diff --git a/docs/roadmap/policy.md b/docs/roadmap/policy.md index c9b0795..5840fa4 100644 --- a/docs/roadmap/policy.md +++ b/docs/roadmap/policy.md @@ -1,63 +1,151 @@ -# OSS Policy Adoption +# Project Licensing Policy Alignment ## Status -Completed on 2026-09-26. The upstream template work proposed here is now -available and adopted locally. This document records the adoption; the -[OSS policy](../policy/oss.md) is the canonical owner of the ongoing rules. +Accepted feature direction, recorded on 2026-09-26; implementation is pending. +Align the policies and supporting documentation with the standard policy +repository at commit `dafa823981004d4d58a5eb1b59a84ffebbd979da`, reviewed in +`../policy`. This roadmap defines the target state, not an implementation +sequence. The [OSS policy](../policy/oss.md) will own the ongoing rules. -The adopted baseline is the standard policy repository at commit -`eea8bcd21a964b395e31971077d7fddb445f2c28`: +## Current Baseline + +The reviewed Scriptorium revision is `39d3508`. Its earlier policy adoption +is complete; that revision's `docs/roadmap/policy.md` preserves the previous +adoption record in Git. Current policy versions are: - OSS policy base version 1.1; - documentation policy base version 1.4; and - release policy base version 1.2. -Each affected policy records its base version and local update date. Template -adoption instructions were removed. Unchanged agent, architecture, and testing -policies retain their existing versions. +The maintainer has already changed the project grant to GPL-3.0-or-later. +[COPYRIGHT](../../COPYRIGHT) follows the upstream application convention, +including project identity, copyright holder and year, SPDX expression, +grant, disclaimer, and third-party statement. [LICENSE](../../LICENSE) contains +the complete GPLv3 text; its only byte-level difference from the upstream +reference is a missing final newline. No substantive rewrite is needed. -## Adoption Outcome +Remaining differences are documentation and policy alignment: -- [Documentation ownership](../policy/documentation.md) distinguishes the - project license, component entries, standard texts, and OSS policy. -- The [contributor guide](../development.md) routes dependency, copied-asset, - attribution, and release-document work to the OSS policy. -- [Component entries](../oss/attribution.md) cover the six selected direct and - transitive Go modules. Source and project-specific notice links identify the - imported commits. LGPL entries link directly to both LGPL v3 and GPL v3. -- Project-specific notices are linked upstream under the adopted house - interpretation. YAML's former local LICENSE and NOTICE copies were removed; - their history remains in Git. Missing upstream copyright statements are - identified in the affected entries rather than fabricated. -- The five applicable standard texts in `docs/oss/licenses/` match the upstream - reference collection byte-for-byte: GPL v3, LGPL v3, Apache 2.0, BSD 3-Clause, - and MIT. The reference collection documents their publisher/SPDX provenance. - Adoption removed a stray LGPL prefix, restored the complete Apache text, - separated the standard BSD text from the Go-specific notice, and added MIT. -- The [README](../../README.md) ends with friendly project-license and - attribution links. The [release policy](../policy/release.md) delegates footer - conventions to the OSS policy; the [release procedure](../release.md) retains - Scriptorium's immutable-tag URLs and existing hosted-body reuse. +- The README and OSS policy's README example still say BSD 3-Clause. +- Documentation ownership does not yet recognize `COPYRIGHT`, and the + attribution introduction links only to `LICENSE` for the project's terms. +- The release procedure and remaining roadmap handoffs prescribe the old + `LICENSE | ATTRIBUTION` footer. +- The contributor reading guide routes dependency and attribution work to the + OSS policy but does not explicitly include project licensing. + +Dependency entries already use imported-commit source and notice links and +applicable standard and companion texts. The hosted workflow already reuses +the checked-in release note unchanged as the hosted body. + +## Targeted End State + +### Licensing Policy And Ownership + +Adopt OSS policy base version **1.2** and documentation policy base version +**1.5**, preserving Scriptorium-specific customizations. Upstream's agent, +architecture, testing, and release templates have no new changes in this +update; their local versions remain unchanged. + +| Canonical document | Target responsibility | +| --- | --- | +| `docs/policy/oss.md` | Project licensing conventions, author choices, upstream attribution, and discoverability. | +| `COPYRIGHT` | Project identity, holders and years, SPDX expression, grant, disclaimer, and third-party statement. | +| `LICENSE` | Complete project license text and incorporated companion text where applicable. | +| `docs/oss/attribution.md` | Component-specific upstream notices and imported-source references. | +| `docs/oss/licenses/` | Applicable complete standard dependency license texts. | + +The standard defaults are GPL-3.0-or-later for applications and +LGPL-3.0-or-later for libraries. An explicit author choice takes precedence +without exception rationale, extra approval, or compensating controls. These +defaults guide new selections: adoption does not relicense existing code, +override third-party terms, or imply different grants for individual packages. + +Scriptorium's selected grant remains the one already recorded in `COPYRIGHT`. +Holder and year information is maintained accurately, not inferred from +maintainer identity or advanced automatically. No blanket per-file-header +requirement is introduced; applicable