license: schemas are MIT, prose is CC BY 4.0

CITATION.cff

@@ -4,16 +4,18 @@ title: "TrustKit — AUX (Agentic User Experience) heuristics, trust architectur
 abstract: >-
   Canonical, forkable definitions for Agentic User Experience (AUX): the 10 AUX
   Heuristics, the 4-stage Trust Architecture, the Trust Gap Taxonomy, and the
-  agent-spec / memory-policy schemas. Definitions are CC BY 4.0; executable
-  tooling is MIT.
+  agent-spec / memory-policy schemas. The schemas and the tooling are MIT; the
+  prose that explains them is CC BY 4.0. Citation is requested, not required.
 type: software
 authors:
   - name: "auxfirst"
     website: "https://auxfirst.com"
     email: "founder@auxfirst.com"
 repository-code: "https://github.com/auxfirst/trustkit"
 url: "https://auxfirst.com"
-license: CC-BY-4.0
+license:
+  - MIT
+  - CC-BY-4.0
 version: "0.2"
 date-released: "2026-04-19"
 keywords:

CONTRIBUTING.md

@@ -36,4 +36,4 @@ Contributors are listed in `CONTRIBUTORS.md` with the IDs / patterns they author
 
 ## License
 
-By contributing you agree your contribution is licensed under the repo's declared license (CC BY 4.0 for definition repos, MIT for executable repos, CC BY-NC 4.0 for teardowns).
+By contributing you agree your contribution is licensed under the license for that artifact type in [LICENSING.md](LICENSING.md): MIT for schemas and tooling, CC BY 4.0 for prose, CC BY-NC 4.0 for teardown content.

LICENSING.md

@@ -1,13 +1,42 @@
 # Licensing
 
-TrustKit is dual-licensed by artifact type. GitHub’s license detector reads
-[`LICENSE`](LICENSE), which is the unmodified **CC BY 4.0** legal code.
+TrustKit is licensed by artifact type, on one rule:
+
+> **Machine-readable definitions are MIT. Prose is CC BY 4.0.**
+
+If a file is something you embed, vendor, parse, or generate from, it is MIT
+and carries no attribution condition. If it is something you read, it is
+CC BY 4.0 and attribution is the price.
+
+GitHub's license detector reads the root [`LICENSE`](LICENSE), the unmodified
+CC BY 4.0 legal code, so the repository badge says **CC BY 4.0**. That covers
+the prose, which is most of the repository by volume. It does not describe
+`schemas/`, which is MIT — see the table.
 
 | Artifact | License | File |
 |---|---|---|
-| Definitions: schemas, onboarding, vocabulary, patterns, teardowns metadata | **CC BY 4.0** | [`LICENSE`](LICENSE) |
-| Executable tooling: `packages/aux-audit`, `action.yml` | **MIT** | [`packages/aux-audit/LICENSE`](packages/aux-audit/LICENSE) |
-| Teardown *content* under `repos/agent-ux-teardowns/teardowns/` (when added) | **CC BY-NC 4.0** | declared in that tree |
+| **Schemas** — every `.yaml` under [`schemas/`](schemas/) | **MIT** | [`schemas/LICENSE`](schemas/LICENSE) |
+| **Executable tooling** — `packages/aux-audit`, `action.yml` | **MIT** | [`packages/aux-audit/LICENSE`](packages/aux-audit/LICENSE) |
+| **Prose** — onboarding, vocabulary, pattern write-ups, architecture, this file | **CC BY 4.0** | [`LICENSE`](LICENSE) |
+| **Teardown content** under `repos/agent-ux-teardowns/teardowns/` (when added) | **CC BY-NC 4.0** | declared in that tree |
+
+## Why the schemas are MIT
+
+The point of publishing the heuristics, the trust ladder, and the gap taxonomy
+as YAML is that other people put them **inside** things — a CI check, a linter,
+a scoring service, a product's own config. Creative Commons says plainly that
+its licenses are not intended for software, and many legal teams will not
+approve CC-licensed files in a codebase. A license that makes a corporate
+adopter open a ticket is a license that loses the adoption.
+
+Attribution is still wanted, and [`CITATION.cff`](CITATION.cff) makes it
+one click. It is just not a condition of use.
+
+## What this means in practice
 
-The bundled YAML under `packages/aux-audit/schemas/` is a copy of the canonical
-definitions and remains **CC BY 4.0**, even though the CLI that reads it is MIT.
+- **Vendoring `aux-heuristics.yaml` into a closed-source product** — fine, MIT.
+- **Shipping a tool that bundles the schemas** — fine, MIT, which is why the
+  copies under `packages/aux-audit/schemas/` need no separate carve-out.
+- **Quoting the onboarding docs in a blog post** — CC BY 4.0, so credit
+  auxfirst and link back.
+- **Reselling a teardown** — no; teardown content is CC BY-NC 4.0.

