Skip to content

SOP-031 — License audit (dependency licensing review)

Guide

<!-- last-reviewed: 2026-06-01 · owner: Legal & Compliance (Legal Director) -->

SOP-031 — License audit (dependency licensing review)

SOP · owner: Legal & Compliance (Legal Director). Layer: SOP/Runbook (docs/canon.md). Procedure for auditing OSS/commercial dependency licensing and maintaining docs/legal/license-inventory.md. Member-level evidence comes from SOP-034 (docs/sop/SOP-034-license-scan.md) (Compliance Analyst).

Interface Contract

  • Inputs: dependency-change notice ← from <dependency-change producer> · trigger: “dependency changed”
  • Inputs: license scan result ← from Compliance Analyst · trigger: “scan complete”
  • Inputs: non-permissive-license question + evidence ← from Compliance Analyst · trigger: “escalation requested”
  • Outputs: scan request / dependency-change notice → to Compliance Analyst · trigger: “audit requested”
  • Outputs: licensing requirements/constraints → to Engineering Director · trigger: “requirements issued”
  • Outputs: approved license inventory → to Archivist · trigger: “artifact approved”
  • Handoff trigger (in): a dependency is added/removed/changed, or a periodic audit is due
  • Handoff trigger (out): the inventory is updated, any flagged dependency has a named alternative, and high-risk items are escalated to the Principal
  • Definition of Done before handoff:
    • [ ] Every direct dependency in the package.json tree classified by SPDX ID
    • [ ] Any copyleft (GPL/AGPL/LGPL/MPL) or unclear license flagged with a named alternative
    • [ ] docs/legal/license-inventory.md updated and Principal-approved
    • [ ] High-risk findings escalated to the Principal with a remediation path
    • [ ] Learnings captured to docs/knowledge/ if the audit surfaced one

Trigger note. dependency changed, scan complete, requirements issued, audit requested, and escalation requested are registered verbatim phrases (Wave 1 additions, Operations-approved 2026-06-01) in docs/handoff-triggers.md — draw from the registry, do not invent inline (interface-contract-spec.md §3.1).

Purpose

Keep an accurate, dated, defensible record of every dependency’s license so the Principal’s intended use (private platform, no source redistribution, output: 'hybrid' networked context) is never silently violated by an incompatible license.

When to use

When the Engineering Director adds/removes/changes a dependency (dependency changed), on a periodic refresh, or when any licensing question is raised. As of 2026-06-01 docs/legal/license-inventory.md does not exist — the first run creates it.

Flow

flowchart LR
  A["Inventory<br/>package.json tree"] --> B["Classify by SPDX"]
  B --> C["Assess vs.<br/>intended use"]
  C --> D{"Copyleft /<br/>unclear?"}
  D -->|yes| E["Flag + name<br/>alternative → Eng"]
  D -->|no| F["Mark clean"]
  E --> G["Update inventory<br/>→ Principal → Archivist"]
  F --> G
  classDef s fill:#1d4ed8,color:#fff,stroke:#1e3a8a
  classDef d fill:#0f766e,color:#fff,stroke:#134e4a
  class A,B,C,E,F,G s
  class D d

Text fallback: inventory the package.json tree → classify each dep by SPDX → assess against intended use → if a dep is copyleft or unclear, flag it and name a concrete alternative for Engineering; otherwise mark it clean → update the inventory, route to the Principal for approval, then to the Archivist.

Steps

  1. Inventory. Read intranet/package.json, db/package.json, root package.json; extract every direct and notable transitive dependency. Commission the Compliance Analyst’s scan (SOP-034 (docs/sop/SOP-034-license-scan.md)) for transitive coverage.
  2. Classify. Assign each an SPDX ID; categorize permissive / weak copyleft / strong copyleft / commercial / unclear. (Baseline 2026-06-01: direct deps are MIT/Apache-2.0 — see the Phase 0 review.)
  3. Assess compatibility against the intended use; specifically flag any AGPL in the networked-service context.
  4. Flag unclear cases (non-SPDX, dual, custom) for deeper review — not automatic blockers.
  5. Produce findings: (a) clean, (b) flagged + alternative, © unclear/follow-up.
  6. Update docs/legal/license-inventory.md, route to Principal, then Archivist.

Roles / approvers

Authored and run by the Legal Director; evidence from the Compliance Analyst; implementation of any swap by the Engineering Director; inventory approved by the Principal (direct-report unit, per documentation-program §7 / charter).

Guardrails

  • Read the actual license text, not a badge or summary.
  • No product code — issue constraints to Engineering; they implement the swap.
  • Do not restate docs/canon.md or the JD here — link to them.
  • Escalate high-risk findings to the Principal immediately, not at next review.

Job aid: docs/units/legal-compliance/job-aids/JA-031-license-audit-triage.md. See also: SOP-034 (docs/sop/SOP-034-license-scan.md) · charter (docs/units/legal-compliance/charter.md) · docs/legal/license-inventory.md (to be created).