06 The service and the non-profit that runs it

Status: DRAFT v0.1, 2026-08-19. Consistent with the programme decision of 26 July 2026 (~/claudecode/programme-record/DECISIONS.md 2.1): standard and neutral infrastructure in a UK company limited by guarantee; implementations and IP in a separate commercial entity; manufacturers, including our own airframe work, outside the body that certifies manufacturers. Nothing here is incorporated yet.

1. Purpose

To build and maintain, as a non-profit service for the UAS community, industry, general aviation and the regulator:

1. The SigNet reporting standard: a typed schema for exposure, occurrence and periodic safety data in the CAA's own hazardous-event and barrier vocabulary, with evidence levels on every key claim.
2. The assurance layer of an SMS as a hosted service: hazard library, standard SPI set, occurrence workflow, monthly aggregates, lessons bulletins.
3. Neutral data brokerage: receive, anonymise at source, aggregate, and deliver worked signal to members and the regulator.
4. Independent evidence custody: periodic signed chain-head deposits from member ledgers, so a member's evidence is verifiable against the service (ADR-0007 L5).
5. In time, a conformance and certification scheme for platforms and components against the standard, run by the body that does not build them.

2. Legal form and structure

3. Services, and their maturity

4. Membership

5. Governance

• Board: 5 to 7; independent chair; at least one operator member, one GA member, one person with airworthiness or ANSP safety-case background; founder as executive director.
• Safety committee: member representatives plus observers; reviews monthly aggregates and lessons; recommends hazard library and SPI changes.
• Standard amendment: proposals public; 30-day comment; safety committee recommendation; board ratifies; major versions need a member vote.
• Data governance: anonymisation at source, pseudonymous ids held by the custody officer only; raw records never leave the service; aggregates only below a cell-size floor; members may withdraw their raw data; legal duties (AAIB, court) honoured and notified to the member.
• Independence: from any contractor (including partners who may build or host parts of the service), any manufacturer, and any UTM vendor. Contracts are tendered and published in summary.

6. The seed corpus: our simulated evidence

No member has flown yet. The standard still needs data to be shaped against, so we seed it with the v1 reference-implementation corpus (../evidence/v1-final-report.md): 313,298 simulated flights, 2,669,463 ledger events, over a London corridor model, 2026-07-23 to 07-26. Clearly labelled simulated, it is used for four things and nothing else:

1. Exercise the schema end to end: emit periodic_summary and occurrence records from the ledger, find the fields that are awkward or missing, fix the schema before a human ever fills it in. First worked record: schema/examples/periodic_summary_v1_sim.json.
2. Propose baselines, not targets: divert 0.33%, emergency landing 0.26%, critical forced descent 0.011%, gate denials 208 over 313k requests. Live targets are set after the first 100 real member flights; the simulated values are the opening hypothesis and are marked as such in every record (simulated: true).
3. Show the regulator the output: what a month of the standard looks like, in their HE/barrier vocabulary, before asking them to define the data request. It is easier to correct a worked example than a blank schema.
4. Find the weak evidence: the corpus shows which claims in the hazard library are L1 (self-reported SoC, firmware identity, human consent) and which are L4, so the integrity roadmap is argued from data rather than assertion.

What the simulated corpus is not used for: any claim about real-world safety, any SORA submission, any certification decision.

7. Funding

8. What the service does not do

• Operate aircraft for hire.
• Sell or run a UTM, a USSP or a CIS. It is the evidence and assurance layer beside them.
• Certify its own products, or products of any body it shares directors with.
• Hold raw member data longer than its retention policy, or release it identifiably.
• Claim that data proves safety. It produces evidence for the bodies whose job it is to judge.

9. First twelve months