scriptorium/docs/roadmap/policy.md

OSS Policy Adoption

Status

Completed on 2026-09-26. The upstream template work proposed here is now available and adopted locally. This document records the adoption; the OSS policy is the canonical owner of the ongoing rules.

The adopted baseline is the standard policy repository at commit eea8bcd21a964b395e31971077d7fddb445f2c28:

• OSS policy base version 1.1;
• documentation policy base version 1.4; and
• release policy base version 1.2.

Each affected policy records its base version and local update date. Template adoption instructions were removed. Unchanged agent, architecture, and testing policies retain their existing versions.

Adoption Outcome

• Documentation ownership distinguishes the project license, component entries, standard texts, and OSS policy.
• The contributor guide routes dependency, copied-asset, attribution, and release-document work to the OSS policy.
• Component entries cover the six selected direct and transitive Go modules. Source and project-specific notice links identify the imported commits. LGPL entries link directly to both LGPL v3 and GPL v3.
• Project-specific notices are linked upstream under the adopted house interpretation. YAML's former local LICENSE and NOTICE copies were removed; their history remains in Git. Missing upstream copyright statements are identified in the affected entries rather than fabricated.
• The five applicable standard texts in docs/oss/licenses/ match the upstream reference collection byte-for-byte: GPL v3, LGPL v3, Apache 2.0, BSD 3-Clause, and MIT. The reference collection documents their publisher/SPDX provenance. Adoption removed a stray LGPL prefix, restored the complete Apache text, separated the standard BSD text from the Go-specific notice, and added MIT.
• The README ends with friendly project-license and attribution links. The release policy delegates footer conventions to the OSS policy; the release procedure retains Scriptorium's immutable-tag URLs and existing hosted-body reuse.

Preserved Scope

This adoption changes documentation and attribution, not Scriptorium's license, dependencies, application architecture, or release machinery. Published notes, tags, and assets remain unchanged. Existing source-release completion and asynchronous binary-delivery behavior remain intact.

There is no new publication-time network check, approval gate, scanner, source bundle, downloadable license asset, or modified-dependency rebuild exercise. Concrete exceptions continue to receive the treatment specified by the adopted OSS policy; the house format is not a universal legal-sufficiency guarantee.

Validation

The standard texts were compared against the upstream reference collection. The BSD reference intentionally retains its publisher's trailing space in the copyright placeholder; it is not reformatted to satisfy a whitespace check. Dependency commit references were resolved from Go module origin metadata or the selected upstream tag, and affected local links and upstream attribution destinations were checked. No runtime code, commands, or executable examples changed.