Maintaining Oss State

Maintaining FlashDreams's OSS state

FlashDreams is released to the public under Apache-2.0 (OSRB Bug

6107043).

The repo carries a fixed set of collateral that the OSRB approved on, and

a reuse-lint CI workflow that fails the build if that collateral drifts.

This skill is the map for keeping the collateral consistent — what each

file is for, what edits trigger which downstream paperwork, and which CI

gates catch what.

> The reference design here was landed across PRs #54 (CONTRIBUTING.md),

> #55 (Apache-2.0 collateral), #111 (cudaraster + LodePNG disclosure),

> #119 (strict inline SPDX CI), and the alpadreams → omnidreams rename

> (#128 / #132). The git history of those commits is the canonical

> example for every operation described below.

TL;DR

• Six files at repo root + one CI workflow define OSS state:

LICENSE, LICENSES/, NOTICE, THIRD-PARTY-NOTICES,

REUSE.toml, CONTRIBUTING.md, and

.github/workflows/reuse-lint.yml. Touch any of them with the same

care you'd give to a public API.

• LICENSE has a multi-license preamble explaining that the bulk

of the repo is Apache-2.0 and that two subtrees

(cudaraster → BSD-3-Clause, LodePNG → Zlib) carry different OSI

licenses, then reproduces the full Apache-2.0 text. CI verifies the

canonical Apache-2.0 sentinel strings are present; the structural

cross-references in the preamble are not lint-checked (these files

change rarely — see the change-log review path instead).

• NOTICE is the minimal Apache 2.0 §4(d) notice — NVIDIA

copyright + pointers to LICENSE, LICENSES/, and

THIRD-PARTY-NOTICES. It is *not* the full attribution document.

• **THIRD-PARTY-NOTICES is the full per-dependency attribution

document** — direct runtime deps, reference architectures, optional

integrations, and source-level redistributions, each with SPDX

identifier and upstream URL.

• Every first-party source file carries an inline SPDX header.

REUSE.toml's ** aggregate keeps the lint green for files that

can't carry one (config, assets, binaries), but reuse-lint's

"Inline SPDX headers on first-party source files" step rejects any

new .py / .c / .cpp / .cu / .sh / .proto / Dockerfile

/ etc. without the inline tag.

• Direct deps are mirrored in three places: the workspace member's

pyproject.toml dependencies, the resolved uv.lock pin, and the

THIRD-PARTY-NOTICES "Direct runtime dependencies" table. All

three must agree.

• Third-party source physically present in the repo (cudaraster,

LodePNG) lives in THIRD-PARTY-NOTICES "Source-level

redistributions", carries the full license text under

LICENSES/<SPDX>.txt, has a matching REUSE.toml override

annotation, and is cross-referenced from the LICENSE preamble.

• **OSRB Bug 6107043 §14 is the source of truth for which deps are

"covered" by the contribution approval.** Adding a new direct dep =

reopen 6107043 and amend §14. Adding a transitive that only matters

because the SBOM scanner flagged it = either reopen + amend §14, or

file a self-cert under osrb/. Dev-only transitives → SBOM

correction (not shipped).

1. The OSS-collateral file set

| File / path | Role | OSRB anchor |

|---|---|---|

| LICENSE | Multi-license preamble (Apache-2.0 + BSD-3 + Zlib pointer) followed by the canonical Apache-2.0 v2.0 text. CI verifies the canonical Apache-2.0 sentinel strings are present (preamble structure is not lint-gated). | 6107043 item #3 + OSRB unified-posture review |

| LICENSES/Apache-2.0.txt | REUSE 3.3 license-bundle copy of the canonical Apache-2.0 text (no preamble — must remain reusable verbatim by REUSE tooling). | 6107043 item #3 |

| LICENSES/BSD-3-Clause.txt | Full BSD-3 text covering the in-source cudaraster port. | 6107043 Cmt #5 (2) |

| LICENSES/Zlib.txt | Full Zlib text covering the embedded LodePNG codec. | 6107043 Cmt #5 (2) |

