eric/policy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Standardize attribution formatting and exclude editorial commentary

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-27 13:48:54 +00:00
parent 0243378009
commit a469273add
3 changed files with 92 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/policy/documentation.md
View File

@@ -1,8 +1,8 @@
# Documentation Policy
**Base Policy Version:** 1.5
**Base Policy Version:** 1.6
**Last Updated**: 2026-09-26
**Last Updated**: 2026-09-27
## Base Policy Template
@@ -83,7 +83,7 @@ secret values.
| Open source licensing and attribution policy | `docs/policy/oss.md` | Project licensing defaults and author choices, COPYRIGHT conventions, upstream attribution format, license-text and notice-link conventions, discoverability, maintenance, and handling of concrete exceptions. | Component entries, license texts, release commands, and dependency security review. |
| Project copyright and license grant | `COPYRIGHT` | Project identity, copyright holders and years, SPDX expression, license grant, warranty disclaimer, and statement about third-party material. | Complete license texts and upstream component attribution. |
| Project license texts | `LICENSE` | Complete project license text and incorporated companion text, with project-specific fields where required by the selected license. | General licensing policy and upstream component attribution. |
| Upstream component attribution | `docs/oss/attribution.md` | Component names, copyright statements, license identification, and license, notice, and source links. | General attribution policy and complete standard license texts. |
| Upstream component attribution | `docs/oss/attribution.md` | Factual component identification, copyright statements, license identification, required upstream notices, and license, notice, and source links in the House Format. | General attribution policy, exception reasoning, research narratives, compliance commentary, and complete standard license texts. |
| Standard dependency license texts | `docs/oss/licenses/` | Complete, verbatim standard license texts shared by attribution entries where applicable. | Project-specific upstream notices, attribution prose, and policy interpretation. |
| Repository-specific release procedure | `docs/release.md` | Maintainer prerequisites, candidate preparation, concrete validation and publication commands, automated publication guards, asynchronous deliverable publication, separate delivery status, optional consumer-facing verification, and failure recovery. | General release requirements, product installation guidance, historical release summaries, and current compatibility contracts. |
| CLI contract (if applicable) | `docs/cli.md` | Commands, arguments, flags, invocation semantics, and exit codes. | End-to-end operating procedures, configuration field definitions, runtime filesystem layout, module implementation details. |

