ariada.org

License matrix

The @ariada-org/* family ships under three OSS licenses and one documentation license. Every file in every published package carries an SPDX identifier in a header comment, and every package ships a REUSE.toml declaring per-file license and copyright. The repository is REUSE-compliant; the REUSE CLI runs in continuous integration on every push so downstream auditors can verify license obligations without cloning.

Per-package license matrix

Sixteen open-source packages: thirteen EUPL-1.2, three MIT, one dual EUPL-1.2 + CC0-1.0. Six HYBRID packages ship their commodity-outer surface under EUPL-1.2 (with the proprietary algorithmic core retained as separate closed code).

Package License Files covered Rationale
wcag-rules-extended EUPL-1.2 All TS sources + JSON rule corpora Core rule corpus — narrow Article 2 patent-peace grant + EU public-sector procurement compatibility
eaa-pipeline EUPL-1.2 Reusable workflow YAML + action sources CI differential gate commodity-outer surface; Article 2 grant attaches to OSS workflow
statement-generator EUPL-1.2 All TS sources + locale bundles EN 301 549 art. 7 compliance logic — EU regulatory primacy
penalty-estimator EUPL-1.2 (code) + CC-BY-4.0 (rate-card data) TS code + YAML rate cards EU-jurisdictional fine data — CC-BY-4.0 maximises downstream reuse for compliance research
evidence-emitter EUPL-1.2 All TS sources + JSON schemas VPAT + EN 301 549 evidence-bundle logic — EU-procurement-friendly
core-engine EUPL-1.2 TypeScript scanner orchestration core Commodity scanner adapter; OSS by distribution model (npm-distributed TS = readable JS on install)
core-browser EUPL-1.2 DOM adapter for Chrome / Edge / Firefox extension Commodity DOM adapter; Microsoft Insights ships the equivalent surface under MIT
core-playwright EUPL-1.2 Node + Chrome DevTools Protocol adapter Commodity orchestration glue; no proprietary inner surface
cli EUPL-1.2 Command-line runner Wraps the OSS scanner runtime; gap-closing vs Pa11y
design-plugin-scaffolds EUPL-1.2 Figma / UXP / Sketch plugin scaffolds Design-tool integration scaffolds; the closed colour-suggestion engine ships as a separate proprietary component
L0-mindset-framework EUPL-1.2 (code) + CC-BY-4.0 (prose) Companion repo ariada-org/l0-mindset-framework 10-rule architect-tier framework; CC-BY-4.0 standard for educational prose
Anti-overlay explainer CC-BY-4.0 Documentation under /anti-overlay/ Public-interest regulator-aligned explainer; CC-BY-4.0 for translation + republication
brand-tokens MIT CSS custom-property definitions only Commodity design tokens — MIT max-permissive adoption; no logo or wordmark files included
embed-badge MIT Web Component for embedding scan badges Commodity embed convention — MIT removes friction for downstream sites; trademark in badge artwork stays proprietary
dracula-agent MIT Commodity viz helpers Visualisation-library helpers; MIT for maximum integration reach (the Dracula character-renderer algorithm is a separate closed component, not these helpers)
test-fixtures EUPL-1.2 (code) + CC0-1.0 (HTML corpus) TS glue code under EUPL-1.2; HTML fixtures under CC0-1.0 Test corpus is most useful when freely combinable with any other corpus, including incompatibly-licensed ones

The six HYBRID commodity-outer packages (AI authorship attribution, multi-domain scanner, Dracula scan-flow visualisation, HAES ledger, CI differential gate, and the regulatory-context MCP server) inherit EUPL-1.2 on their published OSS surface; the closed algorithmic cores are not distributed as packages and carry no SPDX identifier on this site. See the component matrix for the OSS / closed boundary per HYBRID component.

