diff --git a/CITATION.cff b/CITATION.cff
index 290db25..caff63d 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -4,8 +4,8 @@ title: "TrustKit — AUX (Agentic User Experience) heuristics, trust architectur
abstract: >-
Canonical, forkable definitions for Agentic User Experience (AUX): the 10 AUX
Heuristics, the 4-stage Trust Architecture, the Trust Gap Taxonomy, and the
- agent-spec / memory-policy schemas. Definitions are CC BY 4.0; executable
- tooling is MIT.
+ agent-spec / memory-policy schemas. The schemas and the tooling are MIT; the
+ prose that explains them is CC BY 4.0. Citation is requested, not required.
type: software
authors:
- name: "auxfirst"
@@ -13,7 +13,9 @@ authors:
email: "founder@auxfirst.com"
repository-code: "https://github.com/auxfirst/trustkit"
url: "https://auxfirst.com"
-license: CC-BY-4.0
+license:
+ - MIT
+ - CC-BY-4.0
version: "0.2"
date-released: "2026-04-19"
keywords:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 57b69e3..64f2fde 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -36,4 +36,4 @@ Contributors are listed in `CONTRIBUTORS.md` with the IDs / patterns they author
## License
-By contributing you agree your contribution is licensed under the repo's declared license (CC BY 4.0 for definition repos, MIT for executable repos, CC BY-NC 4.0 for teardowns).
+By contributing you agree your contribution is licensed under the license for that artifact type in [LICENSING.md](LICENSING.md): MIT for schemas and tooling, CC BY 4.0 for prose, CC BY-NC 4.0 for teardown content.
diff --git a/LICENSING.md b/LICENSING.md
index a13a652..6062a6d 100644
--- a/LICENSING.md
+++ b/LICENSING.md
@@ -1,13 +1,42 @@
# Licensing
-TrustKit is dual-licensed by artifact type. GitHub’s license detector reads
-[`LICENSE`](LICENSE), which is the unmodified **CC BY 4.0** legal code.
+TrustKit is licensed by artifact type, on one rule:
+
+> **Machine-readable definitions are MIT. Prose is CC BY 4.0.**
+
+If a file is something you embed, vendor, parse, or generate from, it is MIT
+and carries no attribution condition. If it is something you read, it is
+CC BY 4.0 and attribution is the price.
+
+GitHub's license detector reads the root [`LICENSE`](LICENSE), the unmodified
+CC BY 4.0 legal code, so the repository badge says **CC BY 4.0**. That covers
+the prose, which is most of the repository by volume. It does not describe
+`schemas/`, which is MIT — see the table.
| Artifact | License | File |
|---|---|---|
-| Definitions: schemas, onboarding, vocabulary, patterns, teardowns metadata | **CC BY 4.0** | [`LICENSE`](LICENSE) |
-| Executable tooling: `packages/aux-audit`, `action.yml` | **MIT** | [`packages/aux-audit/LICENSE`](packages/aux-audit/LICENSE) |
-| Teardown *content* under `repos/agent-ux-teardowns/teardowns/` (when added) | **CC BY-NC 4.0** | declared in that tree |
+| **Schemas** — every `.yaml` under [`schemas/`](schemas/) | **MIT** | [`schemas/LICENSE`](schemas/LICENSE) |
+| **Executable tooling** — `packages/aux-audit`, `action.yml` | **MIT** | [`packages/aux-audit/LICENSE`](packages/aux-audit/LICENSE) |
+| **Prose** — onboarding, vocabulary, pattern write-ups, architecture, this file | **CC BY 4.0** | [`LICENSE`](LICENSE) |
+| **Teardown content** under `repos/agent-ux-teardowns/teardowns/` (when added) | **CC BY-NC 4.0** | declared in that tree |
+
+## Why the schemas are MIT
+
+The point of publishing the heuristics, the trust ladder, and the gap taxonomy
+as YAML is that other people put them **inside** things — a CI check, a linter,
+a scoring service, a product's own config. Creative Commons says plainly that
+its licenses are not intended for software, and many legal teams will not
+approve CC-licensed files in a codebase. A license that makes a corporate
+adopter open a ticket is a license that loses the adoption.
+
+Attribution is still wanted, and [`CITATION.cff`](CITATION.cff) makes it
+one click. It is just not a condition of use.
