license-compliance-audit

license-compliance-audit

Gate G0 (road-to-provenance-and-license-governance, Phase 0) measured both candidate similarity detectors against a frozen golden corpus and neither met the pre-registered bar for a CI gate. Council resolved (2026-07-28, Option A): no lint_code_provenance.ts in any form — not even advisory. This skill is the result of that decision: the scan capability that used to be a planned CI gate now exists only as something a human invokes deliberately, so every hit gets investigated because a human asked for it — never as a silent pipeline signal nobody reads.

When to use

• Before merging a diff that looks suspiciously similar to something you've seen elsewhere, or that a reviewer flagged.
• During a periodic self-audit (e.g. the Phase-4 "run the full pipeline on this repo" dogfood exercise).
• A reviewer or the origin: uncertain self-flag from code-provenance names a residual-class file worth a closer look.

Do NOT use when:

• You expect this to run automatically in CI — it does not, by explicit council decision; nothing here is wired into any pipeline.
• You expect a clean result to prove the code was not copied — it cannot; see the scope bound below.
• You already have a specific, known source to check against a specific license — that's license-compliance-borrow-check, a targeted one-source check, not a corpus-wide scan.

Procedure

1. Inspect available tooling. The offline layer (L-1) is always available via npx:

   npx jscpd --version
   

   The online layer (L0) is optional — check whether it is installed and reachable:

   scanoss-py --version   # or: pip show scanoss
   

   Offline-only is expected and fine in most environments; report it honestly rather than treating it as a failure.
2. Run the offline scan (L-1) against the target path or diff:

   npx jscpd <path> --min-tokens 25
   

   --min-tokens 25 is the pre-registered shipping value — the best false-positive-clean point of the S0.3 sweep (internal/bench/provenance/reports/baseline-2026-07-28.md). Read every reported clone pair as a candidate, never a verdict.
3. If L0 is reachable, run the fingerprint scan:

   scanoss-py scan <path>
   

   Only WFP fingerprints leave the machine, never raw source (privacy by construction, principle 7). If L0 is unreachable, rate-limited, or not installed, report the result as partial (offline) explicitly — never claim a full two-layer scan ran.
4. Investigate every hit manually. For each match: is the matched file already in provenance/borrows.jsonl (cleared)? Does it read like independent convergence on a common algorithm shape, or an unattributed real copy? Open both files side by side before deciding — a match id is a starting point, not a conclusion.
5. Route unresolved hits. A hit with no existing ledger entry and no independent-convergence explanation routes to license-compliance-borrow-check to classify and draft the entry. Never clear a hit yourself by simply deciding it's fine.
6. Report the scope bound alongside every result (see below) — a clean run means "nothing matched this KB/corpus at this sensitivity", never "no copying happened".