8.1. License

Three separate licence grants, and what each one covers

A licence grant is explicit permission from the copyright holder to copy, modify, and redistribute a work. Copyright reserves all three until a grant says otherwise, so a repository can be perfectly public and still unusable by anyone else: visibility is not permission. Copy infra/ into a company platform repository without the notice travelling with it, and nobody can later say under whose terms that code runs — in copyright law, not knowing defaults to no. This page names which grant covers any file here, why the split exists, and the one command that catches a drifted copy.

Software and teaching material are reused by different people for different reasons:

The root LICENSE carries the MIT software grant, static/LICENSE.txt carries the course-content grant, and static/assets/fmind/OFL-1.1.txt carries the font notices. MIT is a short permissive software licence whose one real obligation is keeping its copyright and permission notice with substantial copies.

CC BY 4.0 is built for creative work instead. It allows reuse and adaptation, including commercially, provided attribution, a licence link, and an indication of what you changed travel with the material, and provided you add no restriction that stops the next person doing the same. One licence for both audiences would force each to interpret terms written for the other.

These summaries are an engineering guide, not legal advice. Read the licence text before you redistribute a derivative, meaning anything you publish that copies or adapts this material.

Why six subtrees carry byte-identical copies of the licence

Someone who copies agents/ receives a directory, not a repository, so the grant has to be inside it. Six distributable subtrees carry their own copy — the three Go modules among them, because a module is the unit someone can go get on its own — and the copies are not allowed to diverge:

sha256sum LICENSE agents/LICENSE clients/LICENSE evals/LICENSE infra/LICENSE load/LICENSE tools/LICENSE

b20626e1f04ad0cfd44fced6cccbebaca919619a2336d7a6d785f0293f2de8d0  LICENSE
b20626e1f04ad0cfd44fced6cccbebaca919619a2336d7a6d785f0293f2de8d0  agents/LICENSE
b20626e1f04ad0cfd44fced6cccbebaca919619a2336d7a6d785f0293f2de8d0  clients/LICENSE
b20626e1f04ad0cfd44fced6cccbebaca919619a2336d7a6d785f0293f2de8d0  evals/LICENSE
b20626e1f04ad0cfd44fced6cccbebaca919619a2336d7a6d785f0293f2de8d0  infra/LICENSE
b20626e1f04ad0cfd44fced6cccbebaca919619a2336d7a6d785f0293f2de8d0  load/LICENSE
b20626e1f04ad0cfd44fced6cccbebaca919619a2336d7a6d785f0293f2de8d0  tools/LICENSE

One digest, seven files. scripts/check-licenses.sh runs cmp over exactly that set, so an edit to one copy fails instead of silently creating two different MIT grants in one project. That set is also the limit of what the comparison covers: lift a folder out of skills/, which ships no copy, and nothing comes with it unless you bring the notice yourself.

The same logic decides which licence covers a quoted excerpt. A page never retypes code: it pulls the function in through an include, a shortcode naming the repository path and region to extract. The explanation around it is CC BY 4.0 course content, the extracted function stays MIT-licensed software, and the include makes that provenance visible rather than inferred — 8.0. Repository shows how to find the source it points at.

For a derivative, that means two habits: keep the MIT notice beside copied software, and for adapted prose write a visible attribution that names the course and author, links the source, links CC BY 4.0, and says what you changed — without implying the original author endorses your version.

How check:licenses verifies notices and every module’s dependencies

One task runs both checks:

mise run check:licenses

[check:licenses] $ ./scripts/check-licenses.sh full
repository licenses: MIT software + CC BY 4.0 course content + OFL 1.1 fonts

Report Summary

┌──────────────────┬───────┬──────────┐
│      Target      │ Type  │ Licenses │
├──────────────────┼───────┼──────────┤
│ agents/go/go.mod │ gomod │    -     │
├──────────────────┼───────┼──────────┤
│ evals/go.mod     │ gomod │    -     │
├──────────────────┼───────┼──────────┤
│ go.mod           │ gomod │    -     │
├──────────────────┼───────┼──────────┤
│ tools/go.mod     │ gomod │    -     │
├──────────────────┼───────┼──────────┤
│ agents/go/go.mod │   -   │    0     │
├──────────────────┼───────┼──────────┤
│ evals/go.mod     │   -   │    0     │
├──────────────────┼───────┼──────────┤
│ tools/go.mod     │   -   │    0     │
└──────────────────┴───────┴──────────┘

Three timestamped INFO lines and the closing legend are cut; the rest is verbatim, separators included. In that legend, 0 means clean and - means not scanned for that class, so a module listed twice is one target under two classes.