| NOTICE | Apache 2.0 §4(d) minimal notice — NVIDIA copyright + pointers to LICENSE, LICENSES/, and THIRD-PARTY-NOTICES. Carried forward verbatim by downstream redistributions. | Apache-2.0 §4(d) |

| THIRD-PARTY-NOTICES | Full per-dependency attribution: Direct runtime deps + Reference architectures + Optional-integration deps + Source-level redistributions. The source of truth for the third-party manifest. | OSRB review (canonical attribution doc) |

| REUSE.toml | REUSE 3.3 aggregate / override annotations for files without inline SPDX. | 6107043 item #2 |

| CONTRIBUTING.md | Apache-2.0-only contribution statement + DCO v1.1 reproduction + "Signing Your Work" subsection (with git commit -s and --signoff) + IP-review reference. | 6107043 item #6 + OSRB DCO template |

| .github/workflows/reuse-lint.yml | CI gate enforcing REUSE 3.3 compliance, presence of the five core OSRB collateral files (LICENSE, LICENSES/Apache-2.0.txt, CONTRIBUTING.md, NOTICE, REUSE.toml), canonical Apache-2.0 text in LICENSE and LICENSES/Apache-2.0.txt, CONTRIBUTING.md DCO/sign-off reference, inline SPDX headers (incl. .sh / .proto / Dockerfile), and no legacy proprietary banners. Content-shape of LICENSE preamble / CONTRIBUTING.md policy text / THIRD-PARTY-NOTICES sections is reviewed manually, not lint-checked. | (enforces the above) |

The CI workflow runs on every PR, every push to main, and inside the

GitHub merge queue. A failed reuse-lint blocks merge — never bypass it,

fix the underlying file.

2. Per-file SPDX headers

Every first-party source file starts with the inline SPDX header. The

exact wording is enforced by reuse-lint's "Inline SPDX headers on

first-party source files" step (looks for SPDX-License-Identifier in

the first 20 lines).

Python / shell / TOML / YAML (# line comments):

# SPDX-FileCopyrightText: Copyright (c) <YEAR> NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

C / C++ / CUDA (// line comments): same two SPDX tags + the same

Apache-2.0 preamble, with // swapped for #.

Rules:

• <YEAR> is the current calendar year for newly created files

(use the system clock — *not* a model-training-cutoff year). For

files being edited, leave the year alone — it reflects original

authorship, not last-touched.

• The two SPDX tags (SPDX-FileCopyrightText + SPDX-License-Identifier)

are the load-bearing part. The Apache-2.0 preamble is house style;

the CI gate only checks for SPDX-License-Identifier in the first 20

lines, but the long form is what every existing file carries, so

match it.

• External contributors add their own copyright line *above* the

NVIDIA line — keep both. See CONTRIBUTING.md:200-235.

• The Cosmos-Drive-Dreams files

(integrations/omnidreams/omnidreams/conditioning/world_scenario/{camera_base,ftheta,pinhole}.py)

carry two SPDX-FileCopyrightText lines (NVIDIA + Cosmos-Drive-Dreams

contributors). Mirror that pattern when redistributing other modified

upstream Apache-2.0 source.

What's exempt (handled by REUSE.toml)

• Vendored upstream under integrations/omnidreams/ludus-renderer/ludus_renderer/_cpp/cudaraster/**

(carries its own BSD-3 / Zlib banners; override annotation in REUSE.toml).

• Generated protobuf stubs under

integrations/omnidreams/omnidreams/grpc/protos/*_pb2* (regeneration

script is project-owned; aggregate annotation covers them).

• Binary assets (assets/**.png, .jpg, .jpeg, .webp, .mp4,

.gif, .svg) and lock files (uv.lock).

• Documentation (.md, .rst, docs/**).

If a tracked source file genuinely cannot carry an inline header (a

tooling-generated artifact, an asset, a config file), extend REUSE.toml

rather than fighting the lint.

3. REUSE.toml — aggregate vs override

REUSE.toml is the REUSE 3.3 manifest that fills gaps the inline SPDX

header convention can't.

Precedence rules (from REUSE.toml):

• precedence = "aggregate" — declared license merges with any

inline SPDX header the file carries. Used for the project-wide default

(path = "**" → Apache-2.0) and for documentation / config /

build / asset blocks.

