Repository navigation
chore(licensing): correct 1000Langs attribution, add Apache-2.0 NOTICE for meta/ - #21
Merged
Merged
Conversation
…tice Record what LOL took from ehsanasgari/1000Langs: every file under meta/ is a byte-identical copy (Apache-2.0); the code is an independent reimplementation. See docs/provenance/1000langs-comparison.adoc. - add LICENSES/Apache-2.0.txt (the 1000Langs LICENSE), NOTICE and REUSE.toml licensing meta/** as Apache-2.0 - replace "Ehsaneddin Asgari and Contributors" copyright lines on files he did not write with Jonathan D.A. Jewell; licence ids unchanged - README: accurate credit line and a corpus-data/translation-licence section; config/main.ncl: per-source terms_url (unknown where unverified) - POSTULATE-AUDIT: drop the false third-party-origin claim No behaviour change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5oTR3UPaBfCsjErogrM7E
Contributor
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing (22)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
5 of 13 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 7, 2026
<!-- SPDX-License-Identifier: CC-BY-SA-4.0 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> --> ## Summary Adds a **draft** Profile A `AFFIRMATION.adoc` (per `standards/docs/AFFIRMATION-STANDARD.adoc`), anchored to `main@eb8e1d0`, the parent of this PR's commit. Every claim in it is drawn from a command run in-session on 2026-10-07. It becomes the affirmation when the owner merges it with a signed merge. **Not merged by the agent, and automerge is not armed. Merging is Jonathan's.** What it affirms and what it refutes, in short: - **Affirmed:** - The Agda proofs type-check. - The trust-base audit passes: 5 quarantined postulates. - The 1000Langs attribution files are present. - **Refuted:** - `nickel export config/main.ncl` fails. - `reuse lint` fails. - **Refuted:** that the source is AffineScript. 16 of the 21 `.affine` files still contain ReScript syntax, and none of the 21 parse. - **Unrunnable:** every Justfile build, test and lint recipe calls Deno or ReScript. No issue closed. ## Type of change - [ ] 🐛 Bug fix: no code changes. - [ ] ✨ New feature: no code changes. - [ ] 💥 Breaking change: no code changes. - [ ] 🕳️ Soundness fix: no checker or proof is touched. - [x] 📖 Documentation - [ ] 🧹 Refactor: no code changes. - [ ] ⚡ Performance: no code changes. - [ ] 🔧 Build / CI / tooling: none touched. ## 📌 New pins Head SHA: **cc76dce51aaf5dbad3792dd7735b1f82d52a4c53**. No pins added or changed: no `uses:`, lockfile or digest edits. ## How has this been verified? Run at the anchor in a clean worktree (`git status --porcelain` empty): - `sh scripts/audit-trust-base.sh` exited 0: `trust-base audit: OK — 5 postulate(s) in quarantine (conjecture=2 ffi-fact=3 ), 1 safe module(s), 3 .agda file(s) total`. - `HOME=<scratch> AGDA_STDLIB_DIR=/usr/share/agda-stdlib/src sh scripts/prove-agda.sh` exited 0: `All Agda proofs type-checked cleanly under the enforced flags.` Agda 2.7.0.1, agda-stdlib 2.1. - As shipped with the real HOME, it exits 1 (`mkdir: … ~/.agda/libraries: File exists`). - With no `AGDA_STDLIB_DIR` set, it exits 1 because the stdlib is not found. - Both failures are recorded in the file. - `nickel export config/main.ncl` exited 1: `error: missing definition for 'environment'`. - `reuse lint` exited 1. Licence texts are missing for MPL-2.0, CC-BY-SA-4.0, MIT and LicenseRef-Palimpsest-0.8; 106 of 349 files carry copyright information. - `affinescript check` (0.1.1, local build) exited 124 on all 21 `.affine` files. The reported location (the `module X;` line) is misattributed; the real cause is ReScript syntax such as `module Fetch = {` and `@val external`. - Positive control: a minimal valid `module Foo;` file passes, and the same file plus one ReScript module block fails at the same misattributed location. - The first commit (6c03172) had called this inconclusive. The second commit corrects that. - `asciidoctor --failure-level=WARN AFFIRMATION.adoc` passed with no warnings. ## Checklist - [x] My commits are **signed** (`git commit -S`). `git log --format=%G?