[plainprogrammer]

Closes #402.

What this does

A pull request that adds a gem, or a JavaScript package, font or icon set the third-party manifest lists, under a licence the project hasn't allowed now fails bin/ci checks. The failure names the dependency, its licence and config/licence_policy.yml, which records the allowed SPDX ids and the named exceptions. It judges the list spec 087's reader already builds, so there is no second reader of the bundle, and it reports spec 087's guard too, so an importmap pin with no entry fails the checks job as well as the suite.

• Allowed (the maintainer's ruling, 2026-11-13): MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0, ISC, Ruby, OFL-1.1, and nothing else.
• Several licences: a component passes if any one is allowed (lets in rdoc as Ruby, diff-lcs as MIT). A missing or unrecognised string fails; nothing is normalised.
• Exceptions: bundler-audit (GPL-3.0-or-later), brakeman (Brakeman Public Use License) and vcr (Hippocratic-2.1, MIT), each a tool the app never loads. An exception goes stale, and fails, when the gem leaves the lockfile, declares other licences, or is allowed without it. vcr uses all_required: true, because its MIT is unverified and an ordinary exception for it would read as stale (spec decision 3).
• Every Bundler group is judged, so the rule doesn't depend on The image leaves out the test and lint gems #408.
• Step: "Licences: dependencies are under allowed licences", bin/rails licences:check, after the importmap audit in config/ci.rb. No workflow, Dockerfile or settings change.

Spec 091 (v0.5.2), ADR 0031 (Proposed; becomes Accepted with this PR), the plan, verification.md, the area docs (catalog core, release and deploy), CLAUDE.md and two rules files are in the PR.

Proof

• The rules by injection: policy_spec.rb, check_spec.rb, licences_rake_spec.rb (in-process, exit status and streams), and the step's place in ci_definition_spec.rb; the suite is 5073 examples (bin/rspec --dry-run), and the pre-push hook ran the one full bin/ci on this SHA.
• The real task failing: a policy copy without Apache-2.0 and without the brakeman exception made bin/rails "licences:check[...]" print 8 problems, one per dependency with its licence and the policy path, and exit 1. Today's tree passes: Licences: 151 components judged.
• bin/ci checks time: 35.5 s before; 30.98 s (cold), 24.70 s, 25.80 s and 25.64 s after. The totals are lower than the baseline because other workers share the machine; the step's own cost is 1.2 to 1.3 s.
• Reviews: spec (Fable, 2 rounds), ADR and spec (Fable), plan (Fable), implementation (Opus 5.5, SPEC-ALIGNED WITH FINDINGS, all fixed except the README note below). Spec, ADR, plan and docs: Sonnet 5.5 (main session); code: Sonnet 5.5 implementers.

Owed to the maintainer

• vcr 6.4.1 declares Hippocratic-2.1 and MIT and ships no licence file; whether the MIT is a real choice is unverified upstream. It is a named exception for that reason; checking upstream would settle it.
• README.md's numbered bin/ci step list (lines 124 to 132) predates this branch (no migration guard, YARD or ratchet) and now also lacks the licence check. Not changed.
• Merge conflicts to expect in docs/specs/README.md and docs/adr/README.md (siblings add their rows at the same place).

🤖 Generated with Claude Code