Why EUPL-1.2

Thirteen of the sixteen published open-source packages ship under the European Union Public Licence v1.2. EUPL-1.2 is the European Commission's reciprocal-share license, explicitly compatible via its Annex with GPL-2.0, GPL-3.0, AGPL-3.0, Apache-2.0, and MPL-2.0. Three properties of EUPL-1.2 make it the right default for the compliance pipeline and scanner runtime:

  1. Patent peace via the Article 2 narrow grant. EUPL-1.2 Article 2 grants the Licensee «royalty-free, non-exclusive usage rights to any patents held by the Licensor, to the extent necessary to make use of the rights granted on the Work under this Licence». The «to the extent necessary» scope is materially narrower than Apache-2.0 §3's enumerated grant («make, use, sell, offer to sell, have made, import») — OSS users get full patent peace for what they actually do with the OSS code; commercial competitors cannot use a downstream fork as a back-door license to commercialise techniques covered by the closed cores. See /patents for the full OSS/closed boundary and the non-assertion pledge.
  2. EU Commission endorsement + public-sector procurement compatibility. EUPL-1.2 is published in twenty-three EU official languages with each version legally equivalent. National public-sector procurement frameworks in Sweden, France, Germany, Italy, the Netherlands, and elsewhere explicitly accept EUPL-1.2 as an interoperable choice. Adoption by a national accessibility-enforcement body (DIGG, BFB, DINUM) is not blocked by license-incompatibility review.
  3. CRA Article 24 Open Source Steward alignment. EUPL-1.2 Article 5 source-availability and license-text obligations map cleanly onto the documentation expectations the CRA places on Open Source Stewards. See the architecture page CRA section for the dual-class Manufacturer + Steward posture.

Why MIT for select packages

Three packages ship under MIT: brand-tokens, embed-badge, and dracula-agent. MIT is the right license for these surfaces for two reasons:

Why CC0-1.0 for fixtures

The test-fixtures package dual-licenses: the TypeScript glue code ships under EUPL-1.2; the HTML fixture corpus itself ships under CC0-1.0 (Creative Commons Zero — public-domain dedication).

A test corpus is most valuable to the wider accessibility community when it can be freely combined with any other corpus, including those licensed under terms incompatible with EUPL-1.2 or MIT. CC0-1.0 removes the attribution and reciprocity obligations entirely: downstream researchers, regulators, and competing scanners may bundle the fixtures verbatim into their own test suites without triggering any license obligation.

The choice also aligns with the Horizon Europe Article 17 open-science default for research data — CC0-1.0 and CC-BY-4.0 are the two recommended licenses for Horizon Europe research-data deposits.

License compatibility

The EUPL-1.2 Annex enumerates compatible OSI-approved licenses whose covered code can be combined with EUPL-1.2 code under defined conditions. The compatibility surface relevant to downstream consumers and contributors:

EUPL-1.2 also provides explicit copyleft protection against AGPL contagion: EUPL copyleft does not extend across service boundaries when the code is not modified. A consumer can run the pipeline as a black-box compliance gate without triggering an obligation to publish derivative works.

Contribution license — DCO not CLA

Contributions are accepted via the Developer Certificate of Origin (DCO) 1.1, not a Contributor License Agreement (CLA). Each commit must be signed off (git commit -s) attesting the contributor has the right to submit the work under the project's license.

DCO over CLA is the contribution discipline endorsed across the Linux kernel, the Cloud Native Computing Foundation projects, and most OSS-foundation-hosted infrastructure. CLAs concentrate copyright in the project entity (useful for relicense flexibility but a barrier to contribution); DCOs preserve contributor copyright while still providing the project clear license provenance. The project's authorship policy mandates human authorship attribution on every commit; the Developer Certificate of Origin sign-off is the ergonomic mechanism for that mandate.

REUSE compliance

Every published source file carries an SPDX identifier in a header comment. A REUSE.toml per published package declares the license and copyright applying to each file. The REUSE CLI (Free Software Foundation Europe specification) runs in CI on every push; the build fails if any file is missing an SPDX header. Downstream auditors can verify license obligations mechanically without cloning the repository.

Maintained by Alexander Brichkin (Agonist Development AB, Sweden, org.nr 559452-5726).