74
docs/policy/oss.md
View File

@@ -1,8 +1,8 @@
# Open Source Licensing And Attribution Policy
**Base Policy Version:** 1.3
**Base Policy Version:** 1.4
**Last Updated**: 2026-09-26
**Last Updated**: 2026-09-27
## Base Policy Template
@@ -94,35 +94,51 @@ preserve notices or add them where the applicable terms require them.
## Upstream Attribution House Format
Each component entry has five fields:
Begin `docs/oss/attribution.md` with `# Open Source Attribution Notices`,
followed directly by component entries. Do not add an introductory summary,
policy links, audit narrative, disclaimer, or concluding explanation.
1. **Project name**, normally as the entry heading.
Each entry presents these five fields in order, with blank lines between them:
1. **Project name** as a level-two heading. An optional identification paragraph
may follow, such as `Selected module: MODULE at VERSION.` with the module and
version in backticks. A factual qualifier such as `(transitive dependency)`
is permitted; do not describe dependency-discovery methods.
2. **Upstream copyright statement or statements**, preserving their wording.
3. **SPDX license identifier or expression**, when applicable.
4. **License and notice links**, covering the applicable standard texts and
upstream project-specific material.
5. **Source repository link**, identifying the source corresponding to the
imported version.
Put multiple statements in separate paragraphs. If the selected upstream
source supplies no applicable statement, omit this field without inventing
one or adding an explanation of its absence.
3. **SPDX license identifier or expression**, when applicable, using
`SPDX-License-Identifier: EXPRESSION`.
4. **License and notice links**, beginning `License and notices:`, separated
by ` | `, and ending with a period. Label local standard texts by license
name, such as `MIT` or `Apache 2.0`. Label upstream files by their actual
filenames, such as `COPYRIGHT`, `LICENSE`, `NOTICE`, or `PATENTS`.
5. **Source repository link**, using `[Source](COMMIT_URL).` with no `Source:`
prefix or additional description.
Illustrative Markdown, with placeholders for the actual upstream information:
Use the copyable [attribution example](../../examples/licensing/attribution.md).
Its three illustrative entries demonstrate a normal entry, omission of an
unavailable copyright statement, and multiple copyrights and license texts.
Replace the uppercase placeholders and illustrative URLs with actual component
information. Local license links are relative to the destination
`docs/oss/attribution.md`; copy the applicable texts into its `licenses/`
directory. Do not copy example entries for components the project does not use.
```markdown
## Example Library
These are five fields, not a line limit. Omit the SPDX field when no applicable
identifier exists; identify nonstandard terms through the linked text. Preserve
licensing alternatives and exceptions, and record a selected option when
relevant through the factual license identification. Do not invent an identifier
or silently resolve an unsettled licensing choice.
Copyright <upstream copyright statement>
SPDX-License-Identifier: Apache-2.0
License and notices: [Apache 2.0](licenses/Apache-2.0.txt) | [NOTICE](<upstream NOTICE URL at the imported commit>)
Source: [Example Library](<upstream repository URL at the imported commit>)
```
These are five fields, not a line limit. Include multiple statements and links
where needed. Omit the SPDX field when no applicable identifier exists; identify
nonstandard terms accurately through the linked text. Preserve licensing
alternatives and exceptions, and record a selected option when relevant. Do not
invent an identifier or silently resolve an unsettled licensing choice.
Keep entries factual. Do not add agent-authored explanations of license
expressions, file-level license scope, research performed, retained source
notices, or compliance conclusions. Avoid filler such as "none is invented
here" and embellished link labels such as "upstream LICENSE", "additional
patent grant", or "at the imported commit". Preserve actual required upstream
content; this rule excludes editorial additions, not required notices. Policy
interpretation and exception reasoning belong in the adopted OSS policy or an
appropriate decision record, not the attribution document.
## License Texts And Upstream Links
@@ -191,8 +207,10 @@ to implement this policy.
Use the House Format routinely. Raise an exception only for a concrete obligation
or unresolved rights question it does not address, including any arising from a
particular distribution channel. Record the issue and selected treatment in the
adopted policy or affected attribution entry as appropriate. Resolve the issue
before the affected use or distribution without reopening settled choices.
adopted OSS policy or an appropriate decision record. Attribution entries
contain the resulting factual identification and required material, without
repeating that reasoning. Resolve the issue before the affected use or
distribution without reopening settled choices.
Common ownership of projects is neither required nor a blanket exception.
Apply the formatting convention prospectively. Do not rewrite published tags,

43
examples/licensing/attribution.md Normal file
View File

@@ -0,0 +1,43 @@
# Open Source Attribution Notices
## PROJECT_ONE
Selected module: `MODULE_ONE` at `VERSION_ONE`.
Copyright (C) YEAR_ONE COPYRIGHT_HOLDER_ONE
SPDX-License-Identifier: MIT
License and notices: [MIT](licenses/MIT.txt) |
[COPYRIGHT](https://example.invalid/PROJECT_ONE/blob/COMMIT_ONE/COPYRIGHT) |
[LICENSE](https://example.invalid/PROJECT_ONE/blob/COMMIT_ONE/LICENSE).
[Source](https://example.invalid/PROJECT_ONE/tree/COMMIT_ONE).
## PROJECT_TWO
Selected module: `MODULE_TWO` at `VERSION_TWO`.
SPDX-License-Identifier: Apache-2.0
License and notices: [Apache 2.0](licenses/Apache-2.0.txt) |
[LICENSE](https://example.invalid/PROJECT_TWO/blob/COMMIT_TWO/LICENSE).
[Source](https://example.invalid/PROJECT_TWO/tree/COMMIT_TWO).
## PROJECT_THREE
Selected module: `MODULE_THREE` at `VERSION_THREE` (transitive dependency).
Copyright (C) YEAR_THREE COPYRIGHT_HOLDER_THREE
Copyright (C) YEAR_FOUR COPYRIGHT_HOLDER_FOUR
SPDX-License-Identifier: MIT AND Apache-2.0
License and notices: [MIT](licenses/MIT.txt) |
[Apache 2.0](licenses/Apache-2.0.txt) |
[LICENSE](https://example.invalid/PROJECT_THREE/blob/COMMIT_THREE/LICENSE) |
[NOTICE](https://example.invalid/PROJECT_THREE/blob/COMMIT_THREE/NOTICE).
[Source](https://example.invalid/PROJECT_THREE/tree/COMMIT_THREE).