+
+## What this means in practice
-The bundled YAML under `packages/aux-audit/schemas/` is a copy of the canonical
-definitions and remains **CC BY 4.0**, even though the CLI that reads it is MIT.
+- **Vendoring `aux-heuristics.yaml` into a closed-source product** — fine, MIT.
+- **Shipping a tool that bundles the schemas** — fine, MIT, which is why the
+ copies under `packages/aux-audit/schemas/` need no separate carve-out.
+- **Quoting the onboarding docs in a blog post** — CC BY 4.0, so credit
+ auxfirst and link back.
+- **Reselling a teardown** — no; teardown content is CC BY-NC 4.0.
diff --git a/README.md b/README.md
index 1d5af90..c27b00c 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@
**Project home: [auxfirst.com](https://auxfirst.com)** · [`aux-audit`](packages/aux-audit/) · [Schemas](schemas/) · [Onboarding](onboarding/README.md) · [Docs](docs/index.md) · [Cite this work](CITATION.cff)
-**AUX** (Agentic User Experience) is an open standard. The 10 AUX Heuristics, the 4-stage Trust Architecture, and the Trust Gap Taxonomy are published as editable YAML schemas — forkable, citable, not vendor-locked. Definitions are **CC BY 4.0**; executable tooling is **MIT**.
+**AUX** (Agentic User Experience) is an open standard. The 10 AUX Heuristics, the 4-stage Trust Architecture, and the Trust Gap Taxonomy are published as editable YAML schemas — forkable, citable, not vendor-locked. The schemas are **MIT** — embed them, vendor them, no attribution condition. The prose around them is **CC BY 4.0**.
If you ship AI products, you are no longer designing screens. You are designing an ongoing relationship between a user and an agent that has memory, initiative, and judgment. Classical UX was built for tools. AUX is built for relationships.
@@ -103,8 +103,8 @@ Or read **[onboarding/README.md](onboarding/README.md)** — the router with all
├── docs/ ← static-site copy (canonical path TBD)
├── CHANGELOG.md ← what shipped
├── CITATION.cff ← how to cite AUX definitions
-├── LICENSE ← CC BY 4.0 (GitHub-detectable legal code)
-├── LICENSING.md ← dual-license map (CC BY / MIT / CC BY-NC)
+├── LICENSE ← CC BY 4.0 (prose; GitHub-detectable legal code)
+├── LICENSING.md ← license map: machine-readable = MIT, prose = CC BY
└── .github/ ← Issue templates, PR template, CI
```
@@ -155,11 +155,13 @@ GitHub renders it behind the *Cite this repository* button as APA or BibTeX.
## License
-- Definition content (schemas, frameworks, heuristics, vocabulary): **CC BY 4.0**.
-- Executable tooling (`packages/aux-audit`, `action.yml`): **MIT**.
+One rule: **machine-readable definitions are MIT, prose is CC BY 4.0.**
+
+- Schemas (`schemas/*.yaml`) and tooling (`packages/aux-audit`, `action.yml`): **MIT**. Embed them; no attribution condition.
+- Prose (onboarding, vocabulary, pattern write-ups): **CC BY 4.0**.
- Teardown content: **CC BY-NC 4.0** (attribution, non-commercial).
-See **[LICENSE](LICENSE)** for the CC BY 4.0 legal code and **[LICENSING.md](LICENSING.md)** for the dual-license map (tooling is MIT).
+GitHub's badge reads CC BY 4.0 because it detects the root **[LICENSE](LICENSE)**, which covers the prose. The schemas are not CC — see **[LICENSING.md](LICENSING.md)** and **[schemas/LICENSE](schemas/LICENSE)**.
## Status
diff --git a/REPO_STRUCTURE.md b/REPO_STRUCTURE.md
index 22d5463..c167882 100644
--- a/REPO_STRUCTURE.md
+++ b/REPO_STRUCTURE.md
@@ -24,7 +24,7 @@ Every repo name should read like a **reference in a paper**, not a product.
| Kind | Purpose | Primary content | Primary license |
|---|---|---|---|
-| **Definition** | Own the language | Markdown + YAML schemas | CC BY 4.0 |
+| **Definition** | Own the language | Markdown + YAML schemas | MIT (schemas) / CC BY 4.0 (prose) |
| **Executable** | Earn dev respect | CLI / scanner / linter | MIT |
| **Reference** | Show what good looks like | One pattern, runnable | CC BY 4.0 / MIT |
diff --git a/docs/schemas.md b/docs/schemas.md
index 43bfa2a..193346d 100644
--- a/docs/schemas.md
+++ b/docs/schemas.md
@@ -12,7 +12,7 @@ the CLI does not duplicate heuristic text, IDs, or the trust-stage mapping.
