Licensing release checklist and evidence workflow

Documentation checkpoint gate

python3 tools/governance/check_licensing.py --mode docs checks that declared direct packages and source media are all represented in config/license-evidence.json, validates statuses, asset hashes and the necessary licensing publication pages. This is an inventory gate, not a legal clearance.

Commercial distribution gate

python3 tools/governance/check_licensing.py --mode commercial requires affirmative reviewed evidence and flags an incomplete transitive SBOM, any unverified item and missing release-specific notices. It must remain BLOCKED until evidence is supplied and independently reviewed. Never edit statuses just to make a gate pass.

Release-specific decisions

For each WordPress plugin ZIP, API source release, native binary or public documentation bundle: identify files included, licence sources, notices/credits and links to evidence; approve only the rights relevant to the actual distribution. Keep the reviewing person's name, date and any restrictions. If a dependency is dropped or replaced, preserve its historical record and record the change.

Legal escalation

Escalate GPL obligations, conflicting licences, brand/photos without permission, SaaS terms, open-source copyleft triggers, patented technology and unclear privacy obligations. A reviewed SPDX string is necessary but not sufficient. The development history records the review decision; WordPress page revisions record changes to published documents.