From 6ff711c751e72d3cab6ed9922469790b54a5cfd8 Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Tue, 25 Aug 2026 07:21:31 +0200
Subject: [PATCH] Declare the licence by parts, because the boundary runs
 inside two files (#1)

Entry 1 of #1 was answered on 2026-08-24: the code carries AGPL-3.0-or-later,
and the CC-BY-4.0 split for the design system and the page prose takes the form
of one declaration by parts rather than a header in each file. Nothing in the
tree said so, and three sites went on telling a reader the question was open.

`decisions/licensing.md` is that declaration. It says which bytes of the served
pages are under which licence, because both pages hold their stylesheet, their
markup and their script in the same bytes as the words a reader reads, so a
table of paths is wrong about part of every file it names.

The failure this prevents is a reader taking the root `LICENSE`, or the licence
field the platform derives from it, for the whole answer, and treating the
design system as something that cannot be adopted without inheriting a code
licence. Removing that question is the reason the CC-BY-4.0 half was decided.

README and CONTRIBUTING drop their entry-1-is-open pointers, which the same
answer asked for. The CC-BY-4.0 text itself is not in the tree; the declaration
says so in its own words rather than glossing it, and #140 holds that gap.
---
 CONTRIBUTING.md        |  20 +++---
 README.md              |  62 +++++++++---------
 decisions/licensing.md | 141 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 186 insertions(+), 37 deletions(-)
 create mode 100644 decisions/licensing.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9935e21..0b05126 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -185,10 +185,12 @@ the site.
 `decisions/` is what has been settled and why, and it is not published.
 
 The separation that matters most is between the generator and everything
-published, because only the first one is a program. Whether the design system
-ends up under a different licence from the generator is entry 1 of #1, and the
-boundary that answer would fall on is `docs/design-system.html` plus the token
-file #39 extracts from it.
+published, because only the first one is a program. The design system does carry
+a different licence from the generator, and the boundary falls inside
+`docs/design-system.html` rather than around it: the words are CC-BY-4.0 and the
+markup, stylesheet and script they sit in are not. `decisions/licensing.md` is
+the declaration, and `docs/design-tokens.json` is on the design system's side of
+it.
 
 ## What runs today
 
@@ -250,10 +252,12 @@ tense. Read the relevant one before arguing with a rule, because most
 disagreements about a rule are disagreements with the decision behind it and
 those are easier to have directly.
 
-Some things are deliberately not settled. Those are in #1 and are not decided in
-a pull request. The license this repository carries is no longer one of them: it
-is AGPL-3.0, in [LICENSE](LICENSE), and what remains open in entry 1 of #1 is
-whether the published pages and the design system carry different terms.
+Some things were deliberately not settled, and those were in #1 rather than in a
+pull request. Every entry of that issue now carries an answer. The licence is one
+of them: the code is AGPL-3.0-or-later, in [LICENSE](LICENSE), and the design
+system and the words on the published pages are CC-BY-4.0.
+`decisions/licensing.md` is the declaration that says which bytes are which,
+because the boundary runs inside two files rather than between them.
 
 ## Style
 
diff --git a/README.md b/README.md
index 237d97b..856eca1 100644
--- a/README.md
+++ b/README.md
@@ -185,40 +185,44 @@ own documentation.
 
 ## License
 
-The GNU Affero General Public License, version 3 or any later version. The full
-text is in [LICENSE](LICENSE), and the "or any later version" is the option the
-licence's own application notice offers rather than an addition to it.
+Two licences over one tree.
 
-The detector reads it:
+The code is under the GNU Affero General Public License, version 3 or any later
+version. The full text is in [LICENSE](LICENSE), and the "or any later version"
+is the option the licence's own application notice offers rather than an addition
+to it.
 
-    gh api repos/Flowfin/hub --jq '.license.spdx_id'
-    AGPL-3.0
-
-Run 2026-08-09.
+The design system and the words on the published pages are under CC-BY-4.0,
+attribution required, so that a project adopting the design system does not
+inherit a code licence with it.
 
