agenthropic

ADR-0011: CD-9 — Per-artifact licensing

As-built update — 2026-07-30

Verdict: the automatable half is live and green; the project’s own license is not yet published.

What shipped. scripts/check-licenses.mjs runs as gate:licenses in CI on every push and exits non-zero on any dependency whose license falls outside an explicit allowlist (MIT, MIT-0, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, BlueOak-1.0.0, CC0-1.0, Unlicense, Python-2.0, plus a short list of documented per-package exceptions). SPDX OR expressions pass if any branch is allowlisted; AND expressions require every part to be. It currently reports OK across 412 installed packages. The allowlist that licensing.md listed under “What’s undecided” is now decided and in the repository.

The gate is also the one sanctioned exception to the no-spawner rule (ADR-0009): it shells out to pnpm licenses list --json with a fixed argv, marked inline with a spawner-gate-allow comment that the spawner gate itself recognizes. That exception is deliberate, narrow, and visible — not a hole.

The honest blocker: the repository still has no license as far as anyone can tell. A LICENSE file (MIT, © 2026 Ivan Baev) exists in the working tree but is not tracked in git. GitHub therefore reports this repository’s license as null — which means agenthropic currently sits in exactly the position this ADR condemns in cast, disler and nirdiamant: source published with no license grant, all-rights-reserved by the Berne default. The reasoning in licensing.md §2 applies to this project too, and right now it applies against it. This is a one-line fix owned by Ivan (the file must be committed); until it is, the “commercial-clean” posture of ADR-0002 is asserted but not published.

The clean-room half is still discipline, not tooling, exactly as licensing.md §6 says. Nothing built since changes that. The attribution mechanism for simple10/hoangsonww (a NOTICE file, file headers, or a credits page) remains unchosen — and remains unexercised, because the hoangsonww-attributed alert schema is post-1.0 and has not been written.

As-built update — 2026-08-15

Verdict: holds; the blocker recorded above is closed. The LICENSE file is now tracked in git, and gh api repos/IvanBBaev/agenthropic --jq .license.spdx_id returns MIT — re-verified on 2026-08-15. agenthropic no longer occupies the position it condemns in cast, disler and nirdiamant: the grant is published, not merely intended. The blocker was open for roughly one day, and it is left visible above rather than deleted, because the interesting fact is not that it was fixed but that a project whose own licensing page reasons carefully about the difference between a README badge and a real grant nearly shipped as a repository with neither.

The gate itself is unchanged and still green: check-licenses: OK (412 installed packages, all licenses allowlisted) on 2026-08-15. Two clarifications the 2026-07-30 note left loose. First, “a short list of documented per-package exceptions” is, concretely, exactly one: caniuse-lite, accepted only under CC-BY-4.0, an attribution-only data file arriving transitively through the Vite toolchain. The exception is keyed to the license string and not to the name alone, so a relicense of that package turns the gate red rather than passing it through. Second, workspace-local @agenthropic/* packages are skipped as private, so the 412 counts third-party code only.

One over-claim to retire. The 2026-07-30 note says the gate “runs as gate:licenses in CI on every push,” which is accurate, but this ADR set has elsewhere described the CD-9 gate as merge-blocking. On 2026-08-15 it was not: branch protection on main was not enabled, so a red run was a signal rather than a barrier (ADR-0009’s 2026-08-15 update recorded the same gap for the coverage gate).

As built — 2026-08-25: main is now branch-protected and requires the ci check, so a red gate:licenses run does withhold the merge button — from a contributor, and not from the repository owner, who is exempt by design (enforce_admins: false) because agenthropic has exactly one maintainer whose normal working mode is a direct push to main. See the standing correction.

The acceptance criterion — “verified by a CI provenance check” — is satisfied on its own wording either way, since verification is what the check performs; enforcement was never this ADR’s word, and should not be borrowed into it.

The clean-room half is still discipline, not tooling. Nothing has changed: no source text from any of the six audited projects has been copied in, the attribution mechanism remains unchosen, and it remains unowed.

Context

agenthropic deliberately “steals the best proven pieces” from the six audited rival projects (docs/ai/DESIGN.md §0, §7) rather than forking any one of them wholesale. That stance only survives contact with reality if licensing is treated per-artifact, not as a vibe: simple10 and hoangsonww are MIT; cast, disler, and nirdiamant carry no license file, which means they are all-rights-reserved by Berne default — the Business Analyst lens is explicit that this is a hard legal fact, “not ambiguity” (§4.4).

Decision

Per-artifact licensing, enforced by a CI provenance/license scan:

Acceptance criteria

From concept-analysis-v2.md §6 (“Product / business”):

Supporting evidence, development-plan.md WP-F6 (“License/provenance scan (CD-9)”): “A non-allowlisted dependency license makes CI red.”

Consequences

Alternatives considered

This site is open source. Improve this page.