Spec · CHG-2026-014909

change_id: CHG-2026-014909
risk_class: R3
autonomy_tier: A2
controls: ['TPR-05', 'CHG-04', 'TRC-01']
data_classification: public
originator: olaf@freundcloud.com
agent_identity: svc-agent-platform
model_route: gateway/tier-balanced
supersedes: None

Requirements

R1 — Apache-2.0, and specifically not MIT

Both permit commercial use and adaptation. Apache-2.0 carries an express patent grant and a contribution clause, and that is the question an enterprise legal review asks first about a reference implementation someone wants to build on. MIT is shorter and leaves the patent position implicit; here that would trade the answer for two paragraphs of text.

The canonical text is fetched from apache.org rather than reproduced from memory, and the appendix’s [yyyy] [name of copyright owner] placeholders are filled in. A licence shipped with its template placeholders intact is a licence nobody has read.

R2 — NOTICE states what may be done, in plain terms

Apache’s appendix is legally complete and practically opaque. NOTICE says directly: fork it, adapt it, run it commercially, ship products on it — and explains why the licence choice matters here specifically, because a portability argument is worth nothing if the terms are ambiguous.

It also carries the demo-data disclaimer, so the caveat travels with the licence rather than living only in the README.

R3 — Provenance is unambiguous, and the byline is removed

The playbook is renamed to Agentic-SDLC-Playbook.md. The corporate byline, the “How X delivers this” section heading, the “(X addition)” annotation on §6.2 and the closing “Prepared by” line are removed. pyproject.toml, AGENTS.md and the README stop naming a vendor, and the attestation predicate type moves from a corporate domain to the project’s own.

The corporate address on the seeded chain’s originator becomes the author’s.

R4 — Recorded screencasts are re-recorded, never edited

site/assets/casts/control-layer.cast contains the old address, because the demo printed it during the take. The cast is re-recorded, not edited.

This is not fastidiousness. The repository’s justification for asciinema over a scripted terminal renderer is that the recording is the session rather than a reconstruction of one. A cast altered after the fact is a reconstruction — and one that is textually indistinguishable from a genuine recording, which makes it the worse kind.

R5 — SECURITY.md scopes reports honestly

The interesting report is a gate that can be made to pass on a change it should refuse, because that is a defect in the argument and not only in the code. Also in scope: a route to the default branch for the agent identity, tier escalation past the autonomy matrix, instruction-injection through content the pipeline reads, and supply-chain weaknesses in the workflows.

Out of scope, stated so nobody wastes an afternoon: findings against service/ treated as a production service. It is a fixture, and saying so is more useful than receiving the report.

It also names where the controls here are deliberately weaker than they look — enforce_admins and prevent_self_review are both off for a single maintainer — rather than waiting for someone to discover it and report it as a finding.

R6 — CONTRIBUTING.md describes this process, not a generic one

Intent before spec before plan before code, because the gates enforce exactly that and a generic guide would contradict the repository within one pull request. Includes the non-negotiables (Decimal for money, audit on state change, no personal data in logs, the frozen path, no model in a gate) and the feedback loop from REVIEW.md: a mistake found twice goes into AGENTS.md as part of that review.

Policy conflicts

None identified. Stated explicitly rather than omitted.

Considered: relicensing assumes the author is entitled to relicense. That is an assumption about facts outside the repository, recorded here as an assumption rather than presented as a finding — which is the same treatment any other unverifiable input gets.

Verification