• precedence = "override" — declared license replaces any inline

SPDX header. Used for vendored upstream (cudaraster/** →

BSD-3-Clause; lodepng/** → Zlib) to keep the upstream banners

authoritative while still surfacing the SPDX identifier REUSE needs.

When to add an annotation block:

| Scenario | Block style | precedence |

|---|---|---|

| Add a new first-party source-file type covered by the default ** rule | (nothing — default covers it) | n/a |

| Add a new asset / config / generated-output path that can't carry an inline header | new [[annotations]] block, copyright + Apache-2.0 | aggregate |

| Add a new third-party source subtree (different license, banners we want to keep) | new [[annotations]] block, copyright = upstream, SPDX = upstream's license | override |

| Add a redistributed-and-modified upstream Apache-2.0 file | new block listing dual SPDX-FileCopyrightText (NVIDIA + upstream) | aggregate |

More specific paths win — the cudaraster override covers everything

under that subtree, then the lodepng override overrides the cudaraster

block for the lodepng leaf. Order the annotations so specific paths come

*after* general ones.

4. NOTICE vs THIRD-PARTY-NOTICES — what goes where

Two distinct files. Mixing them up is the most common OSS-state mistake.

NOTICE — minimal, downstream-propagated

NOTICE exists to satisfy Apache 2.0 §4(d): any derivative work must

carry a readable copy of the upstream NOTICE text. Keep it small so

downstream consumers do not pay an unreasonable carry-forward cost.

Shape:

NVIDIA FlashDreams
Copyright (c) <YEAR> NVIDIA CORPORATION & AFFILIATES. All rights reserved.

This product is licensed under the Apache License, Version 2.0; the
full license text is reproduced in LICENSE at the repository root and
in LICENSES/Apache-2.0.txt.

Two subtrees physically vendored into this repository carry
different OSI-approved licenses; full texts are reproduced under
LICENSES/:

  - integrations/omnidreams/ludus-renderer/ludus_renderer/_cpp/cudaraster/
        BSD-3-Clause  (see LICENSES/BSD-3-Clause.txt)
  - integrations/omnidreams/ludus-renderer/ludus_renderer/_cpp/
    cudaraster/framework/3rdparty/lodepng/{lodepng.h,lodepng.cpp}
        Zlib          (see LICENSES/Zlib.txt)

Third-party software attributions, source-level redistribution
disclosures, and the full per-dependency license inventory are
documented in THIRD-PARTY-NOTICES at the repository root.

Do not enumerate transitive dependencies, SPDX tables, or per-package

attributions in NOTICE. Those go in THIRD-PARTY-NOTICES.

THIRD-PARTY-NOTICES — full per-dependency manifest

THIRD-PARTY-NOTICES is the consumer-facing attribution document and

the source of truth for the third-party manifest. It has four named

sections; do not invent new ones without a corresponding REUSE.toml

change.

NVIDIA FlashDreams — Third-Party Notices
Copyright (c) <YEAR> NVIDIA CORPORATION & AFFILIATES. All rights reserved.

  Preamble explaining the dynamic-import / no-source-redistribution
  default and pointing readers at the Source-level redistributions
  section at the bottom.

================================================================================
Direct runtime dependencies
================================================================================

  <name>  <SPDX>  <upstream-URL>
  ... one row per direct dep ...

================================================================================
Reference architectures
================================================================================

  Wan 2.1 / Wan 2.2   Apache-2.0   https://github.com/Wan-Video/Wan2.1
      <one paragraph explaining the reference-architecture relationship
       and confirming weights/sources aren't redistributed>

================================================================================
Optional integration: integrations/<name>
================================================================================

  <one block per integration that pulls in deps not used by the root
   package — currently omnidreams (mediapy, opencv-python-headless,
   grpcio, shapely, ludus-renderer) and lingbot (aiohttp, aiortc,
   opencv-python-headless)>

================================================================================
Source-level redistributions
================================================================================

  <one block per subtree of third-party source physically in the repo>

Rules:

• Column 1 = exact PyPI / upstream name. Match

flashdreams/pyproject.toml's dependencies = spelling

(e.g., opencv-python-headless, not opencv).