README.md

@@ -7,7 +7,7 @@
 
 **Project home: [auxfirst.com](https://auxfirst.com)** · [`aux-audit`](packages/aux-audit/) · [Schemas](schemas/) · [Onboarding](onboarding/README.md) · [Docs](docs/index.md) · [Cite this work](CITATION.cff)
 
-**AUX** (Agentic User Experience) is an open standard. The 10 AUX Heuristics, the 4-stage Trust Architecture, and the Trust Gap Taxonomy are published as editable YAML schemas — forkable, citable, not vendor-locked. Definitions are **CC BY 4.0**; executable tooling is **MIT**.
+**AUX** (Agentic User Experience) is an open standard. The 10 AUX Heuristics, the 4-stage Trust Architecture, and the Trust Gap Taxonomy are published as editable YAML schemas — forkable, citable, not vendor-locked. The schemas are **MIT** — embed them, vendor them, no attribution condition. The prose around them is **CC BY 4.0**.
 
 If you ship AI products, you are no longer designing screens. You are designing an ongoing relationship between a user and an agent that has memory, initiative, and judgment. Classical UX was built for tools. AUX is built for relationships.
 
@@ -103,8 +103,8 @@ Or read **[onboarding/README.md](onboarding/README.md)** — the router with all
 ├── docs/                          ← static-site copy (canonical path TBD)
 ├── CHANGELOG.md                   ← what shipped
 ├── CITATION.cff                   ← how to cite AUX definitions
-├── LICENSE                        ← CC BY 4.0 (GitHub-detectable legal code)
-├── LICENSING.md                   ← dual-license map (CC BY / MIT / CC BY-NC)
+├── LICENSE                        ← CC BY 4.0 (prose; GitHub-detectable legal code)
+├── LICENSING.md                   ← license map: machine-readable = MIT, prose = CC BY
 └── .github/                       ← Issue templates, PR template, CI
 ```
 
@@ -155,11 +155,13 @@ GitHub renders it behind the *Cite this repository* button as APA or BibTeX.
 
 ## License
 
-- Definition content (schemas, frameworks, heuristics, vocabulary): **CC BY 4.0**.
-- Executable tooling (`packages/aux-audit`, `action.yml`): **MIT**.
+One rule: **machine-readable definitions are MIT, prose is CC BY 4.0.**
+
+- Schemas (`schemas/*.yaml`) and tooling (`packages/aux-audit`, `action.yml`): **MIT**. Embed them; no attribution condition.
+- Prose (onboarding, vocabulary, pattern write-ups): **CC BY 4.0**.
 - Teardown content: **CC BY-NC 4.0** (attribution, non-commercial).
 
-See **[LICENSE](LICENSE)** for the CC BY 4.0 legal code and **[LICENSING.md](LICENSING.md)** for the dual-license map (tooling is MIT).
+GitHub's badge reads CC BY 4.0 because it detects the root **[LICENSE](LICENSE)**, which covers the prose. The schemas are not CC — see **[LICENSING.md](LICENSING.md)** and **[schemas/LICENSE](schemas/LICENSE)**.
 
 ## Status
 

REPO_STRUCTURE.md

@@ -24,7 +24,7 @@ Every repo name should read like a **reference in a paper**, not a product.
 
 | Kind | Purpose | Primary content | Primary license |
 |---|---|---|---|
-| **Definition** | Own the language | Markdown + YAML schemas | CC BY 4.0 |
+| **Definition** | Own the language | Markdown + YAML schemas | MIT (schemas) / CC BY 4.0 (prose) |
 | **Executable** | Earn dev respect | CLI / scanner / linter | MIT |
 | **Reference** | Show what good looks like | One pattern, runnable | CC BY 4.0 / MIT |
 

docs/schemas.md

@@ -12,7 +12,7 @@ the CLI does not duplicate heuristic text, IDs, or the trust-stage mapping.
 | [`schemas/agent-spec.schema.yaml`](../schemas/agent-spec.schema.yaml) | Audit input |
 | [`schemas/memory-policy.schema.yaml`](../schemas/memory-policy.schema.yaml) | Memory governance |
 
-License: **CC BY 4.0**. See [`LICENSING.md`](../LICENSING.md).