| [`schemas/agent-spec.schema.yaml`](../schemas/agent-spec.schema.yaml) | Audit input |
| [`schemas/memory-policy.schema.yaml`](../schemas/memory-policy.schema.yaml) | Memory governance |
-License: **CC BY 4.0**. See [`LICENSING.md`](../LICENSING.md).
+License: **MIT** ([`schemas/LICENSE`](../schemas/LICENSE)) — embed or vendor them freely. See [`LICENSING.md`](../LICENSING.md) for the full map.
The Evolution Curve is mentioned in
[`onboarding/appendix-a-vocabulary.md`](../onboarding/appendix-a-vocabulary.md)
diff --git a/onboarding/for-ctos.md b/onboarding/for-ctos.md
index f491450..476f041 100644
--- a/onboarding/for-ctos.md
+++ b/onboarding/for-ctos.md
@@ -2,7 +2,7 @@
*You'll be asked if your agents are trustworthy. Here's a defensible framework — and the open standard you can adopt or fork.*
-> **AUX** is an open standard for agentic UX published at **github.com/auxfirst** — schemas and heuristics are **CC BY 4.0**, tooling is **MIT**. Fork it, cite it, extend it.
+> **AUX** is an open standard for agentic UX published at **github.com/auxfirst** — the schemas and the tooling are **MIT**, so your team can vendor them without a legal review. The written guides are CC BY 4.0. Fork it, cite it, extend it.
This is the 5-minute version. The long version is **[ARCHITECTURE.md](../ARCHITECTURE.md)**. The executable version is **[aux-audit](../packages/aux-audit/README.md)** (GitHub Action: `auxfirst/trustkit@v0.2`).
diff --git a/onboarding/forwardables/A2-cto-exec-brief.md b/onboarding/forwardables/A2-cto-exec-brief.md
index 76c004c..10035ba 100644
--- a/onboarding/forwardables/A2-cto-exec-brief.md
+++ b/onboarding/forwardables/A2-cto-exec-brief.md
@@ -2,7 +2,7 @@
*Executive brief · auxfirst · v0.1*
-**Source.** This page adopts **AUX** — an open standard for agentic UX published at **github.com/auxfirst**. Schemas + heuristics are CC BY 4.0; CLIs are MIT. Forkable. Citable. Not vendor-locked.
+**Source.** This page adopts **AUX** — an open standard for agentic UX published at **github.com/auxfirst**. The schemas and the CLI are MIT, so they can go straight into a codebase. Forkable. Citable. Not vendor-locked.
This is the one-page version. The framework is open-standard and forkable.
@@ -51,4 +51,4 @@ Adopt the framework with a 90-day pilot on one product. At day 90, the product h
---
-Source: auxfirst · aux-frameworks, aux-audit · CC BY 4.0.
+Source: auxfirst · aux-frameworks, aux-audit · schemas and tooling MIT, this brief CC BY 4.0.
diff --git a/packages/aux-audit/LICENSE b/packages/aux-audit/LICENSE
index 0394c3a..67070c6 100644
--- a/packages/aux-audit/LICENSE
+++ b/packages/aux-audit/LICENSE
@@ -22,5 +22,6 @@ SOFTWARE.
---
-The canonical AUX definitions bundled under `schemas/` are licensed
-CC BY 4.0, not MIT. See https://github.com/auxfirst/trustkit/blob/main/LICENSE.
+The canonical AUX definitions bundled under `schemas/` are MIT as well, and
+carry their own copy of this license. See
+https://github.com/auxfirst/trustkit/blob/main/LICENSING.md.
diff --git a/packages/aux-audit/README.md b/packages/aux-audit/README.md
index 663c1d7..82625c3 100644
--- a/packages/aux-audit/README.md
+++ b/packages/aux-audit/README.md
@@ -134,4 +134,4 @@ npm run build
## License
-MIT for the tooling. The bundled AUX definitions under `schemas/` are CC BY 4.0 — see [LICENSE](LICENSE).
