Document the licensing policy alignment roadmap

docs/roadmap/policy.md

@@ -1,63 +1,151 @@
-# OSS Policy Adoption
+# Project Licensing Policy Alignment
 
 ## Status
 
-Completed on 2026-09-26. The upstream template work proposed here is now
-available and adopted locally. This document records the adoption; the
-[OSS policy](../policy/oss.md) is the canonical owner of the ongoing rules.
+Accepted feature direction, recorded on 2026-09-26; implementation is pending.
+Align the policies and supporting documentation with the standard policy
+repository at commit `dafa823981004d4d58a5eb1b59a84ffebbd979da`, reviewed in
+`../policy`. This roadmap defines the target state, not an implementation
+sequence. The [OSS policy](../policy/oss.md) will own the ongoing rules.
 
-The adopted baseline is the standard policy repository at commit
-`eea8bcd21a964b395e31971077d7fddb445f2c28`:
+## Current Baseline
+
+The reviewed Scriptorium revision is `39d3508`. Its earlier policy adoption
+is complete; that revision's `docs/roadmap/policy.md` preserves the previous
+adoption record in Git. Current policy versions are:
 
 - OSS policy base version 1.1;
 - documentation policy base version 1.4; and
 - release policy base version 1.2.
 
-Each affected policy records its base version and local update date. Template
-adoption instructions were removed. Unchanged agent, architecture, and testing
-policies retain their existing versions.
+The maintainer has already changed the project grant to GPL-3.0-or-later.
+[COPYRIGHT](../../COPYRIGHT) follows the upstream application convention,
+including project identity, copyright holder and year, SPDX expression,
+grant, disclaimer, and third-party statement. [LICENSE](../../LICENSE) contains
+the complete GPLv3 text; its only byte-level difference from the upstream
+reference is a missing final newline. No substantive rewrite is needed.
 
-## Adoption Outcome
+Remaining differences are documentation and policy alignment:
 
-- [Documentation ownership](../policy/documentation.md) distinguishes the
-  project license, component entries, standard texts, and OSS policy.
-- The [contributor guide](../development.md) routes dependency, copied-asset,
-  attribution, and release-document work to the OSS policy.
-- [Component entries](../oss/attribution.md) cover the six selected direct and
-  transitive Go modules. Source and project-specific notice links identify the
-  imported commits. LGPL entries link directly to both LGPL v3 and GPL v3.
-- Project-specific notices are linked upstream under the adopted house
-  interpretation. YAML's former local LICENSE and NOTICE copies were removed;
-  their history remains in Git. Missing upstream copyright statements are
-  identified in the affected entries rather than fabricated.
-- The five applicable standard texts in `docs/oss/licenses/` match the upstream
-  reference collection byte-for-byte: GPL v3, LGPL v3, Apache 2.0, BSD 3-Clause,
-  and MIT. The reference collection documents their publisher/SPDX provenance.
-  Adoption removed a stray LGPL prefix, restored the complete Apache text,
-  separated the standard BSD text from the Go-specific notice, and added MIT.
-- The [README](../../README.md) ends with friendly project-license and
-  attribution links. The [release policy](../policy/release.md) delegates footer
-  conventions to the OSS policy; the [release procedure](../release.md) retains
-  Scriptorium's immutable-tag URLs and existing hosted-body reuse.
+- The README and OSS policy's README example still say BSD 3-Clause.
+- Documentation ownership does not yet recognize `COPYRIGHT`, and the
+  attribution introduction links only to `LICENSE` for the project's terms.
+- The release procedure and remaining roadmap handoffs prescribe the old
+  `LICENSE | ATTRIBUTION` footer.
+- The contributor reading guide routes dependency and attribution work to the
+  OSS policy but does not explicitly include project licensing.
+
+Dependency entries already use imported-commit source and notice links and
+applicable standard and companion texts. The hosted workflow already reuses
+the checked-in release note unchanged as the hosted body.
+
+## Targeted End State
+
+### Licensing Policy And Ownership
+
+Adopt OSS policy base version **1.2** and documentation policy base version
+**1.5**, preserving Scriptorium-specific customizations. Upstream's agent,
+architecture, testing, and release templates have no new changes in this
+update; their local versions remain unchanged.
+
+| Canonical document | Target responsibility |
+| --- | --- |
+| `docs/policy/oss.md` | Project licensing conventions, author choices, upstream attribution, and discoverability. |
+| `COPYRIGHT` | Project identity, holders and years, SPDX expression, grant, disclaimer, and third-party statement. |
+| `LICENSE` | Complete project license text and incorporated companion text where applicable. |
+| `docs/oss/attribution.md` | Component-specific upstream notices and imported-source references. |
+| `docs/oss/licenses/` | Applicable complete standard dependency license texts. |
+
+The standard defaults are GPL-3.0-or-later for applications and
+LGPL-3.0-or-later for libraries. An explicit author choice takes precedence
+without exception rationale, extra approval, or compensating controls. These
+defaults guide new selections: adoption does not relicense existing code,
+override third-party terms, or imply different grants for individual packages.
+
+Scriptorium's selected grant remains the one already recorded in `COPYRIGHT`.
+Holder and year information is maintained accurately, not inferred from
+maintainer identity or advanced automatically. No blanket per-file-header
+requirement is introduced; applicable existing notices remain preserved.
+
+### Discoverability
+
+The README ends with a friendly GPL v3 or later statement linking to
+`COPYRIGHT`, followed by the attribution link. The attribution introduction
+links to both the project grant and complete license text without duplicating
+the grant.
+
+New release notes and hosted download pages end with
+`COPYRIGHT | LICENSE | ATTRIBUTION`. All three links use absolute URLs at the
+release's immutable tag or source revision. Upstream component links continue
+identifying imported commits, not Scriptorium release tags. The release
+procedure owns concrete URLs; the hosted workflow reuses the note rather than
+maintaining a separate footer.
+
+## Recommended Changes From The Baseline
+
+- **[OSS policy](../policy/oss.md):** adopt the v1.2 scope, author-choice rules,
+  canonical locations, coordinated maintenance, and navigation conventions.
+  Use Scriptorium's actual grant in examples. Adapt template references to
+  local files; do not retain adoption instructions or links to absent example
+  directories.
+- **[Documentation policy](../policy/documentation.md):** adopt the v1.5
+  ownership entries and project-licensing boundary. Preserve local ownership,
+  minimal-example guidance, ADR lifecycle, and policy metadata conventions.
+  Both revised policies record their new base version and actual adoption date.
+- **[README](../../README.md) and [attribution](../oss/attribution.md):** correct
+  the stale project-license description and provide the targeted navigation.
+  Preserve legitimate BSD dependency attribution and grants at imported
+  revisions; do not infer new terms from a dependency's latest checkout.
+- **[Contributor guide](../development.md):** explicitly route project-license
+  changes to the OSS policy and relevant canonical documents.
+- **[Release procedure](../release.md):** add the immutable `COPYRIGHT` link to
+  the footer example and update the references to two URLs. The release policy
+  already delegates footer conventions to the OSS policy; this adoption needs
+  no release-policy version bump or automation change.
+- **Active roadmap handoffs:** update or supersede still-operative old-footer
+  directions in the [implementation record](implementation.md) with a link to
+  the canonical release procedure. Preserve historical completion evidence.
+- **Licensing files:** preserve the already-aligned grant and text. Restoring
+  `LICENSE`'s final newline is optional mechanical alignment, not a substantive
+  correction or new release gate. Do not copy the entire upstream license
+  collection or generic COPYRIGHT examples into Scriptorium unnecessarily.
 