+License: **MIT** ([`schemas/LICENSE`](../schemas/LICENSE)) — embed or vendor them freely. See [`LICENSING.md`](../LICENSING.md) for the full map.
 
 The Evolution Curve is mentioned in
 [`onboarding/appendix-a-vocabulary.md`](../onboarding/appendix-a-vocabulary.md)

onboarding/for-ctos.md

@@ -2,7 +2,7 @@
 
 *You'll be asked if your agents are trustworthy. Here's a defensible framework — and the open standard you can adopt or fork.*
 
-> **AUX** is an open standard for agentic UX published at **github.com/auxfirst** — schemas and heuristics are **CC BY 4.0**, tooling is **MIT**. Fork it, cite it, extend it.
+> **AUX** is an open standard for agentic UX published at **github.com/auxfirst** — the schemas and the tooling are **MIT**, so your team can vendor them without a legal review. The written guides are CC BY 4.0. Fork it, cite it, extend it.
 
 This is the 5-minute version. The long version is **[ARCHITECTURE.md](../ARCHITECTURE.md)**. The executable version is **[aux-audit](../packages/aux-audit/README.md)** (GitHub Action: `auxfirst/trustkit@v0.2`).
 

onboarding/forwardables/A2-cto-exec-brief.md

@@ -2,7 +2,7 @@
 
 *Executive brief · auxfirst · v0.1*
 
-**Source.** This page adopts **AUX** — an open standard for agentic UX published at **github.com/auxfirst**. Schemas + heuristics are CC BY 4.0; CLIs are MIT. Forkable. Citable. Not vendor-locked.
+**Source.** This page adopts **AUX** — an open standard for agentic UX published at **github.com/auxfirst**. The schemas and the CLI are MIT, so they can go straight into a codebase. Forkable. Citable. Not vendor-locked.
 
 This is the one-page version. The framework is open-standard and forkable.
 
@@ -51,4 +51,4 @@ Adopt the framework with a 90-day pilot on one product. At day 90, the product h
 
 ---
 
-<sub>Source: auxfirst · aux-frameworks, aux-audit · CC BY 4.0.</sub>
+<sub>Source: auxfirst · aux-frameworks, aux-audit · schemas and tooling MIT, this brief CC BY 4.0.</sub>

packages/aux-audit/LICENSE

@@ -22,5 +22,6 @@ SOFTWARE.
 
 ---
 
-The canonical AUX definitions bundled under `schemas/` are licensed
-CC BY 4.0, not MIT. See https://github.com/auxfirst/trustkit/blob/main/LICENSE.
+The canonical AUX definitions bundled under `schemas/` are MIT as well, and
+carry their own copy of this license. See
+https://github.com/auxfirst/trustkit/blob/main/LICENSING.md.

packages/aux-audit/README.md

@@ -134,4 +134,4 @@ npm run build
 
 ## License
 
-MIT for the tooling. The bundled AUX definitions under `schemas/` are CC BY 4.0 — see [LICENSE](LICENSE).
+MIT throughout — the CLI and the bundled AUX schemas alike. See [LICENSE](LICENSE).

packages/aux-audit/schemas/LICENSE

@@ -0,0 +1,31 @@
+MIT License
+
+Copyright (c) 2026 auxfirst
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+This MIT license covers the machine-readable definitions in this directory —
+the .yaml files you embed, vendor, or generate from.
+
+The prose that explains them (onboarding/, the vocabulary appendix, pattern
+write-ups) is CC BY 4.0; see ../LICENSING.md for the full map. Attribution is
+still appreciated everywhere, but it is not a condition of using these files
+in your own code.

packages/aux-audit/schemas/agent-spec.schema.yaml

@@ -1,5 +1,6 @@
 # Agent Spec — input format for `aux-audit`
 # Version: 0.1.0
+# License: MIT (see schemas/LICENSE)
 # A minimal, opinionated description of an agentic product.
 # Fields marked "required" will cause the audit to refuse to run if missing.
 

packages/aux-audit/schemas/aux-heuristics.yaml

@@ -1,6 +1,6 @@
 # AUX Heuristics — canonical definition
 # Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
 # Referenced by: aux-audit, trust-gap-classifier, agent-ux-teardowns
 
 version: "0.1.0"

packages/aux-audit/schemas/trust-architecture.yaml

@@ -1,6 +1,6 @@
