Publish permanent licensing posture and advisory DCO check - #1337
Conversation
Signed-off-by: Chris0Jeky <jeky.tck@gmail.com>
Signed-off-by: Chris0Jeky <jeky.tck@gmail.com>
Signed-off-by: Chris0Jeky <jeky.tck@gmail.com>
Signed-off-by: Chris0Jeky <jeky.tck@gmail.com>
Self-review — FULL tier, pass 1Reviewed the complete 19-file diff against Findings: no actionable CRITICAL, HIGH, MEDIUM, or LOW findings. Checks performed during review:
Residual risks / unverified:
This PR remains NEVER MERGE TONIGHT because it changes required CI/workflow conventions and project files and has maintainer-owned legal/trademark decisions. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a Developer Certificate of Origin (DCO) policy in CONTRIBUTING.md and establishes a clear licensing commitment in LICENSING.md, confirming the permanent free-core boundary under the MIT license. Additionally, it updates project metadata across backend (.csproj) and frontend (package.json) files to explicitly declare the MIT license. The review feedback suggests standardizing the spelling of "license" (US spelling) instead of "licence" (UK spelling) across the newly added documentation files for consistency.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Signed-off-by: Chris0Jeky <jeky.tck@gmail.com>
Review fix evidence — Gemini round 1
Replied to and resolved all six inline threads. The push triggered a fresh CI/bot round; those checks are pending. The earlier self-review comment counted four commits before this batched review-fix commit; the branch now has five, all with matching DCO sign-offs. |
CI Extended failure classification — current head
|
Fixed-diff self-review —
|
Chris0Jeky
left a comment
Chris0Jeky
left a comment
There was a problem hiding this comment.
Fresh independent FULL-tier adversarial review — 4ae430dd05b2a4314bc1a9cc76f57f28fe0fe9cf
Findings: no actionable CRITICAL, HIGH, MEDIUM, or LOW findings at this exact head.
Scope and evidence
- Reviewed the complete 19-file / 128-insertion diff against base
68f218cf, issue #1299, and the licensing boundary on the #1296 branch. - Licensing wording matches that boundary: existing MIT grants are permanent; future commercial work is additive and separately licensed; the core capture → proposal → review → apply loop, export/portability, BYO-key/local-LLM use, and single-user self-hosting remain free; already-free MFA, OIDC, and board sharing remain free.
- Root
LICENSEis byte-identical at base and head (same Git blob8924315e…).ee/contains onlyee/LICENSE, which excludes the reserved path from the root grant and contains no product code. - All 11
*.csprojfiles contain exactly onePackageLicenseExpression=MIT;frontend/taskdeck-web/package.jsonand its lockfile both carry the MIT root-package metadata. The existing VS Code package metadata was already MIT. README and Testing Guide links/wording are coherent. - All five PR commits have a matching author/committer
Signed-off-by:trailer.
DCO workflow / upstream provenance
KineticCafe/actions-dcorelease v3.1.0 is a lightweight tag resolving exactly to1da04282bbf757dab7d92a5c8535dbfb8113da5c, matching the full-length immutable pin in this PR.- The pinned action runs on Node 24, receives only
contents: read,pull-requests: read, and implicit metadata read, does not check out PR code, and runs only forpull_request. Job-levelcontinue-on-error: truekeeps this rollout advisory while leaving the DCO job visible. - Exact-head job DCO (advisory) downloaded that exact SHA, reported
KineticCafe/dco-check 3.1.0, evaluated the comparison, and passed. - Provenance caveat: GitHub reports the pinned upstream commit as unsigned/unverified. The tag→SHA mapping and release provenance are confirmed, but I did not independently reproduce the bundled
dist/dco_check.cjsbuild. - Rollout caveat: upstream defaults skip merge commits and bot-authored commits; a deliberately unsigned human commit/remediation path was not exercised here. The PR already leaves bot/remediation behavior for the advisory observation week before #1173 enforcement.
Comments, checks, and closing linkage
- Audited 4 conversation comments, 7 review submissions, and 12 inline comments forming 6 review threads. All six Gemini MEDIUM spelling threads were fixed in
4ae430dd, replied to, and resolved. Unresolved review threads: 0. gh pr checks: 21/21 pass, 0 failed, 0 pending. Required CI run 29222076085 and CodeQL run 29222074686 completed successfully, including E2E.- Merge blocker remains: CI Extended run 29222076073 ended in
startup_failurewith zero jobs. Its exact annotation saysci-extended.ymlcalls reusable Gitleaks requestingpull-requests: readwhile the caller allowsnone. This is the systemic, independently reproduced defect tracked by Priority I #1330; it is not flaky and this PR must not merge while it remains failed. - GitHub reports exactly one closing reference: #1299. No other issue is linked for closure.