 ### What it covers
 
-Every path in this repository, with no exception and no second licence anywhere
-in the tree. That is worth saying out loud because this tree holds three kinds of
-thing with three different audiences, and a reader who knows that will look for a
-boundary:
-
-| Path | What it is | Under |
-|---|---|---|
-| `manifest/`, `internal/`, `main.go` | The generator, which is a program | AGPL-3.0-or-later |
-| `docs/` | The published site, including the design system | AGPL-3.0-or-later |
-| `decisions/`, `*.md` | The documents | AGPL-3.0-or-later |
-| `sources/` | The declared source set, which is data | AGPL-3.0-or-later |
-
-The design system is prose and numbers other projects are invited to adopt, and
-adopting them means following what they say rather than copying the file, which
-the licence does not reach. Copying the file, or a client built from it, is a
-derivative and does.
-
-Whether the published pages and the design system should carry different terms
-from the generator is entry 1 of #1 and is open. A single `LICENSE` at the root
-reads as covering the whole tree, which is what the table above states, so a split
-would be a change to this rather than a reading of it.
+The boundary between the two does not run between files. Both served pages hold
+the page's own stylesheet, its markup and its script in the same bytes as the
+words a reader reads, so a table of paths would be wrong about part of every file
+it named. [`decisions/licensing.md`](decisions/licensing.md) is the declaration,
+part by part, and it is the authority rather than this section: it says which
+bytes are under which licence, what a reader who copies a whole file takes, and
+what the tree does not carry.
+
+The short of it. The generator, the site's own markup, stylesheets and script,
+the documents and the declared source set are AGPL-3.0-or-later. The words on the
+published pages, and the design system including `docs/design-tokens.json`, are
+CC-BY-4.0.
+
+Adopting the design system means following what it says rather than copying the
+file, which no licence reaches. Copying the file, or a client built from it, is a
+derivative and does, and CC-BY-4.0 is the licence that reaches it.
+
+The repository detector reads the root file and only the root file, so it reports
+one licence for a tree that grants under two:
+
+    gh api repos/Flowfin/hub --jq '.license.spdx_id'
+    AGPL-3.0
+
+Run 2026-08-25. Nothing on the platform side can be made to state both, which is
+why the declaration is a file in the tree.
 
