license-compliance-credits

When to use

• provenance/borrows.jsonl just gained, lost, or changed a line (a new borrow was ledgered via license-compliance-borrow-check, or a correction line was appended).
• npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts reports the notices file is out of sync with the ledger.
• Someone asks "are our third-party notices up to date?" or "regenerate the credits file".

Do NOT use when:

• You want to add a NEW borrow — that starts at license-compliance-borrow-check; this skill only regenerates the derived file from an already-updated ledger.
• The ledger itself needs fixing (a deny-class entry, a missing note) — fix the offending line via license-compliance-borrow-check's discipline first; this skill cannot repair a bad ledger, only render it.

Procedure

1. Inspect the current state — read provenance/borrows.jsonl (it may be legitimately empty) and note how many lines it has before regenerating, so the diff is checkable.
2. Regenerate the notices file:

   npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts --regenerate-notices
   

3. Diff docs/THIRD-PARTY-NOTICES.md before vs. after — confirm only that generated file changed, and that provenance/borrows.jsonl itself was not touched (it is append-only; this command never writes to it).
4. Verify sync + validity with a plain run (no flag):

   npx tsx node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts
   

   Exit code 0 confirms every ledger record is schema-valid, no deny-class or unknown license slipped through, no transformation note reads as rename-only, and the notices file now matches the ledger byte-for-byte.
5. If the linter fails, stop — do not hand-patch docs/THIRD-PARTY-NOTICES.md to make it pass. Fix the actual offending line in provenance/borrows.jsonl via license-compliance-borrow-check, then re-run step 2.

Output format

1. The regenerate command's exit status and a one-line summary of what changed in the notices file (e.g. "added 1 entry: <source_url> (<license>)", or "no borrows recorded" for the honest empty-ledger state).
2. The follow-up lint_provenance (no flag) exit code, confirming sync — never report success on the regenerate step alone.

Gotcha

• docs/THIRD-PARTY-NOTICES.md is generated — a hand-edit is invisible until the next lint_provenance run flags the drift as a linter failure, not as an obvious diff. Always regenerate; never patch the file directly.
• An empty ledger is the honest starting state, not a bug — it renders a plain "no borrows recorded" line. Do not "fix" that by adding a placeholder entry.
• This skill cannot make a bad ledger pass — if lint_provenance (no flag) still fails after regenerating, the defect is in provenance/borrows.jsonl, not in the notices file.

Do NOT

• NEVER hand-edit docs/THIRD-PARTY-NOTICES.md.
• NEVER skip the post-regenerate lint_provenance (no-flag) run — regeneration and validation are two different checks; passing one does not imply the other passed.
• NEVER add or edit a line in provenance/borrows.jsonl from this skill — that belongs to license-compliance-borrow-check.

See also

• code-provenance — the rule that makes a ledger entry mandatory before a conscious borrow lands.
• license-compliance-borrow-check — where new ledger entries are drafted and fixed.
• provenance/README.md — the ledger's append-only contract.
• node_modules/@event4u/agent-config/src/scripts/lint_provenance.ts — the linter this skill wraps.