platform-pre-review

Platform Pre-Review Task (Stage 4a)

Use this skill when you are the Platform Developer executing the Stage 4a pre-review gate — after all Stage 4 build gates pass and before Stage 5 peer review starts.

Procedure

1. npm run lint (or the project's equivalent) — must exit 0.

2. The project's type-check command if one is configured (e.g. tsc --noEmit for TypeScript projects) — must exit 0.

3. Dependency vulnerability scan: npm audit --audit-level=high (or pip-audit, bundler-audit, etc. per stack). Any high or critical finding halts.

4. License compatibility check. For every new or changed direct dependency (compare package.json / requirements.txt / Cargo.toml before and after the PR), determine its declared SPDX license and classify it:

   • Allowed (record nothing): MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0, 0BSD, Unlicense, CC-BY-4.0, Python-2.0, PSF-2.0.
   • Warned (record with policy: "warned"): UNLICENSED, unknown, proprietary, SSPL-1.0, BUSL-1.1. These require a human review before merge; record in license_findings[] and add a warnings[] entry.
   • Denied (record with policy: "denied"): any GPL-2.0, GPL-3.0, LGPL-2.0, LGPL-2.1, LGPL-3.0, AGPL-3.0, or strong-copyleft variant. Copyleft licenses require distributing source and are incompatible with most commercial projects unless a legal exception is documented. A denied finding sets license_check_passed: false and adds a blockers[] entry.

   How to check:

   # Node.js — use npx if license-checker is not installed globally
   npx license-checker --direct --json 2>/dev/null | jq 'to_entries[] | {package: .key, license: .value.licenses}'
   # Python
   pip-licenses --format=json --with-license-file 2>/dev/null
   # Rust
   cargo license --json 2>/dev/null
   

   If no automated tool is available, manually inspect each new dependency's LICENSE file or package metadata. When the license field is missing or ambiguous, classify as warned.