Define project licensing defaults and COPYRIGHT examples

docs/policy/documentation.md

@@ -1,6 +1,6 @@
 # Documentation Policy
 
-**Base Policy Version:** 1.4
+**Base Policy Version:** 1.5
 
 **Last Updated**: 2026-09-26
 
@@ -80,8 +80,9 @@ secret values.
 | Documentation policy | `docs/policy/documentation.md` | Documentation ownership, audience boundaries, maintenance rules, and ADR/document lifecycle. | Application architecture or product behavior. |
 | Testing policy | `docs/policy/testing.md` | Test philosophy, risk-based sufficiency, test boundaries, doubles, coverage guidance, regression-test policy, and criteria for adding, rewriting, or deleting tests. | Subsystem behavior, application contracts, subsystem-specific test inventories, and implementation plans. |
 | Release policy | `docs/policy/release.md` | Versioning and compatibility rules, release integrity and immutability requirements, release-documentation policy, proportionate gate selection, publication controls, release completion, and the boundary between required checks and optional verification. | Repository-specific commands, product installation guidance, CLI version semantics, historical release summaries, and CI implementation detail. |
-| Open source licensing and attribution policy | `docs/policy/oss.md` | House attribution format, license-text and notice-link conventions, discoverability, maintenance, and handling of concrete exceptions. | Component entries, license texts, release commands, and dependency security review. |
+| Open source licensing and attribution policy | `docs/policy/oss.md` | Project licensing defaults and author choices, COPYRIGHT conventions, upstream attribution format, license-text and notice-link conventions, discoverability, maintenance, and handling of concrete exceptions. | Component entries, license texts, release commands, and dependency security review. |
-| Project license | `LICENSE` | The project's own license terms. | Upstream component attribution and dependency license texts. |
+| Project copyright and license grant | `COPYRIGHT` | Project identity, copyright holders and years, SPDX expression, license grant, warranty disclaimer, and statement about third-party material. | Complete license texts and upstream component attribution. |
+| Project license texts | `LICENSE` | Complete project license text and incorporated companion text, with project-specific fields where required by the selected license. | General licensing policy and upstream component attribution. |
 | Upstream component attribution | `docs/oss/attribution.md` | Component names, copyright statements, license identification, and license, notice, and source links. | General attribution policy and complete standard license texts. |
 | Standard dependency license texts | `docs/oss/licenses/` | Complete, verbatim standard license texts shared by attribution entries where applicable. | Project-specific upstream notices, attribution prose, and policy interpretation. |
 | Repository-specific release procedure | `docs/release.md` | Maintainer prerequisites, candidate preparation, concrete validation and publication commands, automated publication guards, asynchronous deliverable publication, separate delivery status, optional consumer-facing verification, and failure recovery. | General release requirements, product installation guidance, historical release summaries, and current compatibility contracts. |
@@ -130,11 +131,12 @@ must change with the behavior it describes. Do not use a release procedure or
 release note to weaken policy, redefine current behavior, or defer required
 documentation updates.
 
-### Open Source Attribution
+### Project Licensing And Upstream Attribution
 
-The [OSS policy](oss.md) defines the House Format and README and release-link
+The [OSS policy](oss.md) defines project licensing conventions, the upstream
-conventions. Attribution entries own component-specific information. README
+House Format, and README and release-link conventions. `COPYRIGHT` states the
-and release documents provide navigation to those canonical materials; the
+project grant; `LICENSE` supplies its complete license texts. Attribution entries
+own component-specific information. README and release documents provide navigation to those canonical materials; the
 release procedure owns URL construction and publication mechanics.
 
 ### Contracts And Implementation

docs/policy/oss.md

@@ -1,6 +1,6 @@
 # Open Source Licensing And Attribution Policy
 
-**Base Policy Version:** 1.1
+**Base Policy Version:** 1.2
 
 **Last Updated**: 2026-09-26
 
@@ -8,10 +8,11 @@
 
 Repositories adopting this policy should:
 
-1. Identify the project's license location, source and release host, distribution
+1. Identify the author's selected project license, source and release host,
-   channels, and publication mechanism in the appropriate canonical documents;
+   distribution channels, and publication mechanism in the appropriate canonical
-2. Connect the contributor reading guide to this policy for dependency,
+   documents;
-   attribution, and release-document changes;
+2. Connect the contributor reading guide to this policy for project licensing,
+   dependency, attribution, and release-document changes;
 3. Record any concrete requirements outside the House Format that apply to the
    project, with their reason and selected treatment;
 4. Update `Last Updated` to the adoption date, retaining the actual Base Policy
@@ -26,23 +27,26 @@ own attribution entries and upstream notice links under this policy.
 
 ## Purpose And Scope
 
-This policy establishes a repeatable House Format for open source attribution
+This policy defines project licensing conventions and a repeatable House Format
-and license notices. It covers upstream components incorporated into or
+for upstream attribution and license notices. It covers the project's own code
-distributed with the project, including relevant transitive dependencies and
+and upstream components incorporated into or distributed with the project,
+including relevant transitive dependencies and
 copied code or assets. Treatment follows the component's terms and actual use,
 rather than its classification as a direct dependency.
 
 The baseline is a publicly available source repository with releases published
 alongside it. The format is independent of language, forge, and build system.
 It does not require attribution for every development tool, establish license
-compatibility, or resolve obligations beyond attribution and notice handling.
+compatibility, or resolve every obligation arising from use or distribution.
 
