scriptorium/docs/roadmap/policy.md

# Project Licensing Policy Alignment

## Status

Accepted feature direction, recorded on 2026-09-26; implementation is pending.
Align the policies and supporting documentation with the standard policy
repository at commit `dafa823981004d4d58a5eb1b59a84ffebbd979da`, reviewed in
`../policy`. This roadmap defines the target state, not an implementation
sequence. The [OSS policy](../policy/oss.md) will own the ongoing rules.

## Current Baseline

The reviewed Scriptorium revision is `39d3508`. Its earlier policy adoption
is complete; that revision's `docs/roadmap/policy.md` preserves the previous
adoption record in Git. Current policy versions are:

- OSS policy base version 1.1;
- documentation policy base version 1.4; and
- release policy base version 1.2.

The maintainer has already changed the project grant to GPL-3.0-or-later.
[COPYRIGHT](../../COPYRIGHT) follows the upstream application convention,
including project identity, copyright holder and year, SPDX expression,
grant, disclaimer, and third-party statement. [LICENSE](../../LICENSE) contains
the complete GPLv3 text; its only byte-level difference from the upstream
reference is a missing final newline. No substantive rewrite is needed.

Remaining differences are documentation and policy alignment:

- The README and OSS policy's README example still say BSD 3-Clause.
- Documentation ownership does not yet recognize `COPYRIGHT`, and the
  attribution introduction links only to `LICENSE` for the project's terms.
- The release procedure and remaining roadmap handoffs prescribe the old
  `LICENSE | ATTRIBUTION` footer.
- The contributor reading guide routes dependency and attribution work to the
  OSS policy but does not explicitly include project licensing.

Dependency entries already use imported-commit source and notice links and
applicable standard and companion texts. The hosted workflow already reuses
the checked-in release note unchanged as the hosted body.

## Targeted End State

### Licensing Policy And Ownership

Adopt OSS policy base version **1.2** and documentation policy base version
**1.5**, preserving Scriptorium-specific customizations. Upstream's agent,
architecture, testing, and release templates have no new changes in this
update; their local versions remain unchanged.

| Canonical document | Target responsibility |
| --- | --- |
| `docs/policy/oss.md` | Project licensing conventions, author choices, upstream attribution, and discoverability. |
| `COPYRIGHT` | Project identity, holders and years, SPDX expression, grant, disclaimer, and third-party statement. |
| `LICENSE` | Complete project license text and incorporated companion text where applicable. |
| `docs/oss/attribution.md` | Component-specific upstream notices and imported-source references. |
| `docs/oss/licenses/` | Applicable complete standard dependency license texts. |

The standard defaults are GPL-3.0-or-later for applications and
LGPL-3.0-or-later for libraries. An explicit author choice takes precedence
without exception rationale, extra approval, or compensating controls. These
defaults guide new selections: adoption does not relicense existing code,
override third-party terms, or imply different grants for individual packages.

Scriptorium's selected grant remains the one already recorded in `COPYRIGHT`.
Holder and year information is maintained accurately, not inferred from
maintainer identity or advanced automatically. No blanket per-file-header
requirement is introduced; applicable existing notices remain preserved.

### Discoverability

The README ends with a friendly GPL v3 or later statement linking to
`COPYRIGHT`, followed by the attribution link. The attribution introduction
links to both the project grant and complete license text without duplicating
the grant.

New release notes and hosted download pages end with
`COPYRIGHT | LICENSE | ATTRIBUTION`. All three links use absolute URLs at the
release's immutable tag or source revision. Upstream component links continue
identifying imported commits, not Scriptorium release tags. The release
procedure owns concrete URLs; the hosted workflow reuses the note rather than
maintaining a separate footer.

## Recommended Changes From The Baseline

- **[OSS policy](../policy/oss.md):** adopt the v1.2 scope, author-choice rules,
  canonical locations, coordinated maintenance, and navigation conventions.
  Use Scriptorium's actual grant in examples. Adapt template references to
  local files; do not retain adoption instructions or links to absent example
  directories.
- **[Documentation policy](../policy/documentation.md):** adopt the v1.5
  ownership entries and project-licensing boundary. Preserve local ownership,
  minimal-example guidance, ADR lifecycle, and policy metadata conventions.
  Both revised policies record their new base version and actual adoption date.
- **[README](../../README.md) and [attribution](../oss/attribution.md):** correct
  the stale project-license description and provide the targeted navigation.
  Preserve legitimate BSD dependency attribution and grants at imported
  revisions; do not infer new terms from a dependency's latest checkout.
- **[Contributor guide](../development.md):** explicitly route project-license
  changes to the OSS policy and relevant canonical documents.
- **[Release procedure](../release.md):** add the immutable `COPYRIGHT` link to
  the footer example and update the references to two URLs. The release policy
  already delegates footer conventions to the OSS policy; this adoption needs
  no release-policy version bump or automation change.
- **Active roadmap handoffs:** update or supersede still-operative old-footer
  directions in the [implementation record](implementation.md) with a link to
  the canonical release procedure. Preserve historical completion evidence.
- **Licensing files:** preserve the already-aligned grant and text. Restoring
  `LICENSE`'s final newline is optional mechanical alignment, not a substantive
  correction or new release gate. Do not copy the entire upstream license
  collection or generic COPYRIGHT examples into Scriptorium unnecessarily.

## Preserved Scope

This adoption documents an existing author-selected grant; it does not make a
new licensing decision. It changes no dependencies, application architecture,
runtime code, or release machinery. Preserve agent commit rules, the settled
House Format interpretation of upstream notice links, and existing
source-release completion and asynchronous delivery behavior.

There is no new publication-time network check, approval gate, scanner, SBOM,
source bundle, downloadable license asset, or modified-dependency rebuild exercise.
Concrete exceptions continue to receive the treatment specified by the adopted
OSS policy; the house format is not a universal legal-sufficiency guarantee.

## Release And Historical Treatment

Apply navigation changes prospectively. Do not rewrite published notes, tags,
binaries, checksums, or hosted release bodies to retrofit them. The next release
note should explain the maintainer-selected change to GPL-3.0-or-later and link
to the canonical grant. Policy adoption does not alter historical grants.
Version selection and publication remain separate preparation work under the
[release policy](../policy/release.md).

## Completion Criteria

- The two updated policies identify the selected upstream versions and actual
  adoption date, preserving local customizations and settled scope.
- Current project-license descriptions agree with `COPYRIGHT`; documentation
  distinguishes the grant, complete text, and upstream attribution.
- The release procedure and active handoffs agree on the three-link footer,
  with hosted-body reuse and publication behavior unchanged.
- Affected local links and candidate footer paths are verified against the
  repository. Future release tags need not resolve online before publication;
  this is ordinary documentation review, not a new release gate.
- The final diff contains only the agreed documentation changes and any chosen
  newline normalization, not changes to published history or dependency grants.
  Content, link, and diff checks suffice; runtime tests are unnecessary for
  this documentation-only adoption.

There are no unresolved policy choices for this scope.