Verification and residual gates
- Passed:
git diff --check 68f218cf...4ae430dd; root-license blob comparison; exact-head tree/metadata enumeration; five-commit sign-off audit; upstream tag/commit/release inspection; full comment/thread audit; live exact-head check/run audit. - Not performed: the HUMAN-ONLY Taskdeck trademark/domain/package-namespace search. No USPTO, EUIPO, domain, npm, NuGet, or Docker Hub availability query was made.
- Maintainer approval of the MIT-forever/free-boundary/commercial-module/trademark wording remains required. This review is technical/process review, not legal advice.
- I did not approve or merge. The draft remains blocked by #1330 plus the maintainer-only licensing and trademark gates.
Resolves two conflicts that both came from main moving under this branch:
- README.md: the branch still carried the SUPERSEDED archive framing ('Personal
Project ... will be archived once it is finished'), which ADR-0044 replaced
with the revival direction. Took main's structure wholesale and dropped that
section. Main already has a 'License and security' section whose text says the
complete licensing posture 'is the v0.1 REVIVAL-03 deliverable' -- a forward
reference to this PR -- so it now points at LICENSING.md instead of promising
it, which is the only edit this branch still needs there.
- docs/TESTING_GUIDE.md: Last Updated date only; took main's (2026-07-14).
No licensing text was changed by this merge. LICENSING.md, ee/LICENSE, the DCO
job, and the MIT package metadata are exactly as reviewed.
Rebased onto current
|
| file | resolution |
|---|---|
docs/TESTING_GUIDE.md |
Last Updated date only — took main's 2026-07-14. |
README.md |
Substantive. The branch still carried the superseded archive framing — "Taskdeck is built for the maintainer's personal use and will be archived once it is finished" — which ADR-0044 replaced. Took main's structure wholesale and dropped that section. |
The README resolution turned out neatly: main's License and security section already said
"the complete licensing posture is the v0.1 REVIVAL-03 deliverable"
— a forward reference to this PR. It now points at LICENSING.md instead of promising it, which was the only edit this branch still needed there.
No licensing text was touched by the merge. Verified after: LICENSING.md, ee/LICENSE and CONTRIBUTING.md present; the root LICENSE is byte-identical to main (git diff origin/main HEAD -- LICENSE empty); MIT metadata still declared across all 11 .csproj files.
Your two gates
1. Trademark clearance — the research is now done and it is on #1299. Headline: no registered TASKDECK mark exists anywhere (control-validated zeros at USPTO, TMview covering EUIPO/UK/US/~89 offices, and WIPO — each re-run with a known-hit control so a broken query could not masquerade as a clean result). Every package namespace you ship through is free.
But three live products already use the exact name — including tasksdeck.com, "TaskDeck — AI Task Generator for Developers", which is essentially our own pitch under our own name — and the real risk is registrability, not collision: TASK is near-descriptive and 507 GB+EU marks contain "deck" in Class 9/42. Plus TASKADE holds a live, now-incontestable US Class 42 registration expressly covering task management.
Verdict there: proceed-with-precautions — fine for a free MIT beta, poor to build a business on. Which is roughly what this PR already commits to.
Caveat that matters for this PR specifically: UKIPO's own register hard-blocked automated access, so all GB coverage is indirect via TMview, which EUIPO states is not an official register.
2. The wording. LICENSING.md's MIT-forever, free-boundary and additive-only commercial language is a public, permanent commitment. That is yours to sign off, not mine to infer — it is the one thing in this queue I deliberately did not decide for you.
Recommendation
The research supports proceeding under this name for the beta. If the wording reads right to you, this is mergeable now. If you would rather settle the keep-or-rename question first, do it before v0.1.0 (#1303) — renaming is nearly free today and expensive after a tagged release, and this PR is what makes the name a published commitment.
I can merge it the moment you say the wording is good.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ed43faa08b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ## License and security | ||
|
|
||
| Taskdeck is released under the [MIT License](LICENSE). The revival commitment is that code already shipped under MIT stays MIT; the complete licensing posture is the v0.1 [REVIVAL-03](https://github.com/Chris0Jeky/Taskdeck/issues/1299) deliverable. | ||
| Taskdeck is released under the [MIT License](LICENSE). The permanent free-core boundary, the MIT-forever commitment for code already shipped, and the additive-only posture for any future commercial module are documented in [LICENSING.md](LICENSING.md) (REVIVAL-03, [#1299](https://github.com/Chris0Jeky/Taskdeck/issues/1299)). |
There was a problem hiding this comment.
