Skip to content

SOP-034 — License scan

Guide

<!-- last-reviewed: 2026-06-01 · owner: Legal & Compliance (Compliance Analyst) -->

SOP-034 — License scan

SOP · owner: Legal & Compliance (Compliance Analyst). Layer: SOP/Runbook (docs/canon.md). Procedure for scanning dependency licenses and producing the evidence the Legal Director’s audit (SOP-031 (docs/sop/SOP-031-license-audit.md)) consumes.

Interface Contract

  • Inputs: scan request / dependency-change notice ← from Legal Director · trigger: “audit requested”
  • Outputs: license scan result → to Legal Director · trigger: “scan complete”
  • Outputs: non-permissive-license question + evidence → to Legal Director · trigger: “escalation requested”
  • Handoff trigger (in): the Legal Director requests a license scan, or a dependency is added/removed/changed
  • Handoff trigger (out): every dependency has a recorded SPDX classification with a cited source+date, and any non-permissive license is flagged to the Legal Director
  • Definition of Done before handoff:
    • [ ] Every direct dependency scanned; transitive coverage attempted and noted
    • [ ] Each entry: package · version · SPDX ID · category · source citation + date
    • [ ] Any non-permissive license (GPL/AGPL/LGPL/MPL/unclear) flagged, not assessed
    • [ ] Result handed to the Legal Director; learnings captured if any

Trigger note. audit requested, scan complete, escalation requested are registered verbatim phrases (Wave 1 additions, Operations-approved 2026-06-01); phrasing mirrors SOP-031/033 verbatim so the register reconciles green.

Purpose

Produce verifiable, dated license evidence for every dependency so the Legal Director’s audit rests on a citable file rather than an assumption. Confirm or refute the working claim that the tree is clean of copyleft.

When to use

On a Legal Director scan request (audit requested) or when a dependency changes. As of 2026-06-01 no scan artifact exists; direct deps read MIT/Apache-2.0 from package.json, but transitive licenses are unscanned.

Flow

flowchart LR
  A["List deps<br/>(package.json tree)"] --> B["Read each license<br/>(installed + upstream)"]
  B --> C["Assign SPDX +<br/>category, cite + date"]
  C --> D{"Non-permissive<br/>or unclear?"}
  D -->|yes| E["Flag to Legal Director<br/>(escalation requested)"]
  D -->|no| F["Record clean"]
  E --> G["Hand result<br/>→ Legal Director"]
  F --> G
  classDef s fill:#1d4ed8,color:#fff,stroke:#1e3a8a
  classDef d fill:#0f766e,color:#fff,stroke:#134e4a
  class A,B,C,E,F,G s
  class D d

Text fallback: list every dependency from the package.json tree → read each one’s license (installed node_modules/*/package.json license field plus the upstream LICENSE) → assign an SPDX ID and category with a cited source and date → if a license is non-permissive or unclear, flag it to the Legal Director with evidence; otherwise record it clean → hand the result to the Legal Director.

Steps

  1. List dependencies from intranet/package.json, db/package.json, root package.json; include transitive where the tooling allows.
  2. Read each license — the installed node_modules/<pkg>/package.json license field and the upstream LICENSE/NOTICE. Never trust a badge.
  3. Assign SPDX + category (permissive / weak copyleft / strong copyleft / commercial / unclear); cite the source file/URL and the date consulted.
  4. Flag any GPL/AGPL/LGPL/MPL/unclear to the Legal Director with evidence (escalation requested) — do not assess compatibility yourself.
  5. Hand the result to the Legal Director (scan complete); capture learnings.

Roles / approvers

Authored and run by the Compliance Analyst; compatibility interpretation and any escalation decision by the Legal Director.

Guardrails

  • Primary source only — installed metadata + upstream license text, dated.
  • No legal opinions — flag non-permissive licenses; the Legal Director judges them.
  • Label confidence: confirmed vs. inferred vs. unknown.
  • Do not edit package.json or recommend a swap in code — that is Engineering’s, via the Legal Director’s requirements issued (SOP-031).

Job aid: docs/units/legal-compliance/job-aids/JA-034-license-scan.md. See also: SOP-031 (docs/sop/SOP-031-license-audit.md) · charter (docs/units/legal-compliance/charter.md).