DORA RoI Taxonomy Intake

This README is the immutable asset-intake record for the EBA DORA Register of Information (RoI) XBRL taxonomy package vendored into StellaOps. It documents the exact upstream source, provenance hashes, the counsel-gated third-party scan, and how the package is consumed offline at runtime. Audience: legal/compliance reviewers and the Findings DORA RoI maintainers.

Status: present (vendored verbatim; counsel-approved controlled intake — Path A)

Selected package id: eba-dora-roi-reporting-framework-4.0-taxo-package-4.0-errata5

Vendored upstream file: taxo_package_4.0_errata5/taxo_package_4.0_errata5.zip

Provenance (immutable asset-intake record — counsel control #5)

Field	Value
Source	European Banking Authority (EBA)
Source URL	`https://www.eba.europa.eu/sites/default/files/2025-03/2028f606-49d2-4696-be48-7681cc18c696/taxo_package_4.0_errata5.zip`
Framework	EBA reporting framework 4.0 (taxonomy architecture v2.0)
Package version	`taxo_package_4.0_errata5.zip`
Publication date	2025-03-20
First vendored	2026-05-02 (`REG-20260502-eba-dora-roi-4-0-errata5`)
Download re-verified	2026-05-30 (controlled curl fetch; byte-identical)
Outer SHA-256	`sha256:2cf8a0fe6aadee36a5bf07403d7bd63a43cab96f98fad8251c31938e8242e2fb`
Outer bytes	18,213,535
Counsel decision	`docs/legal/decisions/dora-eba-taxonomy-counsel-thread-schema-intake-reply.md` (GO — Path A, RoI only) + `REG-20260502-eba-dora-roi-4-0-errata5.md`

Inner archive contents (verified verbatim):

Inner file	Bytes	SHA-256
`EBA_XBRL_4.0_Dictionary_4.0.0.0.zip`	2,153,993	`sha256:5ef0d4b07d8cd543e26f7600fe0fe8d3e1559f146b362e34b051e15949253187`
`EBA_XBRL_4.0_Reporting_Frameworks_4.0.0.0.zip`	17,722,431	`sha256:79a72fc2a0a46fed1d017398489ea3efe171c7bcf96da18866bff33c4b1c37f5`
`EBA_XBRL_4.0_Severity_4.0.0.0.zip`	424,055	`sha256:f08058d7b04c81e22ab04602893a67a5c2c65e2438c3a0d789b5398e9c962b22`
`Release Notes.4.0 2025-03-20.pdf`	1,657,324	`sha256:87e61634e50c08821c172464e2758d1648896ea67ffbd1cbb716174d2f1bbeda`

Third-party component scan (counsel control #6 — hard GATE) — PASS

Performed 2026-05-30 against a fresh download (SPRINT_20260530_003 S003-002). The outer ZIP and all three inner ZIPs were unpacked and scanned (3,872 files).

Findings:

No third-party copyright markings. 1,633 schema files carry the processing-instruction ; zero files carry any non-EBA copyright PI (no (C) XBRL, (C) Eurofiling, (C) W3C, ESMA/EIOPA, etc.).
No embedded license / notice / terms-of-use files. No LICENSE, NOTICE, COPYRIGHT, or README file exists anywhere in the package. (Every textual hit for “license”/“copyright”/“redistribution” is a business data label, e.g. “Type of licenced activity” — not a legal notice.)
No third-party schema files are physically bundled. Every file on disk is rooted under www.eba.europa.eu/eu/.... There is no www.xbrl.org/..., www.w3.org/..., eurofiling.info/..., oasis-open.org/..., or iso.org/... directory in the payload.
Third-party schemas are referenced by URL only (not redistributed). The META-INF/catalog.xml rewrites only eba.europa.eu URIs to local files; the XBRL International / EuroFiling / W3C namespaces appear solely as xmlns: declarations and xs:import schemaLocation="http://www.xbrl.org/..." external references that resolve via the XBRL processor catalog at runtime — they are not copied into the package.

Conclusion: the package redistributes only EBA-copyrighted material. No embedded third-party component prohibits third-party redistribution, so the counsel GATE is satisfied and the verbatim package is cleared for vendoring. (XBRL International’s own terms additionally permit unmodified redistribution of XBRL documents; the verbatim/no-derivative posture is preserved regardless.)

Package publisher (from META-INF/taxonomyPackage.xml): European Banking Authority, publisherURL http://www.eba.europa.eu/, publication date 2024-12-19; the package exposes the DORA: DORA entry point (.../crr/fws/dora/4.0/mod/dora.xsd).

Runtime use

Loaded offline by StellaOps.Findings.DoraRoi.DoraRoiTaxonomyAsset / validated by DoraRoiTaxonomyValidator. No runtime/test/replay/export path fetches the package over the network; the loader pins the outer + inner SHA-256 and refuses to claim EBA conformance on any mismatch.

License / notice

EBA material reproduced under the EBA legal notice with source acknowledgment; carved out of the Stella Ops BUSL-1.1 grant. See:

NOTICE.md (EBA RoI attribution block)
docs/legal/THIRD-PARTY-DEPENDENCIES.md
third-party-licenses/LicenseRef-EBA-Legal-Notice-Reproduction-With-Source-Acknowledgement.txt