When this commit lands, it publishes the licensing pack and activates the advisory DCO job, but docs/IMPLEMENTATION_MASTERPLAN.md:152 still says the licensing pack is “NOT merged,” while docs/STATUS.md:26 continues to describe the entire pack as a hold instead of separating the delivered implementation from the outstanding human-only trademark clearance. Update both canonical documents in this change so shipped reality and the remaining gate are unambiguous.
AGENTS.md reference: AGENTS.md:L116-L118
Useful? React with 👍 / 👎.
| pull-requests: read | ||
| steps: | ||
| - name: Check commit sign-offs | ||
| uses: KineticCafe/actions-dco@1da04282bbf757dab7d92a5c8535dbfb8113da5c # v3.1.0 |
There was a problem hiding this comment.
Once this PR-only job runs from main, README.md:169 will still tell contributors that the DCO check is not active until REVIVAL-03 lands, and line 13 continues to present the commitment and gate as future work. That directly contradicts this newly active advisory check and the published LICENSING.md; update those pre-landing passages as part of this rollout.
Useful? React with 👍 / 👎.
| - `dco` | ||
| - Checks every pull-request commit for a DCO `Signed-off-by:` trailer with the | ||
| SHA-pinned `KineticCafe/actions-dco` action | ||
| - **Advisory** through the first rollout week, targeted to end 2026-07-20 |
There was a problem hiding this comment.
This commit is dated 2026-07-25, so the newly added check is being introduced five days after the documented 2026-07-20 end of its “initial” advisory week. Because the workflow sets continue-on-error: true without any time-based transition, it will remain advisory indefinitely until another code/settings change despite this text implying that the observation window has ended; base the date on actual activation or describe the rollout as manually gated without an expired deadline.
Useful? React with 👍 / 👎.
| Every commit must include a `Signed-off-by:` trailer certifying the | ||
| [Developer Certificate of Origin 1.1](https://developercertificate.org/). | ||
| Create the trailer from your configured Git name and email with `-s`: |
There was a problem hiding this comment.
Automated contributors are routed to AGENTS.md by README.md:171, but AGENTS.md:85, .codex/skills/taskdeck-worktree-issue-worker/SKILL.md:44, and the batch orchestrator at line 69 still instruct agents to commit with --no-gpg-sign without adding -s/--signoff. Agents following these authoritative paths will keep producing unsigned commits and trip the DCO check once it is enforced; update the automated and mirrored worker instructions to add sign-off while retaining the separate no-GPG behavior.
AGENTS.md reference: AGENTS.md:L49-L51
Useful? React with 👍 / 👎.
Summary
ee/with an explicit separately licensed placeholderCloses #1299
Implementation notes
LICENSEis intentionally unchanged.LICENSING.mdpreserves every existing MIT grant, defines the never-gated free boundary, and keeps any future commercial capability additive and separately licensed.1da04282bbf757dab7d92a5c8535dbfb8113da5c.continue-on-error: true; branch-protection promotion remains maintainer-owned under Register the three required security-scan check contexts in branch protection (#1132 follow-up) #1173.Signed-off-by:trailer.Verification
node scripts/check-docs-governance.mjs— passed.github/workflows/ci-required.yml— passed*.csprojfiles and verified exactly onePackageLicenseExpression=MIT— passedpackage.json/package-lock.jsonand verifiedlicense=MIT— passeddotnet restore backend/Taskdeck.sln— passeddotnet build backend/Taskdeck.sln -c Release --no-restore— passed (0 errors; 12 pre-existing warnings)dotnet test backend/Taskdeck.sln -c Release -m:1 --no-build— passed: 6,823 passed, 0 failed, 1 pre-existing INV-09 skipnpm run typecheck— passednpm run build— passednpx vitest --run— passed: 297 files / 3,756 testsgit diff --check origin/main...HEAD— passedLICENSEdiff againstorigin/main— emptyDocs impact
LICENSING.md.CONTRIBUTING.md,README.md, and the DCO entry indocs/TESTING_GUIDE.md.docs/STATUS.mdanddocs/IMPLEMENTATION_MASTERPLAN.mdare intentionally untouched; direction changes land through maintainer-owned docs: revival pivot (ADR-0044) - open-beta direction, REVIVAL_PLAN spine, canonical doc sync #1296/docs: generalist expansion wave (ADR-0046) - REVIVAL_PLAN Phase 4, artefact intake + dossiers + generalist reach, twin-app deferral #1328 and shipped-reality rehydration belongs after merge.Human-only / maintainer decisions
Merge status and residual risk
NEVER MERGE TONIGHT. This PR changes the required CI workflow and every .NET project file, requires maintainer licensing-wording approval, and retains the human-only trademark gate. It must receive the FULL review/bot/CI process and maintainer approval.
Residual risks: legal wording is project policy, not legal advice; bot/remediation behavior still needs live PR evidence from the new DCO job; the trademark boundary makes no availability or registration claim.