feat(release): block tagging on GPL-family or unknown artifact licences

.github/workflows/release.yml

@@ -261,6 +261,24 @@ jobs:
             exit 1
           fi
 
+      - name: Refuse external requirement sources before any environment is built
+        run: |
+          set -euo pipefail
+          # `uv run --locked` below materialises an environment, so the source
+          # allowlist and the licence adjudication have to happen first: an
+          # unreviewed requirement must never be fetched or installed to get
+          # this far.
+          python -m scripts.ci.dependency_inventory --repository-root . \
+            --output /dev/null --check-sources-only
+          python -m pip download --require-hashes -r requirements.lock \
+            --no-deps --only-binary=:all: --dest license-artifacts
+          python -m scripts.ci.dependency_inventory --repository-root . \
+            --output dependency-inventory.json --artifact-dir license-artifacts
+          python -m scripts.ci.release_license_gate \
+            --inventory dependency-inventory.json \
+            --source-sha "${TARGET_SHA}" \
+            --mode preinstall
+
       - name: Set up pinned Rust toolchain
         uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87
         with:
@@ -306,6 +324,29 @@ jobs:
             exit 1
           fi
 
+      - name: Refuse to release a GPL-family or unknown-licence artifact
+        run: |
+          set -euo pipefail
+          # The SBOM downloaded above is the artifact's own component list.
+          # It is also checked for coverage: every scope pyproject.toml
+          # declares, and every non-Python manifest that ships, must actually
+          # appear, because a partial SBOM is silence rather than evidence.
+          # A failure here stops the run before `publish` exists, so no tag is
+          # created and nothing is published; it is never waived.
+          # The inventory is regenerated here from the released commit's own
+          # lockfiles and refuses to run against modified bytes, so the scopes
+          # the environment SBOM cannot see are enumerated against the exact
+          # source this release publishes rather than against whatever the
+          # security run happened to hold.
+          uv run --no-sync python -m scripts.ci.dependency_inventory \
+            --repository-root . --output dependency-inventory.json --resolve-licenses
+          python -m scripts.ci.release_license_gate \
+            --sbom sbom-download/cyclonedx-sbom.json \
+            --pyproject pyproject.toml \
+            --repository-root . \
+            --inventory dependency-inventory.json \
+            --source-sha "${TARGET_SHA}"
+
       - name: Build the installable package for this exact commit
         run: |
           set -euo pipefail
@@ -341,6 +382,7 @@ jobs:
           name: release-publish-inputs
           path: |
             release-notes.md
+            dependency-inventory.json
             sbom-download/**
             dist/**
           if-no-files-found: error

.github/workflows/security.yml

@@ -266,10 +266,44 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Enumerate every declared dependency scope from the lockfiles
+        run: |
+          set -euo pipefail
+          # The SBOM above describes one installed environment, so it cannot see
+          # the dev, fuzz and native-build groups, the Rust workspace or the npm
+          # tree, while it does see whatever CI tooling happens to be installed.
+          # Scoping the SBOM down does not discharge licence adjudication, so the
+          # excluded classes are enumerated here from the lockfiles and published
+          # beside it, bound to the same commit.
+          # The source check runs before any download: a direct URL or VCS
+          # requirement is fetched and built outside the hash-pinned wheel set,
+          # so it must be refused before pip is asked to fetch anything at all.
+          python -m scripts.ci.dependency_inventory --repository-root . \
+            --output /dev/null --check-sources-only
+          # Licence evidence is gathered BEFORE anything is installed: an
+          # unreviewed package must be adjudicated before it reaches an
+          # environment, not after. Wheels only (--only-binary=:all:), because
+          # resolving an sdist can execute its build backend, which would defeat
+          # the point; a package with no wheel simply stays unresolved.
+          python -m pip download --require-hashes -r requirements.lock \
+            --no-deps --only-binary=:all: --dest license-artifacts
+          python -m scripts.ci.dependency_inventory --repository-root . \
+            --output dependency-inventory.json --artifact-dir license-artifacts
+          # Adjudicate here, not merely collect: a hold fails this step, and a
+          # failed step stops the job, so the install below is never reached.
+          python -m scripts.ci.release_license_gate \
+            --inventory dependency-inventory.json \
+            --source-sha "${GITHUB_SHA}" \
+            --mode preinstall
+
       - name: Install audit and project dependencies
         run: |
           python -m pip install --require-hashes -r requirements-security-ci.txt
-          python -m pip install --require-hashes -r requirements.lock
+          # The shipped set installs from the very wheels whose licences were
+          # read above: --no-index --find-links forbids reaching the network
+          # again, so the bytes adjudicated are the bytes installed.
+          python -m pip install --require-hashes --no-index \
+            --find-links license-artifacts -r requirements.lock
           python -m pip install --no-deps -e .
 