` shows `G`. - [ ] I ran the project's own checks/tests locally and they pass. They do not all pass: the `just` recipes need Deno or ReScript (banned), and nickel and reuse fail on `main`. The file reports this rather than hiding it. - [x] New files carry the correct `SPDX-License-Identifier`: `AFFIRMATION.adoc` is prose, `CC-BY-SA-4.0`. - [x] Docs are updated, and no public claim now overstates what the code does. The file exists to state the gaps. It notes that `EXPLAINME.adoc:38` is stale, since the header fix landed in #21, but does not edit EXPLAINME. - [x] I have not introduced a soundness hole: documentation only. ## Notes for reviewers - **Signing:** the agent's commit is signed with the owner's SSH key on this machine, so it is not an independent signature. The attestation is the owner's signed merge. Until then the file is a draft, as its last line says. - **Anchor drift:** if `main` moves before merge, the anchor is no longer this commit's parent. The file then reads as a draft, and the checks should be re-run with the anchor bumped. - **Follow-ups**, logged to the owner's findings inbox rather than filed as issues: - the `prove-agda.sh` `~/.agda/libraries` bug; - the Justfile still uses Deno and npx/ReScript; - the unconverted ReScript in the `.affine` files, and the misleading parse-error location. ### Deferred red checks (pre-existing on main@eb8e1d0, none required) - `build` (×2) deferred to #24 - `governance / Licence consistency` deferred to #24 - `governance / Workflow security linter` deferred to #24 - `governance / Actions lockfile verify` deferred to #24 - `governance / Check Workflow Staleness` deferred to #24 - `governance / Well-Known (RFC 9116 + RSR)` deferred to #24 The one required context, `scan / gitleaks`, passes on this head. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01V5oTR3UPaBfCsjErogrM7E --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Corrects LOL's licensing and attribution with respect to ehsanasgari/1000Langs (Ehsaneddin Asgari, Apache-2.0). No behaviour change.
Step 1 conclusion: mixed. The
meta/data is derived: 204 files are verbatim copies with identical git blob SHAs. All code is an independent reimplementation; there is no translated Python. The evidence, citing files and lines on both sides, is indocs/provenance/1000langs-comparison.adoc.Because part of the repo is derived, the "derived" branch of the brief applies, scoped to
meta/. The code files, which are independent, now name Jewell.Every changed file and why
docs/provenance/1000langs-comparison.adoc(new)meta/, history, a fingerprint search of the ReScript originals atb39c92a, a rebuttal of the CHANGELOG "Python rewrite" claim, and the conclusion.LICENSES/Apache-2.0.txt(new)LICENSE, byte for byte (checked withcmp).NOTICE(new)meta/comes from 1000Langs, (c) 2018-2019 Asgari. States that the code is an independent ReScript→AffineScript reimplementation, lists the significant differences, and notes that 1000Langs has no NOTICE to carry over.REUSE.toml(new)meta/**as Apache-2.0, since data files cannot carry headers. Asgari is credited only for the 4 files he compiled; no holder is invented for third-party captures,ISO639-3.tsvor flags (see the departure note).README.adocmeta/copied unmodified. Adds a Corpus Data and Translation Licences section: crawls, does not redistribute; Bible.com and similar sites are copyrighted and governed by their ToS; check each translation's licence before republishing; eBible.org is the safest default. Copyright line → Jewell.config/main.nclterms_urlfield to each of the 5 sources. Values were verified by fetching them: API.Bible →https://api.bible/terms-and-conditions; eBible →https://ebible.org/Scriptures/copyright.php; png_scriptures →"unknown". Bible.com returns a bot challenge and find.bible has no terms page, so both are"unknown". Copyright line → Jewell.proofs/POSTULATE-AUDIT.adoc.editorconfig,.github/CONTRIBUTING.md,.gitlab-ci.yml,CODE_OF_CONDUCT.adoc,Containerfile,FUTURE.adoc,proofs/README.adoc,proofs/echidna.toml,proofs/specs/{alignment,iso639,statistics}.spec,proofs/theories/InformationTheory.agda,proofs/theories/InformationTheory/{Axioms,Foundations}.agda,test/vitest.config.affineSPDX-FileCopyrightText: 2024-202[56] Ehsaneddin Asgari and Contributors→2024-2026 Jonathan D.A. Jewell and Contributors. Asgari wrote none of these files. Licence identifiers are unchanged.Closes: no issue (owner brief).
