours on business days.
• Service Level Objectives (SLOs):

* Critical security vulnerabilities reported via the responsible disclosure process have a mitigation plan or patch available within 48 hours of discovery.