 ## Preserved Scope
 
-This adoption changes documentation and attribution, not Scriptorium's license,
-dependencies, application architecture, or release machinery. Published notes,
-tags, and assets remain unchanged. Existing source-release completion and
-asynchronous binary-delivery behavior remain intact.
+This adoption documents an existing author-selected grant; it does not make a
+new licensing decision. It changes no dependencies, application architecture,
+runtime code, or release machinery. Preserve agent commit rules, the settled
+House Format interpretation of upstream notice links, and existing
+source-release completion and asynchronous delivery behavior.
 
-There is no new publication-time network check, approval gate, scanner, source
-bundle, downloadable license asset, or modified-dependency rebuild exercise.
+There is no new publication-time network check, approval gate, scanner, SBOM,
+source bundle, downloadable license asset, or modified-dependency rebuild exercise.
 Concrete exceptions continue to receive the treatment specified by the adopted
 OSS policy; the house format is not a universal legal-sufficiency guarantee.
 
-## Validation
+## Release And Historical Treatment
 
-The standard texts were compared against the upstream reference collection.
-The BSD reference intentionally retains its publisher's trailing space in the
-copyright placeholder; it is not reformatted to satisfy a whitespace check.
-Dependency commit references were resolved from Go module origin metadata or
-the selected upstream tag, and affected local links and upstream attribution
-destinations were checked. No runtime code, commands, or executable examples
-changed.
+Apply navigation changes prospectively. Do not rewrite published notes, tags,
+binaries, checksums, or hosted release bodies to retrofit them. The next release
+note should explain the maintainer-selected change to GPL-3.0-or-later and link
+to the canonical grant. Policy adoption does not alter historical grants.
+Version selection and publication remain separate preparation work under the
+[release policy](../policy/release.md).
+
+## Completion Criteria
+
+- The two updated policies identify the selected upstream versions and actual
+  adoption date, preserving local customizations and settled scope.
+- Current project-license descriptions agree with `COPYRIGHT`; documentation
+  distinguishes the grant, complete text, and upstream attribution.
+- The release procedure and active handoffs agree on the three-link footer,
+  with hosted-body reuse and publication behavior unchanged.
+- Affected local links and candidate footer paths are verified against the
+  repository. Future release tags need not resolve online before publication;
+  this is ordinary documentation review, not a new release gate.
+- The final diff contains only the agreed documentation changes and any chosen
+  newline normalization, not changes to published history or dependency grants.
+  Content, link, and diff checks suffice; runtime tests are unnecessary for
+  this documentation-only adoption.
+
+There are no unresolved policy choices for this scope.