eric/scriptorium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

Document the licensing policy alignment roadmap

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-26 20:48:35 +00:00
parent 39d3508705
commit 83856b4de8
1 changed files with 132 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

176
docs/roadmap/policy.md
View File

@@ -1,63 +1,151 @@
# OSS Policy Adoption # Project Licensing Policy Alignment
## Status ## Status
Completed on 2026-09-26. The upstream template work proposed here is now Accepted feature direction, recorded on 2026-09-26; implementation is pending.
available and adopted locally. This document records the adoption; the Align the policies and supporting documentation with the standard policy
[OSS policy](../policy/oss.md) is the canonical owner of the ongoing rules. repository at commit `dafa823981004d4d58a5eb1b59a84ffebbd979da`, reviewed in
`../policy`. This roadmap defines the target state, not an implementation
sequence. The [OSS policy](../policy/oss.md) will own the ongoing rules.
The adopted baseline is the standard policy repository at commit ## Current Baseline
`eea8bcd21a964b395e31971077d7fddb445f2c28`:
The reviewed Scriptorium revision is `39d3508`. Its earlier policy adoption
is complete; that revision's `docs/roadmap/policy.md` preserves the previous
adoption record in Git. Current policy versions are:
- OSS policy base version 1.1; - OSS policy base version 1.1;
- documentation policy base version 1.4; and - documentation policy base version 1.4; and
- release policy base version 1.2. - release policy base version 1.2.
Each affected policy records its base version and local update date. Template The maintainer has already changed the project grant to GPL-3.0-or-later.
adoption instructions were removed. Unchanged agent, architecture, and testing [COPYRIGHT](../../COPYRIGHT) follows the upstream application convention,
policies retain their existing versions. including project identity, copyright holder and year, SPDX expression,
grant, disclaimer, and third-party statement. [LICENSE](../../LICENSE) contains
the complete GPLv3 text; its only byte-level difference from the upstream
reference is a missing final newline. No substantive rewrite is needed.
## Adoption Outcome Remaining differences are documentation and policy alignment:
- [Documentation ownership](../policy/documentation.md) distinguishes the - The README and OSS policy's README example still say BSD 3-Clause.
project license, component entries, standard texts, and OSS policy. - Documentation ownership does not yet recognize `COPYRIGHT`, and the
- The [contributor guide](../development.md) routes dependency, copied-asset, attribution introduction links only to `LICENSE` for the project's terms.
attribution, and release-document work to the OSS policy. - The release procedure and remaining roadmap handoffs prescribe the old
- [Component entries](../oss/attribution.md) cover the six selected direct and `LICENSE | ATTRIBUTION` footer.
transitive Go modules. Source and project-specific notice links identify the - The contributor reading guide routes dependency and attribution work to the
imported commits. LGPL entries link directly to both LGPL v3 and GPL v3. OSS policy but does not explicitly include project licensing.
- Project-specific notices are linked upstream under the adopted house
interpretation. YAML's former local LICENSE and NOTICE copies were removed; Dependency entries already use imported-commit source and notice links and
their history remains in Git. Missing upstream copyright statements are applicable standard and companion texts. The hosted workflow already reuses
identified in the affected entries rather than fabricated. the checked-in release note unchanged as the hosted body.
- The five applicable standard texts in `docs/oss/licenses/` match the upstream
reference collection byte-for-byte: GPL v3, LGPL v3, Apache 2.0, BSD 3-Clause, ## Targeted End State
and MIT. The reference collection documents their publisher/SPDX provenance.
Adoption removed a stray LGPL prefix, restored the complete Apache text, ### Licensing Policy And Ownership
separated the standard BSD text from the Go-specific notice, and added MIT.
- The [README](../../README.md) ends with friendly project-license and Adopt OSS policy base version **1.2** and documentation policy base version
attribution links. The [release policy](../policy/release.md) delegates footer **1.5**, preserving Scriptorium-specific customizations. Upstream's agent,
conventions to the OSS policy; the [release procedure](../release.md) retains architecture, testing, and release templates have no new changes in this
Scriptorium's immutable-tag URLs and existing hosted-body reuse. update; their local versions remain unchanged.
| Canonical document | Target responsibility |
| --- | --- |
| `docs/policy/oss.md` | Project licensing conventions, author choices, upstream attribution, and discoverability. |
| `COPYRIGHT` | Project identity, holders and years, SPDX expression, grant, disclaimer, and third-party statement. |
| `LICENSE` | Complete project license text and incorporated companion text where applicable. |
| `docs/oss/attribution.md` | Component-specific upstream notices and imported-source references. |
| `docs/oss/licenses/` | Applicable complete standard dependency license texts. |
The standard defaults are GPL-3.0-or-later for applications and
LGPL-3.0-or-later for libraries. An explicit author choice takes precedence
without exception rationale, extra approval, or compensating controls. These
defaults guide new selections: adoption does not relicense existing code,
override third-party terms, or imply different grants for individual packages.
Scriptorium's selected grant remains the one already recorded in `COPYRIGHT`.
Holder and year information is maintained accurately, not inferred from
