> Open source and licence policy for an agent adding code — from The Handover, the-handover.org/docs/open-source-and-licence-policy
> Authors: Leon Mallett (captivated.online) with Claude Code · Last confirmed working: 2026-10-19 on Claude Code 2026-10
> © Captivated Ltd — free to use in your own work, not to redistribute as a collection. the-handover.org/licence

The licence policy for work here. The principle — that obligations run in both
directions, with every dependency carrying terms in and the project's own licence
a decision with legal effect out — lives in the business context. This file is
the policy that principle needs: which licences may enter, what they oblige you to
ship, and where code is allowed to come from.

## Which licences may enter

{{dependency_policy}}

**Check a licence before adding the dependency, not when preparing a release.**
By release it is load-bearing, and removing it is a project.

**Check what actually installs, not what the project page says.** A licence can
change between versions, and a permissively licensed package can bring a copyleft
one in transitively. The question is the whole tree it adds, so read the lockfile
change rather than the one name you typed.

**No licence is not an open licence.** A public repository without one grants no
permission at all. Treat it as forbidden until somebody with authority decides
otherwise.

**Copyleft is the case that matters most** and the easiest to miss, because it
installs identically. Whether it reaches the work depends on how it is linked and
what is distributed — a judgement for a person, not one to reason your way past.

## What every licence obliges you to ship

Permissive does not mean free of obligations. MIT, BSD and Apache-2.0 all require
their notice to travel with the software, and Apache-2.0 adds any NOTICE file the
project ships. A binary shipped without them breaches every one of those licences
at once.

Record every distributed dependency and its licence in {{notices_path}}. When a
dependency is added, removed or upgraded, the notices change in the same commit —
generated where possible, because a list kept by hand drifts from the lockfile the
first time nobody remembers it.

**Vendored code keeps its licence file and its headers.** Copying a library into
the tree does not make it ours.

## Where code may come from

Code arrives from more places than the package manager, and each has terms.

- **Copied snippets** — answers on Q&A sites, gists, blog posts — carry the licence
  of where they came from, and several of those require attribution or
  share-alike. Record the source beside anything non-trivial that was copied, or
  write it fresh.
- **Code from another repository**, our own other projects included, carries that
  repository's licence. Moving code between a public and a private project is a
  licensing decision, not a refactor.
- **Generated code is not exempt.** If output reproduces a recognisable piece of
  licensed code, treat it as copied: find the source, or rewrite it.

## Contributions in

If this project accepts outside contributions, the terms they arrive under have
either been decided or have not — they are never decided by merging. Do not merge
an outside contribution whose author has not agreed to them.

## What needs a person

- Adding any dependency outside the policy above, or one whose licence is unclear.
- Any change to the project's own licence file, licence headers or copyright
  notices.
- Publishing code, or a repository, that has not been published before.
- Accepting the first outside contribution.