license-compliance-borrow-check

license-compliance-borrow-check

When to use

• Before adapting, porting, or otherwise consciously reusing an algorithm, a non-trivial structure, or more than roughly ten lines of logic shape from a source you can name (a repo, a gist, a Stack Overflow answer).
• The code-provenance rule fired and its step 3 ("check license compatibility") needs a concrete answer.
• A reviewer or the origin: uncertain self-flag surfaces a borrow that was never checked.

Do NOT use when:

• No conscious borrow happened — a well-known, unpatentable algorithm shape (a for-loop, a hash map) implemented with no specific source in mind.
• The borrow is already ledgered with a valid entry — use license-compliance-credits to regenerate notices instead.
• You want a broad similarity scan across the repo, not one source — use license-compliance-audit.

A passing verdict is not a copying clearance

This skill answers ONE question: is the source's license compatible with this repo's license, under the derived compatibility policy? An allow verdict means the license permits the reuse — it says nothing about whether the code-provenance discipline (read, close the source, re-derive against house standards) was actually followed. License-clean code that is still a verbatim copy is still a violation of that rule. Run both checks; treat neither as a substitute for the other.

Procedure

1. Identify the source — the URL or repo path being borrowed from, and the exact commit or blob SHA the snippet was taken from (git log -1 --format=%H -- <path> on the source repo, or the URL's own commit ref).
2. Detect the source's license. Check, in order: a LICENSE/ LICENSE.md/COPYING file at the source repo root; the source's package.json "license" field; its composer.json "license" field; an SPDX header comment in the file itself. If none resolve to a known SPDX id, the license is unknown — never guess permissive.
3. Detect this repo's target policy. Run:

   npx tsx node_modules/@event4u/agent-config/src/scripts/detect_target_license.ts . --json
   

   If license-policy.yaml exists at the repo root, read its policy.{allow,conditional,deny} buckets directly. If it does not (dry run only), derive the same buckets by hand from this repo's own LICENSE file and the compatibility matrix in node_modules/@event4u/agent-config/src/scripts/_lib/detect_target_license.ts (COMPATIBILITY_MATRIX/classifyBorrow).
4. Classify the borrow. Map the source's SPDX id to its source class (permissive / weak-copyleft / gpl-2.0 / gpl-3.0 / agpl / sspl / unknown), then read the verdict off the target's policy buckets: allow, conditional (escalate), or deny. A source license of unknown is always deny — no exception.
5. Act on the verdict:
   • allow → continue to step 6 (draft the ledger entry).
   • conditional → STOP. Do not write the borrowed code yet. Escalate to the user with the exact matrix cell that triggered it (per ask-when-uncertain) — never auto-clear a conditional verdict.
   • deny → refuse the borrow. Name the alternative: write it from scratch, find a permissively-licensed equivalent, or ask the maintainer for an explicit, recorded exception.
6. Draft the ledger entry — one JSON object matching node_modules/@event4u/agent-config/src/scripts/schemas/provenance-borrow.schema.json (source_url, license, source_sha, borrowed_at, files, transformation_note, cleared_by). Write a transformation_note that names a real structural change — rename-only phrasing (e.g. "renamed variables", "cosmetic rename") is rejected by lint_provenance.ts even if the code has not landed yet, so draft it honestly against what will actually change.
7. Present the draft to the user before appending it. Once the re-derived code lands, append the confirmed entry to provenance/borrows.jsonl and verify:

   npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts
   

   Exit 0 confirms the entry is schema-valid, license-compliant, and its transformation note passed the rename-only phrase check.