maintainer identity or advanced automatically. No blanket per-file-header
requirement is introduced; applicable existing notices remain preserved.
### Discoverability
The README ends with a friendly GPL v3 or later statement linking to
`COPYRIGHT`, followed by the attribution link. The attribution introduction
links to both the project grant and complete license text without duplicating
the grant.
New release notes and hosted download pages end with
`COPYRIGHT | LICENSE | ATTRIBUTION`. All three links use absolute URLs at the
release's immutable tag or source revision. Upstream component links continue
identifying imported commits, not Scriptorium release tags. The release
procedure owns concrete URLs; the hosted workflow reuses the note rather than
maintaining a separate footer.
## Recommended Changes From The Baseline
- **[OSS policy](../policy/oss.md):** adopt the v1.2 scope, author-choice rules,
canonical locations, coordinated maintenance, and navigation conventions.
Use Scriptorium's actual grant in examples. Adapt template references to
local files; do not retain adoption instructions or links to absent example
directories.
- **[Documentation policy](../policy/documentation.md):** adopt the v1.5
ownership entries and project-licensing boundary. Preserve local ownership,
minimal-example guidance, ADR lifecycle, and policy metadata conventions.
Both revised policies record their new base version and actual adoption date.
- **[README](../../README.md) and [attribution](../oss/attribution.md):** correct
the stale project-license description and provide the targeted navigation.
Preserve legitimate BSD dependency attribution and grants at imported
revisions; do not infer new terms from a dependency's latest checkout.
- **[Contributor guide](../development.md):** explicitly route project-license
changes to the OSS policy and relevant canonical documents.
- **[Release procedure](../release.md):** add the immutable `COPYRIGHT` link to
the footer example and update the references to two URLs. The release policy
already delegates footer conventions to the OSS policy; this adoption needs
no release-policy version bump or automation change.
- **Active roadmap handoffs:** update or supersede still-operative old-footer
directions in the [implementation record](implementation.md) with a link to
the canonical release procedure. Preserve historical completion evidence.
- **Licensing files:** preserve the already-aligned grant and text. Restoring
`LICENSE`'s final newline is optional mechanical alignment, not a substantive
correction or new release gate. Do not copy the entire upstream license
collection or generic COPYRIGHT examples into Scriptorium unnecessarily.
## Preserved Scope ## Preserved Scope
This adoption changes documentation and attribution, not Scriptorium's license, This adoption documents an existing author-selected grant; it does not make a
dependencies, application architecture, or release machinery. Published notes, new licensing decision. It changes no dependencies, application architecture,
tags, and assets remain unchanged. Existing source-release completion and runtime code, or release machinery. Preserve agent commit rules, the settled
asynchronous binary-delivery behavior remain intact. House Format interpretation of upstream notice links, and existing
source-release completion and asynchronous delivery behavior.
There is no new publication-time network check, approval gate, scanner, source There is no new publication-time network check, approval gate, scanner, SBOM,
bundle, downloadable license asset, or modified-dependency rebuild exercise. source bundle, downloadable license asset, or modified-dependency rebuild exercise.
Concrete exceptions continue to receive the treatment specified by the adopted Concrete exceptions continue to receive the treatment specified by the adopted
OSS policy; the house format is not a universal legal-sufficiency guarantee. OSS policy; the house format is not a universal legal-sufficiency guarantee.
## Validation ## Release And Historical Treatment
The standard texts were compared against the upstream reference collection. Apply navigation changes prospectively. Do not rewrite published notes, tags,
The BSD reference intentionally retains its publisher's trailing space in the binaries, checksums, or hosted release bodies to retrofit them. The next release
copyright placeholder; it is not reformatted to satisfy a whitespace check. note should explain the maintainer-selected change to GPL-3.0-or-later and link
Dependency commit references were resolved from Go module origin metadata or to the canonical grant. Policy adoption does not alter historical grants.
the selected upstream tag, and affected local links and upstream attribution Version selection and publication remain separate preparation work under the
destinations were checked. No runtime code, commands, or executable examples [release policy](../policy/release.md).
changed.
## Completion Criteria
- The two updated policies identify the selected upstream versions and actual
adoption date, preserving local customizations and settled scope.
- Current project-license descriptions agree with `COPYRIGHT`; documentation
distinguishes the grant, complete text, and upstream attribution.
- The release procedure and active handoffs agree on the three-link footer,
with hosted-body reuse and publication behavior unchanged.
- Affected local links and candidate footer paths are verified against the
repository. Future release tags need not resolve online before publication;
this is ordinary documentation review, not a new release gate.
- The final diff contains only the agreed documentation changes and any chosen
newline normalization, not changes to published history or dependency grants.
Content, link, and diff checks suffice; runtime tests are unnecessary for
this documentation-only adoption.
There are no unresolved policy choices for this scope.