docs(exceptions): keep AppKit license proposal under unused ID

Update the draft proposal branch to current main and use EX-0013 because EX-0009 is now assigned to the merged GitFlow exception. Preserve all approved entries and the exact development-only uri-js scope; this does not approve or activate the proposal. Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>
docs(exceptions): propose scoped AppKit tooling license review
2026-10-12 09:32:53 -05:00 · 2026-10-10 17:56:28 -05:00
1 changed files with 29 additions and 0 deletions
@@ -343,3 +343,32 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in
 - **Expires:** reviewed yearly, next on 2027-10-12, or when the roots move to an
  encrypted remote backend.
 - **Owner:** the maintainer.
+
+## EX-0013
+
+**Proposed: AppKit ESLint's transitive BSD views license**
+
+- **Status:** Proposed; not effective until this register change is reviewed and merged.
+- **Requirement:** `K22-DEP-02`, enforced by the reusable PR license allowlist.
+- **Scope:** `KofTwentyTwo/AppKit` repository tooling only, `pkg:npm/uri-js@4.4.1`
+  from ESLint's Ajv dependency. It is development-only and ships in no AppKit package.
+- **Reason:** hosted dependency review reports `BSD-2-Clause AND BSD-2-Clause-Views`,
+  while npm metadata says `BSD-2-Clause`. The installed 4.4.1 LICENSE matches the
+  [upstream text](https://github.com/garycourt/uri-js/blob/master/LICENSE), including
+  the views sentence. [SPDX](https://spdx.org/licenses/BSD-2-Clause-Views.html)
+  describes this as BSD-2-Clause with the added views-and-conclusions sentence.
+  Keeping ESLint preserves required checks of repository JavaScript and review code.
+- **Risk:** the default automated license policy cannot accept this expression;
+  a manual decision could miss a license obligation. Source copyright, conditions,
+  disclaimer and views text must be preserved when redistributing this tool.
+- **Compensating controls:** retain the locked dependency and full license; after
+  approval, exempt only that exact package version from license review. Every other
+  license, all development/runtime vulnerability checks, package signature verification
+  and SCA remain enforced. No shipped dependency gains an exemption.
+- **Expires:** 2027-04-10, or when this dependency is removed or upgraded, whichever
+  comes first. Reassess the actual replacement version before extending the scope.
+- **Owner:** KofTwentyTwo maintainer. **Review date:** 2027-01-10.
+- **Evidence:** [AppKit #26](https://github.com/KofTwentyTwo/AppKit/issues/26) and
+  [failed dependency gate](https://github.com/KofTwentyTwo/AppKit/actions/runs/38093180805).
+
+Do not activate a caller exemption while this entry remains proposed.