Linux Turns Thirty-Five: How the Bazaar Became a Registry
On 25 August 1991, a twenty-one-year-old computer science student in Helsinki posted to a Usenet newsgroup called comp.os.minix. He was building an operating system, he wrote, that was "just a hobby, won't be big and professional like gnu." He had ported bash and gcc, and things seemed to work. Linus Torvalds could not have known what that sentence would be measured against thirty-five years later.
On 25 August 2026, thirty-five years to the day, the Linux Foundation announced it had taken governance of a specification called TRACE, short for Trust, Runtime Attestation and Compliance Evidence. Built jointly by AMD, Intel, Microsoft, OPAQUE and the Technology Innovation Institute, TRACE lets an organisation prove, after the fact and across cloud providers, exactly what an artificial intelligence agent did, under what policy, on what hardware. [1] Eight companies now pay $350,000 a year for one of the Agentic AI Foundation's Platinum seats to help govern how that kind of trust gets decided. Two hundred and forty-seven organisations belong to that foundation this month. Not one has ever been from New Zealand.
The anniversary and the announcement share nothing but a calendar date. That is exactly what makes them worth reading side by side. Episode 29 of this series measured the Bazaar at its largest recorded scale: 2,138 contributors to a single kernel merge window, three weeks before this one. [2] This episode asks a different question about the same movement. What does its own institutional apparatus look like, thirty-five years on, and is a $350,000 seat at a neutral registry the argument winning, or the argument being quietly absorbed by exactly the kind of large companies it was once built to answer?
I started running Linux in 1994, three years after that Usenet post, on hardware slow enough that a full kernel compile ran overnight and a clean boot the next morning counted as a personal win. This series has already told that story once, so I will not tell it again here. I raise it only because the distance between a machine that took all night and a foundation with an eight-seat technical steering committee is the distance this whole episode is about.
Eric Raymond gave that distance its name. In "The Cathedral and the Bazaar," first presented at Linux Kongress in Würzburg on 27 May 1997 and published as a book two years later, Raymond argued that development done in the open, with enough eyes on the code, would beat development kept behind a company's closed doors. [3] The Bazaar he described was informal by design, with no membership fee and no seat to earn. Anyone could show up, patch something, and be judged on the patch. That was still mostly true when I moved from writing patches to representing a vendor's interests during the Linux Wars: showing up counted for more than a badge did.
TRACE works differently. It is a formal specification, and what it does is exact. It creates, in the Foundation's own words, a hardware-enforced governance record that binds the runtime environment, the software, the policies, the data classifications and the tool usage into one portable, cryptographically verifiable artefact. [1] Rather than inventing a format from scratch, it builds on six existing open standards, RATS, EAT, SLSA, SCITT, SPIFFE and EAR, and it already carried an installed base before the Foundation formally took it on: nearly 135,000 downloads from the Python package index within ten weeks of its first appearance at a computing conference in June. [1] In practice, that means a bank running an AI agent on one cloud provider can hand a regulator or an auditor a single verifiable record showing which policy the agent operated under and what data it touched, without asking the regulator to simply take the cloud provider's word for it. The Linux Foundation governs TRACE directly. Its technical workstream sits with a separate body, the Coalition for Secure AI, which is a different registry again from the one that took in Google's protocol eight days earlier. [4]
The split matters more than it looks. The Foundation's own role is neutral stewardship: it holds the trademark and sets the governance charter, so no single member company can unilaterally change what "TRACE-compliant" means. The Coalition for Secure AI does the engineering, the working groups that decide what the specification says next. [4] It is the same separation the kernel itself has run for years: the Foundation holds the trademark and sets release governance, while the engineers across competing companies do the technical work, exactly as Episode 29's own 2,138 contributors did three weeks ago.
That second registry is the Agentic AI Foundation, and its own move landed on 17 August 2026, when Google's Agent2Agent protocol joined it as a hosted project, sitting alongside Anthropic's Model Context Protocol under the same technical steering committee. [5] That committee holds eight seats, one per company: Google, Microsoft, Cisco, AWS, Salesforce, ServiceNow, SAP and IBM. It is explicitly still in a "Startup Phase" that converts to a "Steady State" composition around December this year. Agent2Agent already claims more than 150 supporting organisations and a specification at version 1.0, described by the Foundation as its first stable release. [5] Anthropic's Model Context Protocol arrived first, in late 2024, as a way of letting an AI model reach outside tools and data sources. Agent2Agent solves the companion problem, letting one AI agent talk to another across vendor lines. Housing both under one committee is the difference between two companies quietly agreeing on a private handshake and a standard anyone in the room can hold the others to.
The Bazaar's institutional descendant, thirty-five years on, is therefore not one registry but two, sitting side by side under a parent that has governed the Linux kernel itself since 2000. TRACE and the Agentic AI Foundation carry different members and different fee structures, and neither shares the other's scope. Both exist because companies that would once have competed on a closed standard have agreed instead to deposit one where none of them owns it outright. A trademark, in this context, is not decoration. Contributing TRACE meant OPAQUE handed over the right to control who else can call something TRACE-compliant, the exact lever a single vendor would otherwise have kept for itself.
The Agentic AI Foundation's own growth says something about who is doing the depositing. Membership went from 49 organisations at its founding in December 2025 to 146 by February, 190 by May and 247 by this August. [6] No press release from Google's own communications channels has yet surfaced covering the Agent2Agent move; the entire consolidation currently rests on the Foundation's own blog post and one press exclusive. That is worth recording as an observation about how a 2026 standards consolidation travels, not as a claim about whether the move itself is real. And across every one of those membership snapshots, the only Australian or New Zealand entity to appear at all is the government of New South Wales, on the free associate-member tier. No New Zealand organisation, private or public, has ever been named in an Agentic AI Foundation membership release.
