promptkit/docs/policy/oss.md

# Open Source Licensing And Attribution Policy

**Base Policy Version:** 1.2

**Last Updated:** 2026-09-26

Adapted from the standard policy; see [provenance and licensing](../oss/attribution.md#standard-repository-policies).

## Purpose And Scope

This policy defines Promptkit's project licensing conventions and House Format
for upstream attribution. It covers relevant incorporated or distributed
components, including transitive dependencies and copied code, documentation,
or assets. Treatment follows the component's terms and actual use, not merely
its direct-dependency status or common ownership. Development tools do not
automatically require attribution.

Promptkit is a Go library with an author-selected LGPL-3.0-or-later grant in
[COPYRIGHT](../../COPYRIGHT). Its public source repository is
`https://gitea.maximumdirect.net/eric/promptkit`; it publishes source-only Go
module releases through annotated tags, not binaries or separate hosted release
pages. The [release procedure](../release.md) owns publication mechanics.

The House Format does not establish license compatibility or resolve every
obligation arising from use or distribution. Adoption does not relicense
existing material or override third-party terms.

## Canonical Locations

The [documentation policy](documentation.md) assigns ownership:

- `COPYRIGHT`: project name, holders and years, SPDX expression, grant,
  warranty disclaimer, and statement about third-party material.
- `LICENSE`: complete, unmodified project license texts, including incorporated
  companion text. Promptkit includes LGPLv3 followed by GPLv3.
- `docs/oss/attribution.md`: canonical component entries.
- `docs/oss/licenses/`: complete, verbatim standard dependency texts, including
  companions where applicable. Shared texts can serve multiple entries.

Keep explanations and project-specific notices outside standard texts. Preserve
distinct versions and exceptions, using recognizable filenames.

## Project Licensing

The house defaults for new projects are GPL-3.0-or-later for applications and
LGPL-3.0-or-later for libraries. An author's explicit choice takes precedence
without an exception rationale, extra approval, or compensating controls.
Promptkit retains its selected library grant; do not infer different licenses
for individual packages or relicense existing code by adopting this policy.

Keep COPYRIGHT, LICENSE, SPDX expressions, and README descriptions consistent.
Use accurate holders and years; do not assume the maintainer owns every
contribution or advance years automatically. Update grant, disclaimer, and text
references together when the author deliberately changes licensing. Preserve
third-party terms and required existing notices. No blanket per-file header
requirement is introduced.

## Upstream Attribution House Format

Each component entry contains five fields:

1. Project name, normally as the heading.
2. Upstream copyright statements, preserving their wording.
3. Applicable SPDX license identifier or expression.
4. License and notice links.
5. Source repository link at the exact imported commit.

These are fields, not a line limit. Include multiple statements or links where
needed. Do not invent absent copyright statements or SPDX identifiers. Describe
nonstandard terms through their linked text, preserve alternatives and
exceptions, and record a selected option when relevant. Do not silently resolve
an unsettled licensing choice.

## License Texts And Upstream Links

Link standard texts to local copies. Link project-specific notices to the
upstream copies at the exact commit corresponding to the imported version or
copied material. Moving branches and version tags are not substitutes for
commit-specific component links.

Classify material by content, not filename: an upstream LICENSE or COPYING can
mix standard text with project-specific notices or exceptions. Link both when
needed. Make incorporated companion texts directly reachable from each entry.

For project-specific license and attribution material, direct upstream links
are accepted as satisfying reproduction, inclusion, or copy requirements under
the adopted house interpretation. Do not add local-copy requirements or request
repeated approval solely because a license uses those terms. This concerns
notice reproduction, not other concrete obligations such as marking modified
files or supplying corresponding source. Central entries do not authorize
stripping required notices from incorporated source.

## Discoverability

End README with friendly statements linking to the actual grant in COPYRIGHT
and to the attribution document. Each new checked-in release note ends with
links whose visible text is `COPYRIGHT | LICENSE | ATTRIBUTION`, using absolute
URLs at the release's immutable tag or corresponding immutable source revision.
These release links differ from imported-component links, which use commits.

The release procedure owns concrete URL construction. If a hosted download page
is deliberately introduced, reuse the checked-in note and preserve its footer
there. This convention does not require a new hosted page, downloadable license
assets, source bundles, or another packaging format. Do not maintain duplicate
notice lists.

## Maintenance And Exceptions

Update attribution in the change that adds, removes, upgrades, copies, or changes
distribution of a relevant component. Inspect the selected source's actual
licenses/notices rather than assuming they are unchanged. Update entries,
commit links, and texts together; retain history through Git.

Review affected statements, standard-text fidelity, and link destinations during
ordinary change review. Future-release URLs can be checked against candidate
paths before the tag exists remotely. Do not add publication-time network checks,
CI polling, recurring legal sign-offs, mandatory scanners, or an SBOM just to
implement this policy. Attribution maintenance is preparation, not a release gate.

Raise exceptions only for concrete obligations or unresolved rights questions
the House Format does not address, including distribution-specific issues.
Record their selected treatment here or in the affected entry and resolve them
before the affected use/distribution, without reopening settled choices.
Common ownership is not a blanket exception. Adapted standard policy documents
retain their upstream documentation license and identify modifications in their
provenance entry; this does not change Promptkit's library grant.

The maintainer-provided standard policy templates are internal and non-public.
Their attribution entry identifies that source in prose and retains the
applicable license locally; do not link to or require publication of the
internal repository.

Apply conventions prospectively. Do not rewrite published tags, notes, binaries,
or checksums to retrofit formatting. Handle actual omissions deliberately under
applicable terms and the [release correction policy](release.md#immutability-and-failure-recovery).