• Column 2 = SPDX identifier (from <https://spdx.org/licenses/>). For

dual-licensed packages use comma-separated SPDX IDs in alphabetical

order, e.g., MIT, MPL-2.0 for tqdm.

• Column 3 = upstream source URL, not the PyPI page.
• Only direct deps go in the top table. Transitives stay out unless

they're material enough to flag separately under "Optional

integration" blocks.

• Reference architectures get their own block with a 2–4 line

explanation (we implement the architecture; we don't redistribute the

upstream code or weights).

• **The "Source-level redistributions" section is the only place

physically-present third-party source is acknowledged.** Each block:

Path (absolute from repo root), License (SPDX + pointer to

LICENSES/<SPDX>.txt), Upstream URL, and a paragraph explaining what

was modified vs. what's upstream code.

5. Adding or upgrading a runtime dependency

This is the highest-frequency OSS-state edit. It touches four places:

• flashdreams/pyproject.toml (or the workspace member that needs

the dep) — add to dependencies = [...]. Pin a floor (>=) on

semver-stable packages; pin tightly (==) only when the upstream

API is known-unstable across minor versions.

• uv.lock — regenerate with uv lock so the hash-pinned resolved

version lands in the lockfile.

• THIRD-PARTY-NOTICES "Direct runtime dependencies" table — add a row with

name SPDX upstream-URL.

• OSRB Bug 6107043 §14 — reopen the bug and amend §14 with the

new (name, version, license, URL) row. Per OSRB policy, for ongoing

contributions the previously-approved contribution bug must be

reopened whenever a new package is added to the product delivery,

a previously-approved package changes its license, or the use of a

previously-approved component changes.

Pre-add checklist

• [ ] Confirm the SPDX license. Read the upstream LICENSE file

(don't trust GitHub's auto-detected badge). MPL-2.0, LGPL,

AGPL, GPL, EPL, MS-PL all carry copyleft conditions; loop in

legal *before* adding.

• [ ] Confirm the dep is published from PyPI, not from a private

index. If it isn't on PyPI, write [tool.uv.sources] with care

and flag for OSRB review.

• [ ] Check for security advisories (Snyk, BDSA, NVD). The repo

has carried floor pins for security reasons before

(urllib3>=2.7.0 for the botocore/requests CVE chain). If a

floor is needed, leave a one-line comment in pyproject.toml

explaining why.

• [ ] MPL-2.0 / weak-copyleft: confirm dynamic import only, no

modifications, no source redistribution. If any of those don't

hold, the dep needs to be vendored (see §6) and OSRB review is

mandatory.

• [ ] Codec / crypto: if the new dep implements an audio/video

codec or encryption, the entry belongs in the corresponding

Optional-integration block of THIRD-PARTY-NOTICES, and the

OSRB bug Q11 / Q12 answers may need re-confirming.

Upgrading an existing dep version

• Same license, same SPDX, version-bump only → update

pyproject.toml floor (if needed), regen uv.lock.

THIRD-PARTY-NOTICES may not need a touch (we don't pin exact

versions there). OSRB bug does not need to be reopened (policy

explicit: "version updates without licensing changes don't require

reopening").

• License change between versions → treat as a new dep:

reopen 6107043 §14, update THIRD-PARTY-NOTICES, possibly re-check

codec/crypto questions.

• Major version bump that changes the dep's *use* (e.g.,

switching from sync-only to async-only, or adding a new transitive

family) — reopen 6107043 §14 even if the SPDX hasn't changed

("The use of a previously approved component changed").

uv.lock hygiene

• Always regenerate the lock from the workspace root: uv lock.
• Commit pyproject.toml and uv.lock together — they are

jointly maintained (see commit 9480367 ownership notes).

• If a dep's transitives shift in a way that drops or adds a

*direct-of-direct* (e.g., httpx → drops certifi), the new

closure is what the OSRB SBOM scanner will see — re-run the

scanner after the merge so anything new gets caught.