None of this means the older, informal layer of the Bazaar has gone anywhere. The same August that produced TRACE and the Agent2Agent consolidation also produced Armbian 26.8 with a rewritten installer, COSMIC Desktop 1.7, and a GNOME 51 beta: three independent desktop Linux projects, shipped by volunteers, with no Platinum tier and no trademark-transfer clause anywhere in sight. None of the three needed a technical steering committee, a Platinum tier, or anyone's permission to ship. The individual layer this series has followed for twenty-nine episodes is still there, doing what it has always done. It now simply sits underneath a second, institutional layer that did not exist for most of Linux's history, doing for AI-agent governance what the Linux Foundation has done for the kernel itself for a generation.
Whether that second layer is the Bazaar succeeding on its own terms, at a scale the 1991 post could never have anticipated, or a different argument altogether bought at $350,000 a seat, is not a question this episode should answer for you. Raymond stood up in Würzburg and argued that enough eyes, working in the open, would beat a closed cathedral every time. The eyes are still there. Episode 29 counted 2,138 of them in a single merge window three weeks ago. What has changed is that they now work underneath a registry, with a governance charter and a trademark-transfer clause, built by exactly the kind of large, competing companies the Bazaar was supposed to be an alternative to. Neither reading cancels the other. A movement can grow an institutional layer capable of both things at once, and thirty-five years is long enough for a coincidence of calendar to force the question, even if it is not long enough to settle it.
TRACE is not one company's format wearing an open label. It composes six existing open specifications, RATS, EAT, SLSA, SCITT, SPIFFE and EAR, each already maintained by its own community, and stitches them into what the Linux Foundation calls a vendor-neutral framework for trusted AI execution. AMD, Intel, Microsoft, OPAQUE and the Technology Innovation Institute did not have to agree on a single company's design. They had to agree to build on standards none of them own outright. That is the Bazaar's oldest habit, reusing what is already open instead of starting again behind closed doors, now applied one layer up, to the software that watches the software. The Agent2Agent protocol's move into the Agentic AI Foundation follows the same pattern: a standard deposited where every competing company can reach it, under one shared committee rather than one vendor's roadmap.
A similar shift, from trusting a person to trusting a formal process, happened once before in United States defence procurement. The Department of Defense's Instruction 8500.2 set out the framework under which open source software earns the same formal evaluation as proprietary commercial code before it enters a government system: a documented evaluation against a standing framework, applied the same way every time. TRACE and the Agentic AI Foundation's eight-seat technical steering committee follow that same pattern a generation later, for AI agents rather than source code. Drones, satellite ground segments and hardened command systems already run on Linux or BSD-derived stacks built the open way. A cryptographic record of what an agent did, under what policy, is exactly the kind of artefact a procurement officer evaluating that stack would want to see next.
Has something you helped build ever grown past the point where you could still recognise the reasons you first built it? If it has, was that the moment it succeeded, or the moment you began wondering who it was actually for?
This is one of seven weekly series in The Hamberger Report. Subscribe on LinkedIn and the next one arrives in your feed.
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. I write as director of Te Pono Limited; the views are personal and do not represent the position of any client, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance, and it is politically neutral.
About the Author: Andreas Hamberger is a New Zealand-based enterprise architect and technology strategist. Over 30 years, he has moved from compiling kernels on a 486 to leading cloud, cyber, and AI transformation programmes across government, banking, transport, and aviation. He founded Yoper Linux, served as a technology specialist for Novell during the Linux Wars, and is the author of "Generative AI: Skynet or Heaven" and "Space Mafia." He can be reached at andreas@thehambergerreport.com.
This article was produced with AI assistance under my direction. Research, drafting and images pass through a pipeline I built and govern: automated gates for source verification, forbidden language and political neutrality, and my own review before anything is published. The tools include Claude, Gemini and Openart. The frameworks, arguments and editorial judgements are mine and are the same discipline I apply to the AI systems I audit for clients. AI accelerated the work; the thinking, and the responsibility for it, are mine.
[1] Linux Foundation. "Linux Foundation Welcomes TRACE to Advance Verifiable Runtime Evidence for AI Workloads." 25 August 2026. https://www.linuxfoundation.org/press/linux-foundation-welcomes-trace-to-advance-verifiable-runtime-evidence-for-ai-workloads
[2] The Hamberger Report, Linux Wednesday Episode 29. "Linux 7.2 and the New Normal: The Largest Merge Window Ever Counted." Published article, 2 September 2026.
[3] Wikipedia. "The Cathedral and the Bazaar." Entry consulted 27 August 2026, recording first presentation at Linux Kongress, Würzburg, 27 May 1997, and book publication in 1999. Primary conference host page, linux-kongress.org, did not respond on direct verification this session. No URL captured for this secondary source.
[4] Help Net Security. "Linux Foundation takes on TRACE, a hardware-backed runtime evidence specification for AI agents." 26 August 2026. https://www.helpnetsecurity.com/2026/08/26/the-linux-foundation-trace-ai-agent-security/
[5] Agentic AI Foundation. "A2A joins AAIF's open agentic stack." 17 August 2026. https://aaif.io/blog/a2a-joins-aaif
[6] Agentic AI Foundation membership figures, as at 13 August 2026 (247 member organisations; trajectory 49 at founding in December 2025, 146 in February 2026, 190 in May 2026). No URL captured for this figure in the source research; carried from a same-day Linux Foundation primary source fetched during the Research Index's own weekly refresh.
[7] United States Department of Defense. Instruction 8500.2, open source software consideration mandate. No URL captured in the source research for this reference.