 # Trust Architecture — 4-stage maturity ladder
 # Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
 
 version: "0.1.0"
 name: "Trust Architecture"

packages/aux-audit/schemas/trust-gap-taxonomy.yaml

@@ -1,6 +1,6 @@
 # Trust Gap Taxonomy — named failure modes for agent trust
 # Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
 # Each gap maps to: a heuristic (what broke), a trust stage (what was violated),
 # and a fix pattern (how to close it).
 

packages/aux-audit/scripts/sync-schemas.mjs

@@ -22,6 +22,8 @@ const FILES = [
   "trust-architecture.yaml",
   "trust-gap-taxonomy.yaml",
   "agent-spec.schema.yaml",
+  // The schemas are MIT and say so next to themselves, in the tarball too.
+  "LICENSE",
 ];
 
 const check = process.argv.includes("--check");

profile/README.md

@@ -103,7 +103,7 @@ Every repo has a `CONTRIBUTING.md`. The short version: **patterns need diagrams,
 
 ## License
 
-Definition repos: **CC BY 4.0**. Executable repos: **MIT**. Teardowns: **CC BY-NC 4.0** (attribution, non-commercial).
+Machine-readable definitions and tooling: **MIT** — embed them, no attribution condition. Prose: **CC BY 4.0**. Teardowns: **CC BY-NC 4.0**.
 
 ---
 

repos/aux-frameworks/README.md

@@ -48,4 +48,4 @@ SemVer on the framework level. Breaking change = renumber or remove a rule. Chan
 
 ## License
 
-CC BY 4.0. Use it. Attribute it. Extend it.
+MIT for the YAML you embed; CC BY 4.0 for the prose that explains it. Use it. Extend it. Attribution is wanted, not required.

repos/trust-gap-classifier/README.md

@@ -80,4 +80,4 @@ Every detected gap maps back to:
 
 ## License
 
-CC BY 4.0 for the taxonomy. MIT for the detector code.
+MIT — both the taxonomy YAML and the detector code. Embed either.

schemas/LICENSE

@@ -0,0 +1,31 @@
+MIT License
+
+Copyright (c) 2026 auxfirst
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+This MIT license covers the machine-readable definitions in this directory —
+the .yaml files you embed, vendor, or generate from.
+
+The prose that explains them (onboarding/, the vocabulary appendix, pattern
+write-ups) is CC BY 4.0; see ../LICENSING.md for the full map. Attribution is
+still appreciated everywhere, but it is not a condition of using these files
+in your own code.

schemas/agent-spec.schema.yaml

@@ -1,5 +1,6 @@
 # Agent Spec — input format for `aux-audit`
 # Version: 0.1.0
+# License: MIT (see schemas/LICENSE)
 # A minimal, opinionated description of an agentic product.
 # Fields marked "required" will cause the audit to refuse to run if missing.
 

schemas/aux-heuristics.yaml

@@ -1,6 +1,6 @@
 # AUX Heuristics — canonical definition
 # Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
 # Referenced by: aux-audit, trust-gap-classifier, agent-ux-teardowns
 
 version: "0.1.0"

schemas/memory-policy.schema.yaml

@@ -1,6 +1,6 @@
 # Memory Policy Schema — input for `agent-memory-policy`
 # Version: 0.1.0
-# License: MIT
+# License: MIT (see schemas/LICENSE)
 
 version: "0.1.0"
 

schemas/trust-architecture.yaml

@@ -1,6 +1,6 @@
 # Trust Architecture — 4-stage maturity ladder
 # Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
 
 version: "0.1.0"
 name: "Trust Architecture"

schemas/trust-contract.yaml

@@ -1,6 +1,6 @@
 # Trust Contract — the explicit contract an agent makes with its user
 # Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
 #
 # A Trust Contract is the machine-readable declaration of:
 #   - what the agent will do without asking

schemas/trust-gap-taxonomy.yaml

@@ -1,6 +1,6 @@
 # Trust Gap Taxonomy — named failure modes for agent trust
 # Version: 0.1.0
-# License: CC BY 4.0
+# License: MIT (see schemas/LICENSE)
 # Each gap maps to: a heuristic (what broke), a trust stage (what was violated),
 # and a fix pattern (how to close it).