 ## Canonical Locations
 
 The [documentation policy](documentation.md) assigns ownership:
 
-- `LICENSE` contains the project's own license. Dependency attribution does
+- `COPYRIGHT` contains the project name, copyright statements, SPDX expression,
-  not relicense the project.
+  license grant, warranty disclaimer, and statement about third-party material.
+- `LICENSE` contains the complete, unmodified project license text, including
+  incorporated companion text. Dependency attribution does not relicense the project.
 - `docs/oss/attribution.md` contains the canonical component entries.
 - `docs/oss/licenses/` contains complete, verbatim standard license texts,
   including companion texts where applicable.
@@ -51,7 +55,41 @@ Use recognizable license filenames, such as `Apache-2.0.txt` or `LGPL-3.0.txt`.
 A shared standard text may serve multiple entries. Keep explanations outside
 license texts and preserve distinct versions and exceptions.
 
-## House Format
+## Project Licensing
+
+Unless the author specifies otherwise, use **GPL version 3 or later**
+(`GPL-3.0-or-later`) for applications and **LGPL version 3 or later**
+(`LGPL-3.0-or-later`) for libraries. An author's explicit choice takes precedence:
+for example, a one-off script may use MIT. Such a choice requires no exception
+rationale, additional approval, or compensating controls under this policy.
+
+These defaults guide new license selection. Adopting this policy does not
+relicense existing code or override third-party terms. Preserve an existing
+license unless the author deliberately changes it. For mixed-purpose projects,
+follow the author's selected scope rather than inferring different licenses for
+individual packages.
+
+Use the copyable [application COPYRIGHT](../../examples/licensing/application/COPYRIGHT)
+or [library COPYRIGHT](../../examples/licensing/library/COPYRIGHT) as appropriate.
+Replace the project name, years, and holders with accurate information; do not
+assume the maintainer owns every contribution or advance years automatically.
+For another selected license, adapt the grant, SPDX expression, disclaimer, and
+text references together. The examples do not constrain the author's choice.
+
+For GPLv3 projects, copy the complete GPLv3 text into `LICENSE`. For LGPLv3
+projects, place the complete LGPLv3 text followed by the complete GPLv3 text in
+`LICENSE`; the LGPL incorporates the GPL terms. Keep the texts unmodified and
+place project-specific statements in `COPYRIGHT`. For the default grants, the
+grant and SPDX expression in `COPYRIGHT` must expressly identify `or-later`;
+follow the author’s choice if a different grant is selected.
+
+For other licenses, provide their complete text and any required project-specific
+fields; the standard reference collection remains unchanged. Keep `COPYRIGHT`,
+`LICENSE`, SPDX expressions, and README descriptions consistent with the actual
+grant. This convention introduces no blanket requirement for per-file headers;
+preserve notices or add them where the applicable terms require them.
+
+## Upstream Attribution House Format
 
 Each component entry has five fields:
 
@@ -111,18 +149,18 @@ source files; the central attribution entry does not authorize stripping them.
 ## Discoverability
 
 End the project's README with two friendly statements linking to its actual
-license and the attribution document. For example, for a project with the stated
+grant in `COPYRIGHT` and the attribution document. For example, for a project
-license:
+with the stated license:
 
 ```markdown
-PROJECT_NAME is licensed under the [LGPL v3.0 or later](LICENSE).
+PROJECT_NAME is licensed under the [LGPL v3.0 or later](COPYRIGHT).
 
 [Open Source attribution notices](docs/oss/attribution.md) are available.
 ```
 
 Each new checked-in release document and its hosted download page must end
-with links whose visible text is `LICENSE | ATTRIBUTION`. Use absolute URLs to
+with links whose visible text is `COPYRIGHT | LICENSE | ATTRIBUTION`. Use absolute
-those files at the release's immutable tag or corresponding immutable source
+URLs to those files at the release's immutable tag or corresponding immutable source
 revision so the links work in both locations. This release navigation is distinct
 from upstream component links, which must use the imported commit.
 
@@ -134,8 +172,9 @@ assets, source bundles, or a different binary package format.
 
 ## Maintenance And Exceptions
 
-Update notices in the change that adds, removes, upgrades, copies, or changes
+Update project licensing statements together when the author changes the grant
-the distribution of a relevant component. Check the selected source's license
+or its scope. Update upstream notices in the change that adds, removes, upgrades,
+copies, or changes the distribution of a relevant component. Check the selected source's license
 and notices rather than assuming they are unchanged. Update affected entries,
 commit links, and texts; retain historical versions through Git.
 

examples/licensing/application/COPYRIGHT

@@ -0,0 +1,19 @@
+PROJECT_NAME
+
+Copyright (C) YEAR COPYRIGHT_HOLDER
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+PROJECT_NAME is free software: you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+The GNU General Public License version 3 is provided in LICENSE.
+
+PROJECT_NAME is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+Third-party code and assets are subject to their respective license terms.

examples/licensing/library/COPYRIGHT

@@ -0,0 +1,20 @@
+PROJECT_NAME
+
+Copyright (C) YEAR COPYRIGHT_HOLDER
+
+SPDX-License-Identifier: LGPL-3.0-or-later
+
+This library is free software: you can redistribute it and/or modify it
+under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+The GNU Lesser General Public License version 3 and its incorporated
+GNU General Public License version 3 text are provided in LICENSE.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Lesser General Public License for more details.
+
+Third-party code and assets are subject to their respective license terms.