docs(licenses): record initial dependency license review

[josecelano]

Records the first evidence-grounded technical dependency-license review for #269.

The review retains compact inventories for the complete locked graph at its initial review snapshot (575 packages) and a runtime-oriented view (510 packages), with reproducible commands, checksums, and published-source records for non-routine declarations. It also adds the missing workspace license inheritance for workspace-coupling.

The direct runtime bloom GPL-2.0 finding is technically resolved: Issue #2114 and merged PR #2119 removed bloom and its transitive bit-vec dependency after a focused Criterion comparison found the exact-map path faster for the measured operations. The report retains the original bloom evidence for any review of releases that included it; it makes no conclusion about those releases.

No license-enforcement policy is introduced. The five LGPL-3.0 declarations and other non-routine expressions remain pending maintainer classification and qualified legal review where required.

Pending Maintainer Actions

1. For each remaining pending finding, record the package/version/license evidence, dependency kind and reachability, and which distributed artifacts include or depend on it.
2. Read the linked license and notice files, recording plainly stated notice or text-retention requirements without inferring legal compatibility from SPDX metadata.
3. Record one disposition per finding: escalate for qualified legal review, create remediation work, or propose an approval rationale after the required review is complete.
4. Obtain an explicit approval or objection from every active maintainer. A missing response remains pending; approval records the project decision and is not an individual legal opinion.
5. Create focused remediation issues for every finding that cannot be approved. Do not add automated license enforcement until an approved SPDX policy and exception process exist.

Related to #269.

[Copilot]

Pull request overview

This PR records the initial, evidence-grounded technical dependency-license review for issue #269 by adding reproducible inventories (locked graph + runtime-oriented view) and accompanying review/evidence documentation, plus closing a missing workspace license inheritance gap for the workspace-coupling crate.

Changes:

• Add initial review report (initial-review.md) and evidence ledger (evidence.md) for dependency license declarations, including reproducible commands and checksums.
• Add deterministic JSON inventories for the locked dependency graph and a runtime-oriented subset, and exclude those large JSON files from spellchecking noise.
• Ensure workspace-coupling explicitly inherits the workspace AGPL-3.0-only license via license.workspace = true.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
project-words.txt	Adds SPDX/metadata-related terms used in the new license review docs.
docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json	Adds the runtime-oriented dependency license inventory artifact.
docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json	Adds the complete locked-graph dependency license inventory artifact.
docs/issues/open/269-review-dependency-licenses/ISSUE.md	Updates the issue spec to reference and track the initial review artifacts and current status.
docs/issues/open/269-review-dependency-licenses/initial-review.md	Adds the initial technical review report (explicitly non-legal).
docs/issues/open/269-review-dependency-licenses/evidence.md	Adds the reproducible evidence ledger backing the report’s findings.
cspell.json	Excludes the large JSON inventory files from cspell scanning.
contrib/dev-tools/analysis/workspace-coupling/Cargo.toml	Makes workspace-coupling inherit the workspace license (license.workspace = true).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.99%. Comparing base (576f366) to head (493d35d).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #2113      +/-   ##
===========================================
- Coverage    83.99%   83.99%   -0.01%     
===========================================
  Files          349      349              
  Lines        26996    26996              
  Branches     26996    26996              
===========================================
- Hits         22676    22675       -1     
  Misses        3981     3981              
- Partials       339      340       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[josecelano]

Maintainer decision: defer the remaining dependency-license dispositions until the package-overhaul EPIC has defined the final package boundaries, publication status, and distributable artifacts.

The completed bloom remediation remains recorded separately. Retain the inventories and source evidence in this PR as the baseline, but do not infer approval, legal compatibility, or an enforcement policy for the remaining findings yet.

Resume the review when the extraction and distribution decisions are complete, or earlier if a package becomes externally published. At that point, regenerate the locked and runtime inventories, compare them with this snapshot, and classify the final distributed artifacts.

[da2ce7]

Reviewed at 493d35d9856aa304015ef9b479be8ba7828e270c. Recomputed from a clean checkout at that commit; every statement below is backed by a command that was run.

Recomputation of the central data claim

Regenerating the inventory with the pipeline documented in E1, against c30fbff4's tree plus this PR's workspace-coupling license line, produced a file byte-identical to locked-license-inventory.json (sha256 d61456809c69d4dbd6ada3771d39469f1491ac5cb99498068714a67418d43f3e, 575 packages). The other two recorded checksums verify as well: runtime-license-inventory.json 40b63b6192d529032ad0dec68f2463356459608f8dd0cac2cea898fd2cf1fd4c (510 packages) and Cargo.lock at c30fbff4 4fc7f17ed1d348a4500ef3772c661cda43799f5ef44fb51514386d7b408156d4. Both artifacts are sorted as documented, hold no duplicate name+version entries, and every runtime-inventory package is present in the locked inventory (0 extras).

