| name | license-integrity |
| description | Maintain AlbumentationsX license, CLA, provenance notices, and packaged legal artifacts consistently. |
License Integrity
Use this skill for any change to LICENSE, CLA.md, license history,
third-party notices, package license metadata, contributor acceptance language,
or public repository license wording.
Required Context
Read these files completely before editing:
docs/maintaining/license-provenance.mdLICENSELICENSING.mdTHIRD_PARTY_NOTICES.mdCLA.mdlegal/cla/archive/MANIFEST.md- the relevant packaging, contribution, release, and public-copy files
Invariants
- Default repository SPDX expression is
AGPL-3.0-only.
- The AGPL permits commercial use subject to its terms. Do not use the words
commercial, proprietary, internal, or production as automatic license
triggers.
- Separately negotiated commercial terms grant alternative permissions only
for their stated scope. Do not promise support, warranties, maintenance, or
an SLA unless an executed agreement or order form includes it.
- Keep
LICENSE byte-identical to the complete canonical GNU AGPL version 3
text; keep the repository expression and commercial-license path in
LICENSING.md.
- Do not remove the exact legacy Albumentations 2.0.8 MIT notice or describe
the successor license as retroactive.
- CLA acceptance is version-specific. Archive every operative byte version,
record its SHA-256 identifier, and require explicit acceptance of a new
version.
- An Entity Acceptance covers only exact named legal entities and contributors
within the signer's documented authority.
- Release artifacts contain the four outbound license/provenance files and do
not contain the inbound CLA or private acceptance records.
- Build into a fresh directory outside the checkout. A source distribution
must not contain local build-output directories or nested release artifacts.
Verification
Run the focused checks first:
uv run python tools/verify_legal_integrity.py
uv run pytest -q tests/test_legal_integrity.py
artifact_dir="$(mktemp -d)"
uv build --out-dir "${artifact_dir}"
uv run python tools/verify_legal_integrity.py --artifacts "${artifact_dir}"/*.whl "${artifact_dir}"/*.tar.gz
uv run twine check "${artifact_dir}"/*
Then run the repository quality gate required by the surrounding change.