Type of change
REUSE.tomland a data-only config field; nothing readsterms_url(git grep terms_urlhits onlyconfig/main.ncland README)📌 New pins
eec4dbd4b443822539274232ab4d5baee85e292auses:,actions.lock, lockfile or container digest is touched.How has this been verified?
diff <(git ls-tree -r origin/main -- meta) <(git -C 1000Langs ls-tree -r HEAD -- meta)(blob + path) → identical, 204 entries.cmp LICENSES/Apache-2.0.txt 1000Langs/LICENSE→ identical.git diff --stat origin/main -- src lib→ empty.git grep 'Ehsaneddin Asgari and Contributors'→ no hits.nickel exportandnickel export --field sourcesgive the same errors before and after: "missing definition forenvironment" and "non mergeable terms". The config does not evaluate onmaintoday (pre-existing, not fixed here; see notes). The edit adds only plain string fields.reuse lint(/usr/bin/reuse5.0.2), run on a clean export oforigin/main(0cb776c) and of this head. Both exit 1.Base summary:
Head summary:
"Bad licenses" section, identical on base and head:
Apache-2.0is now a used licence with its text present. Files with licence information go from 126 to 331, because all 204meta/files are now covered. On head, 200meta/files still report no copyright holder. That is deliberate: their original authorship is unestablished, and none is invented.NOTICEreports no licence information; it is an attribution file, and choosing its licence is part of the project-licence decision below.PMPL-1.0andPalimpsest-MPL-1.0appear in noSPDX-License-Identifierline, only in README badges and prose, soreuse lintcannot flag them. It does flagLicenseRef-Palimpsest-0.8as a bad licence (10 files), andMPL-2.0,CC-BY-SA-4.0,MITandLicenseRef-Palimpsest-0.8as missing texts. Nothing was renamed or added for these; that is an estate-wide decision.Checklist
git log --format=%G?→G.just test/just lintare Deno-based and no source changed; I ranreuse lintandnickel exportinstead (above).CC-BY-SA-4.0andREUSE.tomlisMPL-2.0.LICENSES/Apache-2.0.txtis a licence text.NOTICEhas no header (see above). No existing file was relicensed; only copyright holder lines changed.proofs/, andtrust-base.jsongates postulates and modules, not headers.Notes for reviewers
Apache-2.0alongside the project licence. The derived files are the unmodifiedmeta/copies. Jewell holds no copyright in byte-identical files and no project licence applies to them, soREUSE.tomlgives them Apache-2.0 alone, and Asgari only where he compiled the data (2018-2019, the years of hismeta/commits). Third-party captures (api_volumes.txt,bibles_list.html,ebible.html),ISO639-3.tsvandflags/get no holder, because none is established.dev-notes/inbox/findings.md):config/main.nclproject.authorsstill lists Asgari as LOL's author.CHANGELOG.adocclaims a Python→ReScript rewrite and a 2018 Apache release that the history contradicts.LICENSEcarries anMPL-2.0SPDX line over AGPL text.LICENSE.txt,SECURITY.md,flake.nixand.resfiles, none of which exist.spdx-checkscans only*.res.🤖 Generated with Claude Code
https://claude.ai/code/session_01V5oTR3UPaBfCsjErogrM7E