oss-license-governance

name	oss-license-governance
description	Use when changing Apache-2.0 licensing, SPDX/REUSE coverage, package license metadata, or third-party notice generation across consent-protocol and hushh-research.

Hussh OSS License Governance Skill

Purpose and Trigger

• Primary scope: oss-license-governance-intake
• Trigger on Apache-2.0 transition work, LICENSE or NOTICE updates, SPDX/REUSE coverage, package license metadata changes, or third-party notice inventory generation.
• Avoid overlap with docs-governance, repo-operations, and backend.

Coverage and Ownership

• Role: owner
• Owner family: oss-license-governance

Owned repo surfaces:

1. LICENSE
2. LICENSES
3. NOTICE
4. REUSE.toml
5. THIRD_PARTY_NOTICES.md
6. consent-protocol/LICENSE
7. consent-protocol/NOTICE
8. consent-protocol/THIRD_PARTY_NOTICES.md
9. scripts/licenses
10. .codex/skills/oss-license-governance

Non-owned surfaces:

1. docs-governance
2. repo-operations
3. backend
4. frontend
5. subtree-upstream-governance

Do Use

1. Apache-2.0 license-surface changes across root and subtree.
2. SPDX/REUSE coverage and notice-generation policy.
3. Package-manifest license cleanup for first-party published packages.
4. Third-party notice inventory generation and verification.

Do Not Use

1. Generic docs-home placement work.
2. CI/deploy operations work unless the issue is license-gate specific.
3. Broad backend or frontend implementation that only incidentally touches licensed files.

Read First

1. LICENSE
2. NOTICE
3. REUSE.toml
4. consent-protocol/pyproject.toml
5. hushh-webapp/package.json
6. packages/hushh-mcp/package.json

Workflow

1. Keep Apache-2.0 as the first-party default across root and subtree unless an explicit exception is documented.
2. Keep NOTICE, REUSE coverage, and third-party inventories aligned in the same change.
3. Treat package-manifest license drift as a release blocker for public packages.
4. Generate notice artifacts from real lockfiles and dependency metadata rather than hand-editing lists.
5. Run a second verification pass after editing the license surface.
6. For root plus subtree licensing changes, run a third check from the canonical repo entrypoint before closing the work.

Handoff Rules

1. If the task is broader repo governance, use repo-operations.
2. If the task is documentation-home governance, use docs-governance.
3. If the task is subtree routing or optional-mirror sync policy, use subtree-upstream-governance.
4. If the task is package-runtime behavior beyond the license surface, use backend or frontend.

Required Checks

python3 scripts/licenses/verify_apache_surface.py
python3 scripts/licenses/generate_third_party_notices.py
./bin/hushh docs verify