Standardize attribution formatting and exclude editorial commentary

docs/policy/documentation.md

@@ -1,8 +1,8 @@
 # Documentation Policy
 
-**Base Policy Version:** 1.5
+**Base Policy Version:** 1.6
 
-**Last Updated**: 2026-09-26
+**Last Updated**: 2026-09-27
 
 ## Base Policy Template
 
@@ -83,7 +83,7 @@ secret values.
 | Open source licensing and attribution policy | `docs/policy/oss.md` | Project licensing defaults and author choices, COPYRIGHT conventions, upstream attribution format, license-text and notice-link conventions, discoverability, maintenance, and handling of concrete exceptions. | Component entries, license texts, release commands, and dependency security review. |
 | Project copyright and license grant | `COPYRIGHT` | Project identity, copyright holders and years, SPDX expression, license grant, warranty disclaimer, and statement about third-party material. | Complete license texts and upstream component attribution. |
 | Project license texts | `LICENSE` | Complete project license text and incorporated companion text, with project-specific fields where required by the selected license. | General licensing policy and upstream component attribution. |
-| Upstream component attribution | `docs/oss/attribution.md` | Component names, copyright statements, license identification, and license, notice, and source links. | General attribution policy and complete standard license texts. |
+| Upstream component attribution | `docs/oss/attribution.md` | Factual component identification, copyright statements, license identification, required upstream notices, and license, notice, and source links in the House Format. | General attribution policy, exception reasoning, research narratives, compliance commentary, and complete standard license texts. |
 | Standard dependency license texts | `docs/oss/licenses/` | Complete, verbatim standard license texts shared by attribution entries where applicable. | Project-specific upstream notices, attribution prose, and policy interpretation. |
 | Repository-specific release procedure | `docs/release.md` | Maintainer prerequisites, candidate preparation, concrete validation and publication commands, automated publication guards, asynchronous deliverable publication, separate delivery status, optional consumer-facing verification, and failure recovery. | General release requirements, product installation guidance, historical release summaries, and current compatibility contracts. |
 | CLI contract (if applicable) | `docs/cli.md` | Commands, arguments, flags, invocation semantics, and exit codes. | End-to-end operating procedures, configuration field definitions, runtime filesystem layout, module implementation details. |

docs/policy/oss.md

@@ -1,8 +1,8 @@
 # Open Source Licensing And Attribution Policy
 
-**Base Policy Version:** 1.3
+**Base Policy Version:** 1.4
 
-**Last Updated**: 2026-09-26
+**Last Updated**: 2026-09-27
 
 ## Base Policy Template
 
@@ -94,35 +94,51 @@ preserve notices or add them where the applicable terms require them.
 
 ## Upstream Attribution House Format
 
-Each component entry has five fields:
+Begin `docs/oss/attribution.md` with `# Open Source Attribution Notices`,
+followed directly by component entries. Do not add an introductory summary,
+policy links, audit narrative, disclaimer, or concluding explanation.
 
-1. **Project name**, normally as the entry heading.
+Each entry presents these five fields in order, with blank lines between them:
+
+1. **Project name** as a level-two heading. An optional identification paragraph
+   may follow, such as `Selected module: MODULE at VERSION.` with the module and
+   version in backticks. A factual qualifier such as `(transitive dependency)`
+   is permitted; do not describe dependency-discovery methods.
 2. **Upstream copyright statement or statements**, preserving their wording.
-3. **SPDX license identifier or expression**, when applicable.
+   Put multiple statements in separate paragraphs. If the selected upstream
-4. **License and notice links**, covering the applicable standard texts and
+   source supplies no applicable statement, omit this field without inventing
-   upstream project-specific material.
+   one or adding an explanation of its absence.
-5. **Source repository link**, identifying the source corresponding to the
+3. **SPDX license identifier or expression**, when applicable, using
-   imported version.
+   `SPDX-License-Identifier: EXPRESSION`.
+4. **License and notice links**, beginning `License and notices:`, separated
+   by ` | `, and ending with a period. Label local standard texts by license
+   name, such as `MIT` or `Apache 2.0`. Label upstream files by their actual
+   filenames, such as `COPYRIGHT`, `LICENSE`, `NOTICE`, or `PATENTS`.
+5. **Source repository link**, using `[Source](COMMIT_URL).` with no `Source:`
+   prefix or additional description.
 
