Enforce public-domain/free-licence provenance gates #109

New issue

Closed

opened 2026-07-01 00:54:18 +00:00 by manlycucumber · 1 comment

manlycucumber commented

2026-07-01 00:54:18 +00:00

(Migrated from github.com)

Problem

Only public-domain or freely-licensed text may enter the corpus. The pipeline must reject strings without acceptable provenance to avoid licence contamination.

Acceptance criteria

An allowlist of acceptable licences is defined
Strings with disallowed or missing provenance are rejected
A provenance report is produced per build
CI fails on any disallowed string

Notes

This gate protects the whole platform's licensing posture.

## Problem Only public-domain or freely-licensed text may enter the corpus. The pipeline must reject strings without acceptable provenance to avoid licence contamination. ## Acceptance criteria - [ ] An allowlist of acceptable licences is defined - [ ] Strings with disallowed or missing provenance are rejected - [ ] A provenance report is produced per build - [ ] CI fails on any disallowed string ## Notes This gate protects the whole platform's licensing posture.

manlycucumber commented

2026-08-05 19:53:38 +00:00

Owner

Done. The gate is tools/generator/src/provenance.mjs, build-time and fail-closed:

0a1c00f — the original born-cited gate and CC0 corpus licensing
9d96cc9 — generalized from a name-only allowlist to office/text leaves (Stage 0.4a)
d073227 — enforce the key:locator scan-locator on text-leaf citations (§4.4)

ACs: an allowlist of acceptable licences is defined ✓ — sources.yaml is the enforced registry, and a text body may cite only a kind: text / rights: public-domain source (one narrow carve-out lets an uncopyrightable name descriptor cite a reference source); strings with disallowed or missing provenance are rejected ✓ — checkProvenance throws from build.mjs; a provenance report is produced per build ✓ — each cited source with its rights and usage count, sorted by key (provenance.mjs:206); CI fails on any disallowed string ✓ — the build throws, and CI runs the build.

This is the control that keeps the clean-room enforceable rather than merely documented.

Done. The gate is `tools/generator/src/provenance.mjs`, build-time and fail-closed: - `0a1c00f` — the original born-cited gate and CC0 corpus licensing - `9d96cc9` — generalized from a name-only allowlist to office/text leaves (Stage 0.4a) - `d073227` — enforce the `key:locator` scan-locator on text-leaf citations (§4.4) ACs: an allowlist of acceptable licences is defined ✓ — `sources.yaml` is the enforced registry, and a text body may cite only a `kind: text` / `rights: public-domain` source (one narrow carve-out lets an uncopyrightable *name descriptor* cite a `reference` source); strings with disallowed or missing provenance are rejected ✓ — `checkProvenance` throws from `build.mjs`; a provenance report is produced per build ✓ — each cited source with its rights and usage count, sorted by key (`provenance.mjs:206`); CI fails on any disallowed string ✓ — the build throws, and CI runs the build. This is the control that keeps the clean-room enforceable rather than merely documented.

manlycucumber closed this issue

2026-08-05 19:53:38 +00:00

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Core#109

No description provided.

Rows
Columns