chore(governance): add CC BY 4.0 license

.reposentinel-baseline.json

@@ -2439,13 +2439,8 @@
       "kind": "high_entropy",
       "line": 60,
       "token": "40-networking/network-fundamentals"
-    },
-    {
-      "fingerprint": "efcd9b83e1c3bef283a2e4f5dbd6a6dfa4fc691f54653643445778f35d2f501e",
-      "kind": "missing_file",
-      "path": "LICENSE"
-    }
-  ],
+    }
+  ],
   "generated_at": "2026-04-02T18:57:41Z",
   "schema_version": 1
 }

LICENSE

@@ -0,0 +1,14 @@
+Creative Commons Attribution 4.0 International (CC BY 4.0)
+
+Unless a file or section states otherwise, the original written content and
+pattern cards in this repository are licensed under CC BY 4.0. This notice
+does not grant rights to third-party platform material, quotations, or linked
+resources; those remain subject to their own terms.
+
+SPDX-License-Identifier: CC-BY-4.0
+
+Canonical license text:
+https://creativecommons.org/licenses/by/4.0/legalcode
+
+License deed:
+https://creativecommons.org/licenses/by/4.0/

POLICY.md

@@ -4,6 +4,13 @@ This repository is public.
 
 Everything published here must be safe to share, compliant with platform rules, and non-actionable outside authorized lab contexts.
 
+## License Scope
+
+Unless a file or section states otherwise, the original written content and
+pattern cards in this repository are licensed under [CC BY 4.0](LICENSE).
+This license does not grant rights to third-party platform material,
+quotations, or linked resources; those remain subject to their own terms.
+
 ## Publishing Standard
 
 The default publishing standard in this repo is:

README.md

@@ -4,6 +4,8 @@ Public, sanitized security write-ups from authorized labs and training platforms
 
 > A local-first public knowledge base focused on methodology, reasoning, and reusable security patterns, not copy-paste exploitation.
 
+Original written content and pattern cards are licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/); see [LICENSE](LICENSE). This does not grant rights to third-party platform material, quotations, or linked resources.
+
 ## Featured Security Patterns
 
 Current extraction metric: **8 stable reusable security patterns extracted

docs/repo-sentinel-baseline-review.md

@@ -55,13 +55,53 @@ this review. A scan for common AWS, GitHub, OpenAI, Slack, private-key, JWT,
 and long-hex marker formats found no matches; that heuristic does not replace
 human review of future high-entropy findings.
 
+## License Decision Resolution
+
+The missing `LICENSE` governance condition is resolved by consumer commit
+`1f829fb02ee662225aaf9b315784f34e4736e31e`, which adds a CC BY 4.0 license for
+original written content and pattern cards. The scope notice explicitly
+excludes third-party platform material, quotations, and linked resources.
+
+The baseline change was targeted: it removed only the stale
+`repo.required_file_missing` entry for `LICENSE`. No unrelated suppression was
+regenerated.
+
+A clean-worktree local validation used the installed `repo-sentinel 0.8.0`
+CLI against that exact consumer commit. This is pre-release/local evidence,
+not a formal remote dependency pin or a claim that the changed-file gate is
+ready.
+
+Reproduction command:
+
+```bash
+repo-sentinel baseline audit \
+  --format json \
+  --baseline .reposentinel-baseline.json \
+  .
+```
+
+Evidence summary:
+
+| Result | Count |
+| --- | ---: |
+| Active `secret.high_entropy` | 272 |
+| Relocated | 7 |
+| Changed | 0 |
+| Ambiguous | 26 |
+| Stale | 0 |
+| Unmatched | 2,567 |
+| Active `repo.required_file_missing` | 0 |
+
+The redacted audit artifact SHA-256 is
+`ce5e84b0bff3c8825c51141a9278612837ae7cbf80baaafd52b1c1a71167fe9a`.
+
 ## Governance Decision
 
 The current baseline is useful as a reviewed suppression record, but it is not
 ready to become a blocking remote gate yet.
 
-1. Keep the existing baseline unchanged until the missing `LICENSE` decision is
-   resolved and the reviewed suppression boundary is explicit.
+1. The missing `LICENSE` decision is resolved. Keep the targeted baseline
+   cleanup and do not regenerate unrelated suppressions.
 2. Keep baseline audit output non-blocking. The changed-file policy should fail
    on new error findings while baseline drift remains an independent review
    signal.
@@ -79,4 +119,7 @@ without claiming that the acceptance criteria are complete. The historical
 issue snapshot and this v0.8 candidate audit are not directly comparable:
 scanner rule coverage and baseline identity semantics changed between the two
 runs. Future comparisons should always record the exact `repo-sentinel`
-release or commit used for the audit.
+release or commit used for the audit. The license condition is now resolved;
+issue #5 remains open pending the formal v0.8.0 release, exact pinned consumer
+audit, synthetic pass/fail/redaction tests, and changed-file remote-gate
+rollout while baseline audit remains non-blocking.