-Illustrative Markdown, with placeholders for the actual upstream information:
+Use the copyable [attribution example](../../examples/licensing/attribution.md).
+Its three illustrative entries demonstrate a normal entry, omission of an
+unavailable copyright statement, and multiple copyrights and license texts.
+Replace the uppercase placeholders and illustrative URLs with actual component
+information. Local license links are relative to the destination
+`docs/oss/attribution.md`; copy the applicable texts into its `licenses/`
+directory. Do not copy example entries for components the project does not use.
 
-```markdown
+These are five fields, not a line limit. Omit the SPDX field when no applicable
-## Example Library
+identifier exists; identify nonstandard terms through the linked text. Preserve
+licensing alternatives and exceptions, and record a selected option when
+relevant through the factual license identification. Do not invent an identifier
+or silently resolve an unsettled licensing choice.
 
-Copyright <upstream copyright statement>
+Keep entries factual. Do not add agent-authored explanations of license
-
+expressions, file-level license scope, research performed, retained source
-SPDX-License-Identifier: Apache-2.0
+notices, or compliance conclusions. Avoid filler such as "none is invented
-
+here" and embellished link labels such as "upstream LICENSE", "additional
-License and notices: [Apache 2.0](licenses/Apache-2.0.txt) | [NOTICE](<upstream NOTICE URL at the imported commit>)
+patent grant", or "at the imported commit". Preserve actual required upstream
-
+content; this rule excludes editorial additions, not required notices. Policy
-Source: [Example Library](<upstream repository URL at the imported commit>)
+interpretation and exception reasoning belong in the adopted OSS policy or an
-```
+appropriate decision record, not the attribution document.
-
-These are five fields, not a line limit. Include multiple statements and links
-where needed. Omit the SPDX field when no applicable identifier exists; identify
-nonstandard terms accurately through the linked text. Preserve licensing
-alternatives and exceptions, and record a selected option when relevant. Do not
-invent an identifier or silently resolve an unsettled licensing choice.
 
 ## License Texts And Upstream Links
 
@@ -191,8 +207,10 @@ to implement this policy.
 Use the House Format routinely. Raise an exception only for a concrete obligation
 or unresolved rights question it does not address, including any arising from a
 particular distribution channel. Record the issue and selected treatment in the
-adopted policy or affected attribution entry as appropriate. Resolve the issue
+adopted OSS policy or an appropriate decision record. Attribution entries
-before the affected use or distribution without reopening settled choices.
+contain the resulting factual identification and required material, without
+repeating that reasoning. Resolve the issue before the affected use or
+distribution without reopening settled choices.
 Common ownership of projects is neither required nor a blanket exception.
 
 Apply the formatting convention prospectively. Do not rewrite published tags,

examples/licensing/attribution.md

@@ -0,0 +1,43 @@
+# Open Source Attribution Notices
+
+## PROJECT_ONE
+
+Selected module: `MODULE_ONE` at `VERSION_ONE`.
+
+Copyright (C) YEAR_ONE COPYRIGHT_HOLDER_ONE
+
+SPDX-License-Identifier: MIT
+
+License and notices: [MIT](licenses/MIT.txt) |
+[COPYRIGHT](https://example.invalid/PROJECT_ONE/blob/COMMIT_ONE/COPYRIGHT) |
+[LICENSE](https://example.invalid/PROJECT_ONE/blob/COMMIT_ONE/LICENSE).
+
+[Source](https://example.invalid/PROJECT_ONE/tree/COMMIT_ONE).
+
+## PROJECT_TWO
+
+Selected module: `MODULE_TWO` at `VERSION_TWO`.
+
+SPDX-License-Identifier: Apache-2.0
+
+License and notices: [Apache 2.0](licenses/Apache-2.0.txt) |
+[LICENSE](https://example.invalid/PROJECT_TWO/blob/COMMIT_TWO/LICENSE).
+
+[Source](https://example.invalid/PROJECT_TWO/tree/COMMIT_TWO).
+
+## PROJECT_THREE
+
+Selected module: `MODULE_THREE` at `VERSION_THREE` (transitive dependency).
+
+Copyright (C) YEAR_THREE COPYRIGHT_HOLDER_THREE
+
+Copyright (C) YEAR_FOUR COPYRIGHT_HOLDER_FOUR
+
+SPDX-License-Identifier: MIT AND Apache-2.0
+
+License and notices: [MIT](licenses/MIT.txt) |
+[Apache 2.0](licenses/Apache-2.0.txt) |
+[LICENSE](https://example.invalid/PROJECT_THREE/blob/COMMIT_THREE/LICENSE) |
+[NOTICE](https://example.invalid/PROJECT_THREE/blob/COMMIT_THREE/NOTICE).
+
+[Source](https://example.invalid/PROJECT_THREE/tree/COMMIT_THREE).