Against the graph at this PR head the locked artifact differs by exactly two packages, bloom 0.3.2 and bit-vec 0.4.4 — the historical snapshot E8 documents. No other mismatch.

cargo deny check bans passes. cargo deny check licenses fails with 475 rejected errors, reproducing E3's observation that no allowlist is configured, which is consistent with the report's decision not to introduce enforcement here.

Staleness

git merge-tree --write-tree against develop 89d45145 merges cleanly. Of the eight touched paths only project-words.txt has develop commits since this head (12), and it merges without conflict; cspell.json, the issue folder and the workspace-coupling manifest have none. workspace-coupling still declares no license at develop, so the E6 fix is still needed and still applies: a cargo metadata run at 89d45145 reports it as the only package missing a declaration.

Recomputing the inventory at 89d45145: 575 packages, 26 entries differ from the snapshot — bloom/bit-vec removed, ten version bumps, plus nix 0.31.3 (MIT) and zlib-rs 0.6.7 (Zlib). The set of copyleft, CDLA and conjunctive declarations at develop is identical to the snapshot minus bloom; no new non-routine declaration has appeared. The findings still hold.

CI and linters

The five workflow runs at 493d35d9856aa304015ef9b479be8ba7828e270c are all completed success and all have jobs, so no run is a silent startup_failure; Docker E2E and the publish jobs are skipping.

linter all exits 1 locally on 195 local Markdown link errors, but the merge base 576f3668 produces the same 195 errors and none of them is in this PR's files — lychee goes from 1976 to 2031 checked links with the error count unchanged. Pre-existing, not introduced here.

Non-blocking follow-ups

Four inline notes: one gap in the conjunctive-expression finding, and three precision points. One further item has no line in this diff to attach to: cargo deny emits three parse-error warnings for the deprecated SPDX identifier LGPL-3.0 — openmetrics-parser 0.4.4, and the workspace's own packages/tracker-client/Cargo.toml and packages/rest-api-client/Cargo.toml. The deprecated identifier is ambiguous between LGPL-3.0-only and LGPL-3.0-or-later; the two in-repo declarations are the project's own to disambiguate, and that fact belongs in the LGPL findings.

None of this blocks the record. The inventories reproduce exactly, the technical conclusions still hold against current develop, merging fixes the only package missing a license declaration, and the deferral recorded on this PR treats the inventories as the baseline to compare against later.

[da2ce7]

Suggestion — this row is incomplete for its own category. brotli 8.0.4 (BSD-3-Clause AND MIT) and matchit 0.8.4 (MIT AND BSD-3-Clause) are conjunctive declarations that appear in both retained inventories, so both are runtime-reachable, and neither name occurs anywhere in this report or in evidence.md. Filtering the locked inventory for AND returns exactly seven packages: the five listed here plus these two. The protocol above puts conjunctive declarations in scope, so either add them to this finding or state why an all-permissive AND is treated as routine.

[da2ce7]

Nit — cargo metadata --locked at c30fbff4 alone does not reproduce locked-license-inventory.json: that tree declares no license for workspace-coupling, so it resolves to NOASSERTION and the checksum differs. The artifact reproduces byte-for-byte only against c30fbff4 plus the license.workspace = true change this PR makes. E6 records that sequence, but a future reviewer starting from this frontmatter alone will not reach the recorded checksum. Consider stating the input as c30fbff4 with this PR's workspace-coupling change applied.

[da2ce7]

Nit — E8 is placed between E5 and E6, so the ledger reads E1–E5, E8, E6, E7. E8 is the later record that closes the E4/E5 finding; moving it after E7, or adding a forward pointer at E5, keeps the ledger readable in order.

[da2ce7]

Nit — this entry omits the HH:MM UTC component that every other changelog line carries, and the frontmatter last-updated-utc still reads 2026-08-28 11:10 although this commit rewrites the task table, the manual-verification table and the acceptance table. docs/skills/semantic-skill-link-convention.md lists last-updated-utc among the required issue-spec fields.

[da2ce7]

ACK 493d35d — docs-only license baseline: all three recorded checksums reproduce (the locked inventory byte-identically), the PR merges cleanly with develop 89d4514, and its findings still hold there.