existing notices remain preserved. + +### Discoverability + +The README ends with a friendly GPL v3 or later statement linking to +`COPYRIGHT`, followed by the attribution link. The attribution introduction +links to both the project grant and complete license text without duplicating +the grant. + +New release notes and hosted download pages end with +`COPYRIGHT | LICENSE | ATTRIBUTION`. All three links use absolute URLs at the +release's immutable tag or source revision. Upstream component links continue +identifying imported commits, not Scriptorium release tags. The release +procedure owns concrete URLs; the hosted workflow reuses the note rather than +maintaining a separate footer. + +## Recommended Changes From The Baseline + +- **[OSS policy](../policy/oss.md):** adopt the v1.2 scope, author-choice rules, + canonical locations, coordinated maintenance, and navigation conventions. + Use Scriptorium's actual grant in examples. Adapt template references to + local files; do not retain adoption instructions or links to absent example + directories. +- **[Documentation policy](../policy/documentation.md):** adopt the v1.5 + ownership entries and project-licensing boundary. Preserve local ownership, + minimal-example guidance, ADR lifecycle, and policy metadata conventions. + Both revised policies record their new base version and actual adoption date. +- **[README](../../README.md) and [attribution](../oss/attribution.md):** correct + the stale project-license description and provide the targeted navigation. + Preserve legitimate BSD dependency attribution and grants at imported + revisions; do not infer new terms from a dependency's latest checkout. +- **[Contributor guide](../development.md):** explicitly route project-license + changes to the OSS policy and relevant canonical documents. +- **[Release procedure](../release.md):** add the immutable `COPYRIGHT` link to + the footer example and update the references to two URLs. The release policy + already delegates footer conventions to the OSS policy; this adoption needs + no release-policy version bump or automation change. +- **Active roadmap handoffs:** update or supersede still-operative old-footer + directions in the [implementation record](implementation.md) with a link to + the canonical release procedure. Preserve historical completion evidence. +- **Licensing files:** preserve the already-aligned grant and text. Restoring + `LICENSE`'s final newline is optional mechanical alignment, not a substantive + correction or new release gate. Do not copy the entire upstream license + collection or generic COPYRIGHT examples into Scriptorium unnecessarily. ## Preserved Scope -This adoption changes documentation and attribution, not Scriptorium's license, -dependencies, application architecture, or release machinery. Published notes, -tags, and assets remain unchanged. Existing source-release completion and -asynchronous binary-delivery behavior remain intact. +This adoption documents an existing author-selected grant; it does not make a +new licensing decision. It changes no dependencies, application architecture, +runtime code, or release machinery. Preserve agent commit rules, the settled +House Format interpretation of upstream notice links, and existing +source-release completion and asynchronous delivery behavior. -There is no new publication-time network check, approval gate, scanner, source -bundle, downloadable license asset, or modified-dependency rebuild exercise. +There is no new publication-time network check, approval gate, scanner, SBOM, +source bundle, downloadable license asset, or modified-dependency rebuild exercise. Concrete exceptions continue to receive the treatment specified by the adopted OSS policy; the house format is not a universal legal-sufficiency guarantee. -## Validation +## Release And Historical Treatment -The standard texts were compared against the upstream reference collection. -The BSD reference intentionally retains its publisher's trailing space in the -copyright placeholder; it is not reformatted to satisfy a whitespace check. -Dependency commit references were resolved from Go module origin metadata or -the selected upstream tag, and affected local links and upstream attribution -destinations were checked. No runtime code, commands, or executable examples -changed. +Apply navigation changes prospectively. Do not rewrite published notes, tags, +binaries, checksums, or hosted release bodies to retrofit them. The next release +note should explain the maintainer-selected change to GPL-3.0-or-later and link +to the canonical grant. Policy adoption does not alter historical grants. +Version selection and publication remain separate preparation work under the +[release policy](../policy/release.md). + +## Completion Criteria + +- The two updated policies identify the selected upstream versions and actual + adoption date, preserving local customizations and settled scope. +- Current project-license descriptions agree with `COPYRIGHT`; documentation + distinguishes the grant, complete text, and upstream attribution. +- The release procedure and active handoffs agree on the three-link footer, + with hosted-body reuse and publication behavior unchanged. +- Affected local links and candidate footer paths are verified against the + repository. Future release tags need not resolve online before publication; + this is ordinary documentation review, not a new release gate. +- The final diff contains only the agreed documentation changes and any chosen + newline normalization, not changes to published history or dependency grants. + Content, link, and diff checks suffice; runtime tests are unnecessary for + this documentation-only adoption. + +There are no unresolved policy choices for this scope.