+MIT throughout — the CLI and the bundled AUX schemas alike. See [LICENSE](LICENSE).
diff --git a/packages/aux-audit/schemas/LICENSE b/packages/aux-audit/schemas/LICENSE
new file mode 100644
index 0000000..26be78b
--- /dev/null
+++ b/packages/aux-audit/schemas/LICENSE
@@ -0,0 +1,31 @@
+MIT License
+
+Copyright (c) 2026 auxfirst
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+This MIT license covers the machine-readable definitions in this directory —
+the .yaml files you embed, vendor, or generate from.
+
+The prose that explains them (onboarding/, the vocabulary appendix, pattern
+write-ups) is CC BY 4.0; see ../LICENSING.md for the full map. Attribution is
+still appreciated everywhere, but it is not a condition of using these files
+in your own code.
diff --git a/packages/aux-audit/schemas/agent-spec.schema.yaml b/packages/aux-audit/schemas/agent-spec.schema.yaml
index 9035fde..88f5106 100644
--- a/packages/aux-audit/schemas/agent-spec.schema.yaml
+++ b/packages/aux-audit/schemas/agent-spec.schema.yaml
@@ -1,5 +1,6 @@
# Agent Spec — input format for `aux-audit`
# Version: 0.1.0
+# License: MIT (see schemas/LICENSE)
# A minimal, opinionated description of an agentic product.
# Fields marked "required" will cause the audit to refuse to run if missing.
diff --git a/packages/aux-audit/schemas/aux-heuristics.yaml b/packages/aux-audit/schemas/aux-heuristics.yaml
index d8d1e5c..359c559 100644
--- a/packages/aux-audit/schemas/aux-heuristics.yaml
+++ b/packages/aux-audit/schemas/aux-heuristics.yaml
@@ -1,6 +1,6 @@
# AUX Heuristics — canonical definition
# Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
# Referenced by: aux-audit, trust-gap-classifier, agent-ux-teardowns
version: "0.1.0"
diff --git a/packages/aux-audit/schemas/trust-architecture.yaml b/packages/aux-audit/schemas/trust-architecture.yaml
index 180229b..27d8c79 100644
--- a/packages/aux-audit/schemas/trust-architecture.yaml
+++ b/packages/aux-audit/schemas/trust-architecture.yaml
@@ -1,6 +1,6 @@
# Trust Architecture — 4-stage maturity ladder
# Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
version: "0.1.0"
name: "Trust Architecture"
diff --git a/packages/aux-audit/schemas/trust-gap-taxonomy.yaml b/packages/aux-audit/schemas/trust-gap-taxonomy.yaml
index e3c6f6b..a149d28 100644
--- a/packages/aux-audit/schemas/trust-gap-taxonomy.yaml
+++ b/packages/aux-audit/schemas/trust-gap-taxonomy.yaml
@@ -1,6 +1,6 @@
# Trust Gap Taxonomy — named failure modes for agent trust
# Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
# Each gap maps to: a heuristic (what broke), a trust stage (what was violated),
# and a fix pattern (how to close it).
diff --git a/packages/aux-audit/scripts/sync-schemas.mjs b/packages/aux-audit/scripts/sync-schemas.mjs
index 89aad5f..1201aab 100644
--- a/packages/aux-audit/scripts/sync-schemas.mjs
+++ b/packages/aux-audit/scripts/sync-schemas.mjs
@@ -22,6 +22,8 @@ const FILES = [
"trust-architecture.yaml",
"trust-gap-taxonomy.yaml",
"agent-spec.schema.yaml",
+ // The schemas are MIT and say so next to themselves, in the tarball too.
+ "LICENSE",
];
const check = process.argv.includes("--check");
diff --git a/profile/README.md b/profile/README.md
index 45dbf61..f5e3122 100644
--- a/profile/README.md
+++ b/profile/README.md
@@ -103,7 +103,7 @@ Every repo has a `CONTRIBUTING.md`. The short version: **patterns need diagrams,
## License
-Definition repos: **CC BY 4.0**. Executable repos: **MIT**. Teardowns: **CC BY-NC 4.0** (attribution, non-commercial).
+Machine-readable definitions and tooling: **MIT** — embed them, no attribution condition. Prose: **CC BY 4.0**. Teardowns: **CC BY-NC 4.0**.
