manage-repo-licensing

Manage Repo Licensing

Encode the REUSE-style mixed-license workflow that has converged across four sibling repos (strength-model, shannon-entropy, zhang-yeung-inequality, non-shannon-inequalities). The skill is a structured companion for these rollouts: it frames policy, standardizes placement, and drives verification. It is not an automated sweeper.

Core Invariants

Every run, regardless of mode, honors these rules. They are the lessons from the four prior rollouts.

1. Policy is frozen before edits. Surface the license split, the fork-lineage question, and the reference-material scope, and wait for user confirmation before touching any file.
2. License-text filenames are normalized first. LICENSES/<SPDX-ID>.txt must match the SPDX identifier byte-for-byte (case-sensitive). Fix mis-cased filenames (APACHE-2.0.txt -> Apache-2.0.txt) before any annotation pass -- otherwise reuse lint will flag every tag.
3. Placement is decided by file type, not by repo convention. Use the standardized matrix in references/file-type-matrix.md. Existing divergence is drift to migrate.
4. REUSE.toml is the default coverage surface. Every repo ships one with at least prose, config, generated, and structural groups (plus conditional CoC and reference-material blocks). Inline SPDX is reserved for substantive source code; per-file .license sidecars are a narrow residual. Config files (Makefile, lakefile.toml, pyproject.toml, cspell-words.txt, dotfiles, YAML, JSONC) and generated artifacts (lock files, lean-toolchain, Pandoc output, regenerated JSON/ICS) both fall in REUSE.toml, not inline or sidecar.
5. Rollouts advance in small, reviewable commits. Use the ladder in references/commit-sequence.md. Do not squash.
6. reuse lint must be clean when done. Plus any repo-local checks (e.g. make lint, make check-proofs).
7. Third-party bundled reference material is covered, not excluded. It uses LicenseRef-Reference-Material (shared canonical text) with scale-tiered placement -- per-file sidecars for small curated collections (~20 or fewer), a REUSE.toml glob for larger ones. Per-work LicenseRef-* exceptions require explicit justification in NOTICE.
8. Comments live where required, nowhere else. No NOTICE.license sidecar. No *.md.license sidecars or HTML-comment SPDX inside project-authored Markdown -- both are absorbed by the REUSE.toml prose group.
9. NOTICE is a summary, not an override. Never write wording that implies every file is under one license.
10. Prose that documents SPDX syntax is a hazard. Any project-authored Markdown that contains the literal string SPDX-License-Identifier followed by a colon (or a similar tag) outside a REUSE-ignore region is parsed by reuse as a real declaration and usually corrupts the lint report. Wrap such passages in <!-- REUSE-IgnoreStart --> / <!-- REUSE-IgnoreEnd --> HTML comments. This applies to this skill's own documentation, to any plan document that describes the workflow, and to README sections that show SPDX examples. The code-block fence does not protect the content; REUSE scans code blocks.
11. Intentional deviations are data, not drift. When running against a repo that is already REUSE-compliant, compare coverage to the matrix but do not flatten deliberate policy choices. Common legitimate deviations: (a) a fork preserving upstream attribution via per-file sidecars on unmodified files, dual-copyright MIT on lockfiles, or a compound license on the README; (b) a non-default code-bucket license (for example, Apache-2.0 rather than MIT for project-authored tooling); (c) per-work LicenseRef-* exceptions with justification in NOTICE; (d) explicit prose path lists instead of globs when auditability matters more than elasticity. Surface these as candidate cleanups and wait for user direction before normalizing. The defaults in Sections 2-6 are a starting point; once a repo has a working policy, changes should be additive and policy-preserving, not flattening.