       - name: Audit pinned dependencies and generate SBOM
@@ -282,7 +316,9 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7.0.1
         with:
           name: cyclonedx-sbom
-          path: cyclonedx-sbom.json
+          path: |
+            cyclonedx-sbom.json
+            dependency-inventory.json
 
       # Analyze without uploading, then upload with an explicit retry loop.
       # Issue #1172: analysis completed and SARIF exported, then the code-scanning

docs/RELEASING.md

@@ -74,15 +74,58 @@ check those contracts separately before replacing a source pin.
    on runner-global `setuptools` or `pip`. This wheel
    is the installable Python package; the separately built Rust decision
    measurement wheel remains a distinct dependency and is not bundled here.
-6. A repository administrator has enabled GitHub release immutability before
+6. That same SBOM passes the fail-closed licence gate
+   (`scripts/ci/release_license_gate.py`): no component may carry a GPL-family
+   licence (GPL, LGPL or AGPL in any spelling) and none may have an absent,
+   placeholder or unknown licence. The SBOM is the scope, so transitive,
+   optional and build-only components count; being unexecuted is not an
+   exemption. A dual-licensed component passes only when its SPDX expression
+   really offers a permissive alternative with `OR`: `AND` imposes both, and an
+   undecidable operand (`GPL-3.0-only OR UNKNOWN`) offers no reviewable choice.
+   Separate `licenses[]` entries are conjunctive, so each must pass on its own,
+   and nested components are adjudicated like any other. A malformed SBOM, or
+   one with no components, is refused rather than read as clean.
+
+   The same gate also proves *coverage*, by set comparison rather than by
+   spot-checking. For each shipped ecosystem it reads that ecosystem's own
+   lockfile -- `uv.lock`, `rust/Cargo.lock`, `package-lock.json` -- which is the
+   resolved transitive closure, and requires every `name==version` pair in it to
+   be present in the SBOM under the matching `pkg:pypi/`, `pkg:cargo/` or
+   `pkg:npm/` purl. Every distribution declared in `pyproject.toml` (runtime,
+   each optional extra, each dependency group) must appear as well. One
+   component per ecosystem proves nothing and no longer passes. A manifest whose
+   lockfile is missing or unreadable is also a finding: an unprovable scope is
+   not a covered one. A partial SBOM is silence about the scopes it never
+   collected, not evidence.
+
+   Known gap, which keeps releases blocked until it is closed: `security.yml`
+   builds the SBOM with `cyclonedx-py environment` in an Ubuntu/Python 3.12
+   environment installed from `requirements.lock` (`api`, `db`, `queue`), so the
+   `dev`, `fuzz` and `native-build` groups, the Rust workspace, the npm packages
+   and the container image layers are not collected. Extending that collection is
+   the prerequisite for any release, not a reason to relax this gate.
+
+   The inventory the gate reads is produced by `scripts/ci/dependency_inventory.py`
+   in the same job, on the same checkout, immediately before the gate runs; that
+   is the only supported producer. The gate rejects a malformed, unbound or
+   self-contradicting document from it -- wrong schema, no commit id, a commit
+   other than the released one, absent provenance, unusable hashes, blob ids that
+   disagree, or a `matches_commit` that is anything but boolean true. Those checks
+   are not independent verification of an inventory from elsewhere: that would
+   require re-reading each lockfile at the released commit and re-deriving its
+   blob id inside the gate, which it does not do.
+
+   The gate runs inside `verify`, which `publish` depends on, so a failure stops
+   the run before any tag exists. It is never waived to get a release out.
+7. A repository administrator has enabled GitHub release immutability before
    publication. The normal workflow token has no Administration permission;
    do not add an administrative secret or expand the publisher's authority
    merely to read or change this setting. The publisher validates the actual
    public `immutable: true` result and release/asset attestations before
    reporting success. A setting that was disabled or changed during publication
    can leave a complete but mutable public release; that is a **failed** run
    and is ineligible for consumption, not an automatic deletion/retagging case.
-7. The runner's GitHub CLI supports `gh release verify` and
+8. The runner's GitHub CLI supports `gh release verify` and
    `gh release verify-asset`. Missing verification capability fails closed;
    do not replace it with a filename or hash-only success claim.
 

pyproject.toml

@@ -1,8 +1,19 @@
+[build-system]
+# Declared explicitly so the PEP 639 licence metadata above is guaranteed to
+# be emitted: setuptools only understands the SPDX expression from 77.
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
 [project]
 name = "contextual-orchestrator"
 version = "0.2.0"
 description = "Paper-grounded model orchestration lab with an enterprise admin console."
 readme = "README.md"
+# PEP 639: the SPDX expression and the licence file that backs it, so the
+# built distribution declares the licence the repository actually carries
+# instead of leaving it undeclared for every downstream SBOM to guess.
+license = "MIT"
+license-files = ["LICENSE"]
 requires-python = ">=3.12"
 dependencies = [
   "cryptography>=43.0",