Licensing and identity¶
This page explains how Skill Family Foundation adopts its license, the distinction between identity roles, and the current status of NOTICE and third-party attribution. It is not an official translation of the Apache License 2.0; the legal text of Apache-2.0 is the root-level LICENSE, and in case of any ambiguity the English original prevails.
License¶
- License:
Apache-2.0(the SPDX identifier is unchanged). - Legal text: the root-level
LICENSEis the full Apache License 2.0 text (authoritative in English). This page and any Chinese material only explain how the license is adopted; they do not replace or restate the legal text and do not claim equal legal effect. - The three leaf packages distribute a copy of the root
LICENSEwith the package.
Distinction between identity roles¶
The following four identities are independent; none may be inferred from or merged with another:
| Role | Value | Notes |
|---|---|---|
| Author / copyright holder | Guangzhou Fenghe Technology Co., Ltd. (广州市风荷科技有限公司) | The copyright owner; written into package.json's author and the LICENSE appendix attribution |
| Repository owner (GitHub owner) | ifoohoo |
The GitHub organization/account; no inference relationship with the author |
| npm publisher | The account in the current publish configuration | The npm publish identity; no inference relationship with author/owner |
| Contributor copyright line | The contributors attribution in the root LICENSE appendix |
A retained historical/contributor attribution, not the project author or copyright holder |
author, repository.owner, and npm publisher are recorded separately; none may be derived from another.
Project-level NOTICE¶
FND-ADR-008 adopts Option B following the user's explicit ruling on 2026-08-10. Foundation now maintains a root NOTICE containing the project name, the year 2026, and the copyright holder, 广州市风荷科技有限公司 (Guangzhou Fenghe Technology Co., Ltd.). Starting with 0.2.1, the three public-unit mirrors, frozen snapshots, and npm tarballs must all distribute that file.
The open-source Profile continues to declare noticeRequired: true. Engineering Kit continues to enforce the invariant between Apache-2.0 and the NOTICE requirement, and checkIdentityDrift continues to report notice-missing when the file is absent. This closure changes only Foundation's publish members; it does not alter the Kit's behavior for other consumers.
Under Section 4(d) of the Apache License 2.0 in the root LICENSE, NOTICE content is informational and attributional; it does not modify the terms of the Apache License 2.0.
Third-party attribution (THIRD_PARTY_NOTICES)¶
The Engineering Kit public unit distributes MkDocs Material, lunr, and lunr-languages assets and already includes packages/skill-family-engineering-kit/THIRD_PARTY_NOTICES with the corresponding third-party license material. Third-party attribution remains covered by THIRD_PARTY_NOTICES and the corresponding license closure; the project-level NOTICE must not replace them. The NOTICE carries only Foundation's own project attribution and does not copy full third-party license texts.
License boundary between the private workspace and public mirrors¶
- This workspace is permanently private and is the single source of development truth; the workspace itself never enters the public boundary.
- The public boundary consists only of three versioned publish mirrors and npm tarballs; they distribute the root
LICENSE(Apache-2.0) andNOTICE. Engineering Kit additionally distributesTHIRD_PARTY_NOTICESand the corresponding third-party license material. - Profiles, fixtures, internal docs, and run evidence inside the private workspace do not enter the public packages; public docs only consume artifacts mechanically verified by the allowlist and release contract.
- Publish state and all remote writes belong to release-skill; this page does not duplicate live publish state.