From ff3b0da5dd0fed627215e04e5aaa03c9b83eb6da Mon Sep 17 00:00:00 2001 From: LeadGoEngineer Date: Mon, 18 May 2026 22:31:25 -0400 Subject: [PATCH] docs: add LICENSING.md referenced by README (follow-up to #37) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #37 promised LICENSING.md but the file was not actually included in the merge. README already links to it. This commit adds the file: - Records the v0.1.0–v1.0.1 GPL-2.0 history (gocronometer-linked) and the v1.1.0 MIT-clean cut. - Documents the clean-room ground rules used in the QUA-37 rewrite (public API surface only, no `gocronometer` source consulted). - Provides reproducibility steps (`go mod why`, `go list -m all`). Satisfies QUA-37 acceptance criterion #2 (LICENSING.md discloses GPL history and MIT-clean cut). Co-Authored-By: Paperclip --- LICENSING.md | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 LICENSING.md diff --git a/LICENSING.md b/LICENSING.md new file mode 100644 index 0000000..68d4cef --- /dev/null +++ b/LICENSING.md @@ -0,0 +1,59 @@ +# Licensing history + +`crono-export-cli` is released under the MIT licence (see [LICENSE](LICENSE)). +This file records the licensing history of the project so that downstream +consumers can reason about which releases are MIT-clean. + +## Summary + +- **v1.1.0 and later — MIT-clean.** The CLI talks to Cronometer through an + in-tree, fresh-authored HTTP client under [`internal/cronoapi/`](internal/cronoapi). + Every transitive dependency reported by `go list -m all` is MIT, BSD, or + Apache-2.0. No GPL code is linked into the binary. +- **v0.1.0 through v1.0.1 — linked GPL-2.0 code.** These releases imported + [`github.com/jrmycanady/gocronometer`](https://github.com/jrmycanady/gocronometer) + (GPL-2.0) as the Cronometer client and were therefore subject to GPL-2.0 + obligations at distribution time. Users who built from those tags should + treat the resulting binaries as GPL-2.0. + +The earlier release notes have been amended to point at v1.1.0 as the first +MIT-clean cut. + +## Clean-room replacement (QUA-12 / QUA-37) + +The replacement Cronometer client in `internal/cronoapi/` was written from a +specification, not from the GPL source. The ground rules followed during the +rewrite: + +- **Inputs allowed.** `gocronometer`'s *public* API surface (exported names + and signatures, visible via `go doc`) and Cronometer's own observable HTTP + behaviour, captured against a real account into redacted fixtures. +- **Inputs not allowed.** `gocronometer`'s source code, internal helpers, or + unexported identifiers. +- **Spec doc.** [`docs/cronometer-protocol.md`](docs/cronometer-protocol.md) + describes the Cronometer endpoints, GWT request/response shapes, and the + authentication handshake that the new client implements. +- **Fixtures.** Recorded HTTP traces live under + [`internal/cronoapi/testdata/`](internal/cronoapi/testdata/) and were + redacted before commit (`tools/wirecap/`). +- **Tests.** Unit tests for the new client exercise the fixtures only; they + do not import `gocronometer` and never have. + +The implementation PR ([#37](https://github.com/quantcli/crono-export-cli/pull/37)) +states explicitly that no `gocronometer` source was consulted during the +rewrite. + +## Verifying MIT-cleanliness + +```sh +# Confirms gocronometer is not in the build graph. +go mod why github.com/jrmycanady/gocronometer +# Expected: "(main module does not need package github.com/jrmycanady/gocronometer)" + +# Lists every module in the build graph; review for licences. +go list -m all +``` + +If you discover a transitive GPL (or other copyleft) dependency in a +v1.1.0+ release, please open an issue against `quantcli/crono-export-cli` +so we can either drop or replace it.