 The plugin repositories this catalogue lists are separate repositories under
 their own terms. A catalogue listing something is not a statement about its
diff --git a/decisions/licensing.md b/decisions/licensing.md
new file mode 100644
index 0000000..f801017
--- /dev/null
+++ b/decisions/licensing.md
@@ -0,0 +1,141 @@
+# Two licences over one tree, declared by parts
+
+This tree holds a program, a published site and a design system. The program is
+under the AGPL. The design system and the words on the published pages are under
+CC-BY-4.0. The boundary between them does not run between files, so it is
+declared here, by part, and nowhere else.
+
+That is entry 1 of #1, and it is the last entry of that issue to be answered.
+
+## What was decided
+
+**The code is AGPL-3.0-or-later.** The licence was taken by the maintainer on
+2026-08-08 in entry 1 of #1 and applied to every board that carried none. The
+`or-later` half is the option the licence's own application notice offers rather
+than an addition to it, and it was made precise fleet-wide on 2026-08-09.
+
+Entry 1 carried two answers naming different variants of the same licence for a
+while: `AGPL-3.0-or-later` on 2026-08-09 and `AGPL-3.0-only` on 2026-08-11,
+neither referring to the other. That was recorded in the issue on 2026-08-11 and
+settled by the maintainer on 2026-08-24, who read the `-only` answer as a slip
+and kept the variant the tree already stated. So this file states one variant and
+does not carry a live disagreement forward.
+
+**The design system and the words on the published pages are CC-BY-4.0.**
+Decided by the maintainer on 2026-08-11, with the reason: a design system other
+projects are invited to adopt must not raise code-licence questions for the
+adopter. Attribution stays required.
+
+**The form is one declaration by parts, not a header in each file.** Decided by
+the maintainer on 2026-08-24, because the boundary does not run between files and
+a per-file header would have to claim it does.
+
+## Why a path table cannot carry it
+
+Both served pages hold the page's own stylesheet, its markup and its script in
+the same bytes as the words a reader reads. At `2a8f88a`:
+
+    grep -n '<style>\|</style>\|<script>\|</script>' docs/index.html docs/design-system.html
+    docs/index.html:5:<style>
+    docs/index.html:22:</style>
+    docs/design-system.html:4:<style>
+    docs/design-system.html:149:</style>
+    docs/design-system.html:411:<script>
+    docs/design-system.html:447:</script>
+
+    grep -c "" docs/index.html docs/design-system.html docs/design-tokens.json
+    docs/index.html:71
+    docs/design-system.html:447
+    docs/design-tokens.json:276
+
+Run 2026-08-25. A row saying `docs/` is under one licence is wrong about part of
+every file it names, and a header at the top of either page would be a statement
+about the whole file made in the one place a reader trusts it least.
+
+Three shapes were open when the entry was recorded on 2026-08-11: a per-file
+header, a declaration naming parts, and moving the prose into files of its own.
+The third was not chosen, so a page's words stay in the page they are read from.
+
+## The declaration
+
+**Under AGPL-3.0-or-later**, whose text is in [LICENSE](../LICENSE):
+
+- The generator, meaning `main.go`, `internal/` and `manifest/`, together with
+  the suites and the specimen data that go with them.
+- The site's own code: in `docs/index.html` and `docs/design-system.html`, the
+  `<style>` block, the `<script>` block, and the elements, attributes and class
+  names that arrange the page. That is a program in the sense that matters here,
+  because it is what runs in a browser, and it is not part of what an adopter is
+  asked to take.
+- The documents: `README.md`, `CONTRIBUTING.md`, `decisions/`, and the other
+  documents at the root of the tree. The answer of 2026-08-11 moved the design
+  system and the page prose and named nothing else, so these stay where the tree
+  already had them rather than following the page prose out.
+- The declared source set under `sources/`, which is this project's data about
+  which repositories it reads.
+
+**Under CC-BY-4.0**, `https://creativecommons.org/licenses/by/4.0/`, attribution
+required:
+
+- The words a reader reads on `docs/index.html` and `docs/design-system.html`:
+  the running text, the headings, the table contents and the captions. Not the
+  markup they sit in.
+- The design system as a whole, which is those words on `docs/design-system.html`
+  plus the values in `docs/design-tokens.json`. The token file is on this side
+  because it is the design system's values in the form an adopter is asked to
+  take, and putting it on the other side would raise for the adopter exactly the
+  code-licence question the answer exists to prevent.
+
+**Under neither, because it is not this project's to license:**
+`docs/manifest.json` is generated, and the names, descriptions and overviews in
+it are read out of descriptors the listed repositories publish.
+`decisions/manifest-is-generated.md` is how it is produced and
+`decisions/names-are-data.md` is why no such value is typed here. The plugin
+repositories the catalogue lists are separate repositories under their own terms,
+and listing something is not a statement about its licence.
+
+## What a reader who takes a whole file takes
+
+Both. A served page is bytes under two licences, and copying the file copies both
+parts of it. That is the cost of the boundary running inside a file rather than
+between files, and it is stated here rather than argued away: an adopter who
+wants only the design system takes the words and the token file and leaves the
+page, and an adopter who wants the page takes it under both sets of terms.
+
+## What the tree does not carry
+
+The CC-BY-4.0 text. `LICENSE` holds the AGPL in full and there is no second
+licence file:
+
+    git ls-files | grep -i -E '^(LICENSE|COPYING|LICENSES)'
+    LICENSE
+
+Run 2026-08-25 at `2a8f88a`. So the second licence is named by identifier and
+address above and is not reproduced in this repository, which is weaker than what
+the first one gets. That is a gap rather than a decision, and #140 is where it is
+held.
+
+The repository detector reads the first licence and only the first one, which is
+what a single root `LICENSE` gets:
+
+    gh api repos/Flowfin/hub --jq '.license.spdx_id'
+    AGPL-3.0
+
+Run 2026-08-25. A reader who takes that field for the whole answer will miss this
+file, and nothing on the platform side can be made to state two.
+
+## What refuses a departure
+
+Nothing. No leg of the gate reads a licence, and a file added tomorrow under
+neither part of this declaration is refused by no route here. This is prose, and
+the review is where a departure is caught.
+
+The one thing that is mechanical is negative: `no-hardcoded-names` and the other
+legs are printed by `go run .` and none of them has a licence as its subject.
+
+## What this does not settle
+
+Whether the plugin repositories the catalogue lists should carry the same licence
+as the catalogue. Entry 1 of #1 raised it in its own body and no answer in that
+issue reaches it; it is a decision about twelve other repositories rather than
+about this tree, and this file states no answer to it.