The first line is the repository’s own notice check; everything below it is trivy-repository.sh licenses walking the whole checkout at UNKNOWN, HIGH, and CRITICAL severity. Trivy is the scanner this repository standardizes on for dependencies and configuration. For a licence, its severity means reuse risk rather than exploitability: copyleft lands in HIGH, and anything it cannot map to a known identifier lands in UNKNOWN.

Because it walks the tree rather than a configured list, it finds every go.mod present: the root Hugo module plus the three Go modules that ship code — agents/go/go.mod, evals/go.mod, and tools/go.mod. A dependency review that inspects only the production module, skipping the evaluation harness and the repository tooling, has reviewed a fraction of what you would be shipping.

mise run check:licenses:core exists because learners and maintainers reach for different task names; it currently calls the same policy, since one implementation behind two names beats a duplicate that quietly disagrees.

One command just confirmed that the four distributable subtrees still carry byte-identical copies of the root MIT grant, and that no dependency arrived with a licence nobody reviewed.

A scanner reads declared metadata, which can be missing, malformed, or overbroad, so read that green as an observation about declared licences, not a legal opinion — 0.2. Evidence draws that line for the whole course.

Image scans come at the same question from the other side. The repository scan sees locks, manifests, and vendored assets before any image exists; the image scan sees the packages actually present in the built artifact, under the same trivy.yaml policy.

Your turn: edit one subtree LICENSE and read the failure it names

Predict before you touch anything. If a contributor updates the copyright year in agents/LICENSE and nowhere else, does the repository end up with two MIT grants, one warning, or a red run?

• Mode: temporary experiment.
• Goal: watch the notice check name the specific copy that drifted, rather than reporting that “licences” are wrong.
• Files to touch: only agents/LICENSE, restored at the end. The root LICENSE is never edited.
• Preflight: git diff --quiet -- agents/LICENSE must exit 0, and mise run check:licenses must currently pass.
• Steps: change one character in agents/LICENSE — a year, a name, a line break — then run mise run check:licenses and read the first line it prints on stderr.
• Gate that proves completion: the task exits non-zero with agents/LICENSE: software license differs from the root MIT license, and you can say why the check compares bytes instead of parsing the text.
• Final state: run git restore -- agents/LICENSE, then confirm mise run check:licenses is green again and git status --short shows no leftover change.

Byte comparison rather than parsing is what makes that failure trustworthy: two MIT grants that differ by a rewrapped line are still two documents a lawyer has to read separately, and a checker clever enough to call them equivalent will one day call two genuinely different grants equivalent too.

Pick a licence for the project you build next

Choose from your project’s ownership and distribution intent, never from its language or framework. For an open-source derivative, preserve the notices attached to any MIT software you copied and pick a compatible licence for your original code. For private or employer-owned work, follow the rights holder’s policy. Never paste this course’s licence header into a project whose owner chose different terms: a wrong grant is worse than a missing one, because a missing one prompts the question and a wrong one looks settled.

Citation is a separate obligation from either grant. CITATION.cff is this repository’s structured citation authority, which GitHub and reference managers render into common formats; it complements the CC BY 4.0 attribution and MIT notice requirements without discharging either.

What you can do now

• You can name the grant covering a Go file, a course paragraph, a bundled font, and a quoted source excerpt.
• You can check the four distributable subtrees for byte-identical MIT notices, and name the copied directory that carries none.
• You can run mise run check:licenses over four go.mod files and read its 0/- legend.
• You can describe that scan as a reviewable observation, not a legal opinion.

“It is on GitHub, so we can use it” is not a licence.

Return to 8. Community, or continue to 8.2. Releases when you want those grants attached to something you actually publish.