scriptorium/docs/roadmap/policy.md

Project Licensing Policy Alignment

Status

Accepted feature direction, recorded on 2026-09-26; implementation is pending. Align the policies and supporting documentation with the agreed licensing conventions below. This roadmap defines the target state, not an implementation sequence. The OSS policy will own the ongoing rules.

Current Baseline

The reviewed Scriptorium revision is 39d3508. Its earlier policy adoption is complete; that revision's docs/roadmap/policy.md preserves the previous adoption record in Git. Current policy versions are:

• OSS policy base version 1.1;
• documentation policy base version 1.4; and
• release policy base version 1.2.

The maintainer has already changed the project grant to GPL-3.0-or-later. COPYRIGHT follows the agreed application convention, including project identity, copyright holder and year, SPDX expression, grant, disclaimer, and third-party statement. LICENSE contains the complete GPLv3 text; its only byte-level difference from the standard reference is a missing final newline. No substantive rewrite is needed.

Remaining differences are documentation and policy alignment:

• The README and OSS policy's README example still say BSD 3-Clause.
• Documentation ownership does not yet recognize COPYRIGHT, and the attribution introduction links only to LICENSE for the project's terms.
• The release procedure and remaining roadmap handoffs prescribe the old LICENSE | ATTRIBUTION footer.
• The contributor reading guide routes dependency and attribution work to the OSS policy but does not explicitly include project licensing.

Dependency entries already use imported-commit source and notice links and applicable standard and companion texts. The hosted workflow already reuses the checked-in release note unchanged as the hosted body.

Targeted End State

Licensing Policy And Ownership

Adopt OSS policy base version 1.2 and documentation policy base version 1.5, preserving Scriptorium-specific customizations. Agent, architecture, testing, and release policies need no changes for this adoption; their versions remain unchanged.

Canonical document	Target responsibility
docs/policy/oss.md	Project licensing conventions, author choices, upstream attribution, and discoverability.
COPYRIGHT	Project identity, holders and years, SPDX expression, grant, disclaimer, and third-party statement.
LICENSE	Complete project license text and incorporated companion text where applicable.
docs/oss/attribution.md	Component-specific upstream notices and imported-source references.
docs/oss/licenses/	Applicable complete standard dependency license texts.

The standard defaults are GPL-3.0-or-later for applications and LGPL-3.0-or-later for libraries. An explicit author choice takes precedence without exception rationale, extra approval, or compensating controls. These defaults guide new selections: adoption does not relicense existing code, override third-party terms, or imply different grants for individual packages.

Scriptorium's selected grant remains the one already recorded in COPYRIGHT. Holder and year information is maintained accurately, not inferred from maintainer identity or advanced automatically. No blanket per-file-header requirement is introduced; applicable existing notices remain preserved.

Discoverability

The README ends with a friendly GPL v3 or later statement linking to COPYRIGHT, followed by the attribution link. The attribution introduction links to both the project grant and complete license text without duplicating the grant.

New release notes and hosted download pages end with COPYRIGHT | LICENSE | ATTRIBUTION. All three links use absolute URLs at the release's immutable tag or source revision. Upstream component links continue identifying imported commits, not Scriptorium release tags. The release procedure owns concrete URLs; the hosted workflow reuses the note rather than maintaining a separate footer.

Recommended Changes From The Baseline

• OSS policy: adopt the v1.2 scope, author-choice rules, canonical locations, coordinated maintenance, and navigation conventions. Use Scriptorium's actual grant in examples and link to local canonical files.
• Documentation policy: adopt the v1.5 ownership entries and project-licensing boundary. Preserve local ownership, minimal-example guidance, ADR lifecycle, and policy metadata conventions. Both revised policies record their new base version and actual adoption date.
• README and attribution: correct the stale project-license description and provide the targeted navigation. Preserve legitimate BSD dependency attribution and grants at imported revisions; do not infer new terms from a dependency's latest checkout.
• Contributor guide: explicitly route project-license changes to the OSS policy and relevant canonical documents.
• Release procedure: add the immutable COPYRIGHT link to the footer example and update the references to two URLs. The release policy already delegates footer conventions to the OSS policy; this adoption needs no release-policy version bump or automation change.
• Active roadmap handoffs: update or supersede still-operative old-footer directions in the implementation record with a link to the canonical release procedure. Preserve historical completion evidence.
• Licensing files: preserve the already-aligned grant and text. Restoring LICENSE's final newline is optional mechanical alignment, not a substantive correction or new release gate. Obtain any needed standard license texts from their public publishers; no additional license collection is needed.

Preserved Scope

This adoption documents an existing author-selected grant; it does not make a new licensing decision. It changes no dependencies, application architecture, runtime code, or release machinery. Preserve agent commit rules, the settled House Format interpretation of upstream notice links, and existing source-release completion and asynchronous delivery behavior.

There is no new publication-time network check, approval gate, scanner, SBOM, source bundle, downloadable license asset, or modified-dependency rebuild exercise. Concrete exceptions continue to receive the treatment specified by the adopted OSS policy; the house format is not a universal legal-sufficiency guarantee.

Release And Historical Treatment

Apply navigation changes prospectively. Do not rewrite published notes, tags, binaries, checksums, or hosted release bodies to retrofit them. The next release note should explain the maintainer-selected change to GPL-3.0-or-later and link to the canonical grant. Policy adoption does not alter historical grants. Version selection and publication remain separate preparation work under the release policy.

Completion Criteria

• The two updated policies identify the selected base versions and actual adoption date, preserving local customizations and settled scope.
• Current project-license descriptions agree with COPYRIGHT; documentation distinguishes the grant, complete text, and upstream attribution.
• The release procedure and active handoffs agree on the three-link footer, with hosted-body reuse and publication behavior unchanged.
• Affected local links and candidate footer paths are verified against the repository. Future release tags need not resolve online before publication; this is ordinary documentation review, not a new release gate.
• The final diff contains only the agreed documentation changes and any chosen newline normalization, not changes to published history or dependency grants. Content, link, and diff checks suffice; runtime tests are unnecessary for this documentation-only adoption.

There are no unresolved policy choices for this scope.