Skip to content

chore: add a standalone release license auditor - #301

Open
tisonkun wants to merge 3 commits into
apache:mainfrom
tisonkun:chore/license-auditor-agent
Open

chore: add a standalone release license auditor#301
tisonkun wants to merge 3 commits into
apache:mainfrom
tisonkun:chore/license-auditor-agent

Conversation

@tisonkun

@tisonkun tisonkun commented Sep 11, 2026

Copy link
Copy Markdown
Member

Summary

Add a standalone Codex license_auditor subagent and integrate it into release preparation and artifact review. The agent helps the release manager understand existing licensing arrangements, investigate questions, and compare practical options. It returns evidence and suggestions without modifying files; release decisions remain with the release manager and project community.

Include Markdown in the license-header check and add ASF headers to the six Markdown source files. Clarify how repository paths in the shared root LICENSE map into the published crate, preserving the existing symlinks and a single maintained source for licensing materials.

Design Notes

The agent is a project-scoped TOML file with inherited model settings, inspired by Apache Magpie's license-compliance-audit and rewritten without its setup, adopter configuration, Markdown tooling, or sibling skills.

Review actual bundled works, applicable licenses, third-party notices, and header-scan exclusions. Distinguish official source releases from third-party convenience distributions and account for Cargo packaging conventions. Explain concrete impact and maintenance costs; keep clear omissions, optional improvements, and incomplete evidence distinct. Consider generated package-specific licensing files only if actual differences between future crates justify them.

Validation

  • cargo x lint: 200 license-header checks, zero changes, conflicts, or unsupported files.
  • Generated the updated crate with cargo package --package asyncband --locked --no-verify --allow-dirty; verified LICENSE, NOTICE, and DISCLAIMER are exact regular-file copies of the shared originals and that every documented crate source path resolves.
  • Verified license terms and third-party attribution sections are unchanged, and preserved the source symlinks.
  • Native Codex role discovery and a delegated package-inspection smoke check were exercised with Codex 0.153.4.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant