feat(repo-health): add dependency-license-audit skill with eval suite

docs/labels-and-capabilities.md

@@ -188,6 +188,7 @@ Capabilities for every skill currently in
 | `security-issue-triage` | `capability:triage` |
 | `ci-runner-audit` | `capability:triage` |
 | `dependency-audit` | `capability:triage` |
+| `dependency-license-audit` | `capability:triage` |
 | `workflow-security-audit` | `capability:triage` |
 | `license-compliance-audit` | `capability:triage` |
 | `flaky-test-triage` | `capability:triage` |
@@ -272,7 +273,7 @@ it implements multiple contracts (e.g. `tools/gmail` provides both
 | [`tools/dev`](../tools/dev/) | `substrate:framework-dev` | Framework dev-loop helpers |
 | [`tools/egress-gateway`](../tools/egress-gateway/) | `substrate:sandbox` | Egress-allowlist forward proxy (proxy.py plugin); host-level egress chokepoint — defence-in-depth for RFC-AI-0003 §4.4 |
 | [`tools/forwarder-relay`](../tools/forwarder-relay/) | `contract:report-relay` | Adapter contract for inbound-relay backends (ASF Security relay, huntr.com, HackerOne triagers). Pure interface spec; adapters declare detection + credit-extraction + reporter-addressing rules. |
-| [`tools/bitbucket`](../tools/bitbucket/) | `contract:change-request` | Coverage: `partial-read-only`. Bitbucket Cloud and Bitbucket Data Center bridge foundation for repository metadata context, pull-request discovery/fetching, read-only commit fetching, read-only diff fetching, comments-only discussion fetching, and read-only status fetching. Remaining candidate read-only gaps include pull-request activity/review-state history, branch restrictions and permission context, Bitbucket Issues, linked Jira handoff context, and deeper Pipelines read coverage. The `partial-read-only` qualifier means this tool implements named read-only contract operations but does not satisfy the complete contract and must not be counted as a complete/selectable backend. Write operations remain out of scope until designed with explicit human-in-the-loop approval and maintainer review. `contract:tracker` remains absent until Bitbucket issue operations or linked Jira handoff coverage exist. |
+| [`tools/bitbucket`](../tools/bitbucket/) | `contract:change-request` | Coverage: `partial-read-only`. Bitbucket Cloud and Bitbucket Data Center bridge foundation for repository metadata context, pull-request discovery/fetching, read-only commit fetching, read-only diff fetching, comments-only discussion fetching, and read-only status fetching. The `partial-read-only` qualifier means this tool implements named read-only contract operations but does not satisfy the complete contract and must not be counted as a complete/selectable backend. `contract:tracker` remains absent until Bitbucket issue operations or linked Jira handoff coverage exist. |
 | [`tools/fossil`](../tools/fossil/) | `contract:tracker` + `contract:source-control` | Fossil SCM forge bridge: integrates local SQLite-backed ticket tracking, wiki, and forum reads with the version-control shim |
 | [`tools/github`](../tools/github/) | `contract:tracker` + `contract:source-control` + `contract:change-request` | GitHub REST / GraphQL tracker substrate (called by every lifecycle phase) plus the Git source-control binding documented in [`source-control.md`](../tools/github/source-control.md) (runnable backend in [`tools/vcs`](../tools/vcs/)) and the pull-request review/merge gate (`change-request`; the ASF default backend, alongside `tools/jira-patch/` and `tools/mail-patch/` for SVN-first projects) |
 | [`tools/github-body-field`](../tools/github-body-field/) | `contract:tracker` | Read or rewrite one `### Field` section of a GitHub issue body without bringing the body into agent context — substrate helper for the security-sync skills |

docs/modes.md

@@ -59,7 +59,7 @@ Autonomous* (the renamed former *Auto-merge*).
 
 | Mode | Purpose | Status | Skill count |
 |---|---|---|---|
-| **Triage** | *(Agentic Triage)* Issues, security reports, PRs: spot, classify, route, surface duplicates. Every output is a suggestion the human signs off on. | stable (security) / experimental (pr-management, issue-management, contributor-nomination, repo-health, release-management) | 33 |
+| **Triage** | *(Agentic Triage)* Issues, security reports, PRs: spot, classify, route, surface duplicates. Every output is a suggestion the human signs off on. | stable (security) / experimental (pr-management, issue-management, contributor-nomination, repo-health, release-management) | 34 |
 | **Mentoring** | *(Agentic Mentoring)* Joins issue and PR threads in a teaching register: clarifying questions, pointers to project conventions, paired examples from prior PRs, hand-off to a human when scope exceeds the agent. Also authors net-new good first issues, curates the existing backlog, and explains filed issues to newcomers to lower onboarding latency. | experimental | 7 |
 | **Drafting** | *(Agentic Drafting)* Agent drafts a fix for a well-scoped problem and opens a PR; every PR is reviewed and merged by a human committer. | stable (security-only); experimental (issue-management, audit-findings, release-management family) | 9 |
 | **Pairing** | *(Agentic Pairing)* Developer-side dev-cycle skills with mentorship intrinsic — multi-agent review pipelines, self-review and pre-flight patterns, scoped fix drafting under the developer's driver's seat. | experimental | 3 |
@@ -104,6 +104,7 @@ do not act without human review.
 | [`pr-management-quick-merge`](../skills/pr-management-quick-merge/SKILL.md) | Identify trivial, low-risk PRs in the `ready for maintainer review` queue that pass every quality gate and touch only supplementary areas (docs, changelog, translations, tests); surfaces candidates with diff summaries and the exact merge command. | experimental |
 | [`ci-runner-audit`](../skills/ci-runner-audit/SKILL.md) | Read-only audit of GitHub Actions workflow runner compatibility across one repo, an explicit set, one Apache project's repos, or the full Apache GitHub org. | experimental |
 | [`dependency-audit`](../skills/dependency-audit/SKILL.md) | Read-only dependency vulnerability audit: detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by severity, and proposes upgrades for maintainer review. | experimental |
+| [`dependency-license-audit`](../skills/dependency-license-audit/SKILL.md) | Read-only license audit of the dependency tree: resolves each dependency's declared license, classifies against the ASF three-category model (A/B/X) or a custom allowlist, and reports forbidden, binary-only (category B), and unknown-license dependencies. | experimental |
 | [`workflow-security-audit`](../skills/workflow-security-audit/SKILL.md) | Read-only GitHub Actions workflow security audit powered by `zizmor`: surfaces injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted-runner fork-secret leaks. | experimental |
 | [`license-compliance-audit`](../skills/license-compliance-audit/SKILL.md) | Read-only license-compliance audit: LICENSE presence, NOTICE completeness when required, and SPDX-header consistency across source files; proposes remedies for maintainer review. | experimental |
 | [`flaky-test-triage`](../skills/flaky-test-triage/SKILL.md) | Read-only flaky-test detection from CI run history: per-job failure-rate analysis over a configurable window, separating intermittent (flaky) from deterministic failures. | experimental |

docs/repo-health/README.md

@@ -12,6 +12,7 @@
     - [`dependency-audit` (experimental)](#dependency-audit-experimental)
     - [`license-compliance-audit` (experimental)](#license-compliance-audit-experimental)
     - [`flaky-test-triage` (experimental)](#flaky-test-triage-experimental)
+    - [`dependency-license-audit` (experimental)](#dependency-license-audit-experimental)
   - [Status](#status)
   - [Adopter contract](#adopter-contract)
   - [Cross-references](#cross-references)
@@ -134,11 +135,58 @@ SHA, job-name patterns across runs. No test code is modified.
 the audit window, the failure-rate threshold, and which test-name patterns
 to include or exclude.
 
+### `dependency-license-audit` (experimental)
+
+Resolve the license of every direct and transitive dependency and classify
+each against the project's license policy. This is distinct from the two
+existing skills: `license-compliance-audit` checks the project's own
+LICENSE, NOTICE, and SPDX headers (and excludes vendored code), and
+`dependency-audit` checks dependencies for known vulnerabilities, not
+license terms. Neither audits the licenses of the dependency tree.
+
+Checks performed:
+
+1. Detect the dependency manager(s) (reusing `dependency-audit`'s detection)
+   and enumerate direct and transitive dependencies.
+2. Resolve each dependency's declared license from ecosystem metadata
+   (`pip-licenses` / PyPI, `license-checker` for npm, `cargo-deny` or
+   `cargo license` for Rust, or `trivy` license scanning for multi-language).
+3. Classify each result against a configured policy. The default ASF policy
+   applies the three-category model: category A allowed, category B allowed in
+   binary/convenience-binary form only (not in source releases), category X
+   (copyleft such as GPL / AGPL / LGPL, and non-commercial terms) forbidden. Dependencies whose license
+   cannot be resolved are reported as unknown.
+
+Surfaces incompatible, forbidden, and unknown-license dependencies as a
+grouped report with a proposed remedy per finding (replace, remove, or
+request a relicense). Read-only; never edits a manifest or lock file.
+
+**Adopter contract**: reads `<project-config>/repo-health-config.md`
+(`dependency_license_audit`) for the policy model, explicit allow / forbid
+lists, whether to include transitive dependencies, and how to treat
+unknown-license dependencies.
+
+**Note — optional dependencies are out of scope, and that is usually fine.**
+The scan reports the resolved/installed dependency graph, so optional extras
+and feature-gated dependencies (Python extras, npm `optionalDependencies` /
+`peerDependencies`, Cargo features, Gradle `compileOnly` and feature variants,
+Maven `provided`-scope deps) are not covered unless enabled at scan time. For
+ASF adopters this is by design rather than a gap: a Category X dependency is
+prohibited only when it is *distributed* in ASF source or a convenience
+binary. An optional, non-distributed Category X dependency that merely
+supports an optional feature (or a build-time-only tool) is explicitly
+permitted, so the default scan already covers what the policy cares about. If
+a maintainer wants the full dependency inventory regardless of distribution,
+enable all extras and features (for example `uv sync --all-extras
+--all-groups`, `cargo license --all-features`) or audit a full-universe lock
+file. See the "may not be distributed" guidance in the ASF resolved-licenses
+policy: <https://www.apache.org/legal/resolved.html>.
+
 ---
 
 ## Status
 
-**Experimental.** All five skills shipped. No adopter-pilot evaluation
+**Experimental.** All six skills shipped. No adopter-pilot evaluation
 has run end-to-end yet; shape may change between framework versions.
 
 To provide pilot feedback, copy
@@ -187,6 +235,19 @@ repo_health:
     window_days: 30
     # Minimum failure rate (fraction) to flag a test as candidate flaky.
     failure_rate_threshold: 0.1
+
+  dependency_license_audit:
+    # License policy model: "asf" applies the ASF category A/B/X model;
+    # "allowlist" uses allowed_licenses only.
+    policy: asf
+    # SPDX expressions always allowed, regardless of policy.
+    allowed_licenses: [Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC]
+    # SPDX expressions always forbidden (category X).
+    forbidden_licenses: [GPL-2.0-only, GPL-3.0-only, AGPL-3.0-only, LGPL-3.0-only]
+    # Include transitive dependencies (default true).
+    include_transitive: true
+    # What to do when a dependency's license cannot be resolved: flag | ignore.
+    unknown_license_action: flag
 ```
 
 ---

docs/vendor-neutrality.md

@@ -567,15 +567,15 @@ generated block below.
 | `contract:scan-format` | ✅ | agnostic | — | vendor-neutral by construction — one spec serves every backend |
 | `contract:project-metadata` | ✅ | single-org | ASF | single-organisation capability (ASF); no vendor choice to make |
 
-**Per-skill assessment: 69/69 skills carry no vendor lock-in.** A skill is *capability-pure* when it names no backend at all, *portable* when every backend it names has an alternative (its contract is green), and *vendor-coupled* only when it reaches for a backend that is the sole implementation of a capability.
+**Per-skill assessment: 70/70 skills carry no vendor lock-in.** A skill is *capability-pure* when it names no backend at all, *portable* when every backend it names has an alternative (its contract is green), and *vendor-coupled* only when it reaches for a backend that is the sole implementation of a capability.
 
 | Skill neutrality | Count |
 |---|---|
-| capability-pure (names no backend) | 10 |
+| capability-pure (names no backend) | 11 |
 | portable (named backends are swappable) | 59 |
 | vendor-coupled (sole-backend dependency) | 0 |
 
-Organization scope (declared, orthogonal to vendor): ASF = 14, agnostic = 55.
+Organization scope (declared, orthogonal to vendor): ASF = 14, agnostic = 56.
 
 **LLM / agent-integration neutrality**
 

projects/_template/repo-health-config.md

@@ -14,8 +14,8 @@
 Per-skill switches for the repo-health audit family. Copy this file into
 your `<project-config>/` directory and fill in the `TODO` values. Skills
 in this family (`ci-runner-audit`, `workflow-security-audit`,
-`dependency-audit`, `license-compliance-audit`, and `flaky-test-triage`)
-read from this file at run time.
+`dependency-audit`, `license-compliance-audit`, `flaky-test-triage`, and
+`dependency-license-audit`) read from this file at run time.
 
 See `docs/repo-health/README.md` for a full description of each skill
 and adopter-contract details.
@@ -132,4 +132,42 @@ repo_health:
     # Job-name glob patterns to exclude (known-always-failing or skipped jobs).
     # TODO: add patterns for jobs that are legitimately unstable but not flaky.
     exclude_patterns: []
+
+  # ---------------------------------------------------------------------------
+  # dependency-license-audit — license classification of direct + transitive
+  # dependencies against a policy.  Consumed by: dependency-license-audit.
+  # ---------------------------------------------------------------------------
+  dependency_license_audit:
+
+    # License policy model.
+    #   asf       — apply the ASF three-category model (A allowed, B allowed
+    #               in binary/convenience-binary form only, X forbidden).
+    #   allowlist — allow only the SPDX expressions in allowed_licenses below.
+    # Default: asf.
+    policy: asf
+
+    # SPDX expressions always treated as allowed, regardless of policy.
+    # Override when: your project permits additional permissive licenses.
+    allowed_licenses:
+      - Apache-2.0
+      - MIT
+      - BSD-2-Clause
+      - BSD-3-Clause
+      - ISC
+
+    # SPDX expressions always treated as forbidden (ASF category X).
+    # Override when: your project has an exception for a specific dependency.
+    forbidden_licenses:
+      - GPL-2.0-only
+      - GPL-3.0-only
+      - AGPL-3.0-only
+      - LGPL-3.0-only
+
+    # Audit transitive dependencies, not just direct ones. Default: true.
+    include_transitive: true
+
+    # How to treat a dependency whose license cannot be resolved.
+    # Allowed values: flag (report as unknown), ignore.
+    # Default: flag.
+    unknown_license_action: flag
 ```