---
diff --git a/repos/aux-frameworks/README.md b/repos/aux-frameworks/README.md
index 1b0a82f..493df46 100644
--- a/repos/aux-frameworks/README.md
+++ b/repos/aux-frameworks/README.md
@@ -48,4 +48,4 @@ SemVer on the framework level. Breaking change = renumber or remove a rule. Chan
## License
-CC BY 4.0. Use it. Attribute it. Extend it.
+MIT for the YAML you embed; CC BY 4.0 for the prose that explains it. Use it. Extend it. Attribution is wanted, not required.
diff --git a/repos/trust-gap-classifier/README.md b/repos/trust-gap-classifier/README.md
index 60f3eac..40ddeac 100644
--- a/repos/trust-gap-classifier/README.md
+++ b/repos/trust-gap-classifier/README.md
@@ -80,4 +80,4 @@ Every detected gap maps back to:
## License
-CC BY 4.0 for the taxonomy. MIT for the detector code.
+MIT — both the taxonomy YAML and the detector code. Embed either.
diff --git a/schemas/LICENSE b/schemas/LICENSE
new file mode 100644
index 0000000..26be78b
--- /dev/null
+++ b/schemas/LICENSE
@@ -0,0 +1,31 @@
+MIT License
+
+Copyright (c) 2026 auxfirst
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+This MIT license covers the machine-readable definitions in this directory —
+the .yaml files you embed, vendor, or generate from.
+
+The prose that explains them (onboarding/, the vocabulary appendix, pattern
+write-ups) is CC BY 4.0; see ../LICENSING.md for the full map. Attribution is
+still appreciated everywhere, but it is not a condition of using these files
+in your own code.
diff --git a/schemas/agent-spec.schema.yaml b/schemas/agent-spec.schema.yaml
index 9035fde..88f5106 100644
--- a/schemas/agent-spec.schema.yaml
+++ b/schemas/agent-spec.schema.yaml
@@ -1,5 +1,6 @@
# Agent Spec — input format for `aux-audit`
# Version: 0.1.0
+# License: MIT (see schemas/LICENSE)
# A minimal, opinionated description of an agentic product.
# Fields marked "required" will cause the audit to refuse to run if missing.
diff --git a/schemas/aux-heuristics.yaml b/schemas/aux-heuristics.yaml
index d8d1e5c..359c559 100644
--- a/schemas/aux-heuristics.yaml
+++ b/schemas/aux-heuristics.yaml
@@ -1,6 +1,6 @@
# AUX Heuristics — canonical definition
# Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
# Referenced by: aux-audit, trust-gap-classifier, agent-ux-teardowns
version: "0.1.0"
diff --git a/schemas/memory-policy.schema.yaml b/schemas/memory-policy.schema.yaml
index 3354422..95f40d3 100644
--- a/schemas/memory-policy.schema.yaml
+++ b/schemas/memory-policy.schema.yaml
@@ -1,6 +1,6 @@
# Memory Policy Schema — input for `agent-memory-policy`
# Version: 0.1.0
-# License: MIT
+# License: MIT (see schemas/LICENSE)
version: "0.1.0"
diff --git a/schemas/trust-architecture.yaml b/schemas/trust-architecture.yaml
index 180229b..27d8c79 100644
--- a/schemas/trust-architecture.yaml
+++ b/schemas/trust-architecture.yaml
@@ -1,6 +1,6 @@
# Trust Architecture — 4-stage maturity ladder
# Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
version: "0.1.0"
name: "Trust Architecture"
diff --git a/schemas/trust-contract.yaml b/schemas/trust-contract.yaml
index 17a3ae6..49bd61c 100644
--- a/schemas/trust-contract.yaml
+++ b/schemas/trust-contract.yaml
@@ -1,6 +1,6 @@
# Trust Contract — the explicit contract an agent makes with its user
# Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
#
# A Trust Contract is the machine-readable declaration of:
# - what the agent will do without asking
diff --git a/schemas/trust-gap-taxonomy.yaml b/schemas/trust-gap-taxonomy.yaml
index e3c6f6b..a149d28 100644
--- a/schemas/trust-gap-taxonomy.yaml
+++ b/schemas/trust-gap-taxonomy.yaml
@@ -1,6 +1,6 @@
# Trust Gap Taxonomy — named failure modes for agent trust
# Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
# Each gap maps to: a heuristic (what broke), a trust stage (what was violated),
# and a fix pattern (how to close it).