git:20260728.aa372ed to git:20260728.6c3c9c3

---

model_tier: lite

name: license-compliance-credits

description: "Regenerate docs/THIRD-PARTY-NOTICES.md from provenance/borrows.jsonl after any ledger change — even a single new entry — never hand-edit the notices file"

domain: engineering

workspaces:

- engineering

packs:

- engineering-base

---

# license-compliance-credits

## When to use

- `provenance/borrows.jsonl` just gained, lost, or changed a line (a new

borrow was ledgered via

[`license-compliance-borrow-check`](../license-compliance-borrow-check/SKILL.md),

or a correction line was appended).

reports the notices file is out of sync with the ledger.

- Someone asks "are our third-party notices up to date?" or "regenerate the

credits file".

Do NOT use when:

- You want to add a NEW borrow — that starts at

[`license-compliance-borrow-check`](../license-compliance-borrow-check/SKILL.md);

this skill only regenerates the derived file from an already-updated

ledger.

- The ledger itself needs fixing (a deny-class entry, a missing note) — fix

the offending line via `license-compliance-borrow-check`'s discipline

first; this skill cannot repair a bad ledger, only render it.

## Procedure

1. **Inspect the current state** — read `provenance/borrows.jsonl` (it may

be legitimately empty) and note how many lines it has before

regenerating, so the diff is checkable.

2. **Regenerate the notices file:**

```bash

```

3. **Diff `docs/THIRD-PARTY-NOTICES.md`** before vs. after — confirm only

that generated file changed, and that `provenance/borrows.jsonl` itself

was not touched (it is append-only; this command never writes to it).

4. **Verify sync + validity** with a plain run (no flag):

```bash

```

Exit code 0 confirms every ledger record is schema-valid, no deny-class

or `unknown` license slipped through, no transformation note reads as

rename-only, and the notices file now matches the ledger byte-for-byte.

5. **If the linter fails**, stop — do not hand-patch

`docs/THIRD-PARTY-NOTICES.md` to make it pass. Fix the actual offending

line in `provenance/borrows.jsonl` via

[`license-compliance-borrow-check`](../license-compliance-borrow-check/SKILL.md),

then re-run step 2.

## Output format

1. The regenerate command's exit status and a one-line summary of what

changed in the notices file (e.g. "added 1 entry: `<source_url>`

(`<license>`)", or "no borrows recorded" for the honest empty-ledger

state).

2. The follow-up `lint_provenance` (no flag) exit code, confirming sync —

never report success on the regenerate step alone.

## Gotcha

- **`docs/THIRD-PARTY-NOTICES.md` is generated** — a hand-edit is invisible

until the next `lint_provenance` run flags the drift as a linter failure,

not as an obvious diff. Always regenerate; never patch the file directly.

- **An empty ledger is the honest starting state, not a bug** — it renders a

plain "no borrows recorded" line. Do not "fix" that by adding a

placeholder entry.

- **This skill cannot make a bad ledger pass** — if `lint_provenance`

(no flag) still fails after regenerating, the defect is in

`provenance/borrows.jsonl`, not in the notices file.

## Do NOT

- NEVER hand-edit `docs/THIRD-PARTY-NOTICES.md`.

- NEVER skip the post-regenerate `lint_provenance` (no-flag) run —

regeneration and validation are two different checks; passing one does

not imply the other passed.

- NEVER add or edit a line in `provenance/borrows.jsonl` from this skill —

that belongs to `license-compliance-borrow-check`.

## See also

- [`code-provenance`](../../rules/code-provenance.md) — the rule that makes

a ledger entry mandatory before a conscious borrow lands.

- [`license-compliance-borrow-check`](../license-compliance-borrow-check/SKILL.md) —

where new ledger entries are drafted and fixed.

- `provenance/README.md` — the ledger's append-only contract.