6. Adding a third-party source-level redistribution

Vendoring upstream source into the repo (the cudaraster + LodePNG

pattern, PR #111) is heavier — it touches six places:

• Physically place the source under an integrations/.../ subtree

that signals it's third-party (e.g.,

integrations/omnidreams/ludus-renderer/ludus_renderer/_cpp/cudaraster/).

Keep the upstream banners verbatim in the file headers — don't

replace them with NVIDIA SPDX headers.

• Add the full license text under LICENSES/<SPDX>.txt.
• Extend REUSE.toml with an override annotation for the

subtree (license = upstream SPDX, copyright = upstream copyright).

• **Add a "Source-level redistributions" block in

THIRD-PARTY-NOTICES** — path, license + pointer to

LICENSES/<SPDX>.txt, upstream URL, one paragraph describing what

we modified vs. upstream. Also update NOTICE to add a

one-line entry under the existing two-subtree bullet list, since

physically-redistributed third-party source is one of the things

downstream consumers must see when carrying our Apache 2.0

§4(d) notice forward. Also update the LICENSE preamble to

cross-reference the new LICENSES/<SPDX>.txt.

• OSRB Bug 6107043 — reopen + add a §14 row *and* note the

source-level redistribution in a comment (per Cmt #5 (2) workflow).

Filing an OSRB Bug for the upstream project itself may be required

if it has its own OSRB process (ludus-renderer = bug 6105127).

• reuse-lint exclusion in .github/workflows/reuse-lint.yml's

"Inline SPDX headers on first-party source files" step — extend

the excludes regex to skip the new subtree, since upstream

banners use the upstream license, not Apache-2.0.

Reference: commits 100c0f8 (initial collateral), 1d8c9ed

(cudaraster + LodePNG vendoring), 8f2aedf (ludus-renderer REUSE 3.3

compliance for sub-bug 6105127).

7. Adding a new first-party source file

Easy path — reuse-lint will fail the PR if you skip a step.

• Open the file with the SPDX header (see §2). The current calendar

year for newly authored files.

• Save / git add. No REUSE.toml change needed — the **

default rule covers it.

• If the file lives under a path that has an override annotation

(cudaraster, lodepng), it inherits the upstream license — only do

this when the file genuinely *is* upstream-derived, not because

it's convenient.

The reuse-lint "No NVIDIA proprietary banners" step will reject any

file that still carries the legacy NVIDIA-CONFIDENTIAL banner. If you

ported source from an internal repo, strip the old banner and replace

with the Apache-2.0 SPDX header.

8. OSRB bug interaction matrix

| Change | OSRB action |

|---|---|

| Bump version, same license | None (policy explicit). |

| Bump version, license changed | Reopen 6107043, amend §14. |

| Add new direct dep | Reopen 6107043, amend §14, update THIRD-PARTY-NOTICES. |

| Add new transitive flagged by SBOM scanner | Reopen 6107043 §14 (preferred), OR file self-cert under osrb/. |

| Add dev/test-only transitive ([dev] extra) flagged by scanner | File SBOM correction — not in product delivery. Self-cert as fallback. |

| Vendor third-party source physically into repo | Reopen 6107043 + Cmt thread; possibly file a sub-OSRB bug for the upstream project (cf. 6105127 for ludus-renderer). |

| Remove a dep | Update pyproject.toml, uv.lock, THIRD-PARTY-NOTICES. No OSRB action — removal doesn't add new attack surface. |

| Drop a previously-approved transitive (closure shift) | Update THIRD-PARTY-NOTICES if it was listed; no OSRB action required. |

OSRB self-cert templates live under osrb/ (e.g.,

osrb/selfcert-certifi-2026.4.22.md). Mirror the OSS-USE form

shape — see prior tickets for the field list.

MPL-2.0 in particular

NVIDIA accepts MPL-2.0 use when all three hold:

• No modifications to the upstream MPL-2.0 source.
• No source redistribution — the dep is consumed from PyPI at

install time, not vendored.

• Dynamic linking only (Python import).

Document this trio explicitly on every MPL-2.0 self-cert ticket. If any

of the three fails, the dep needs a regular Use bug at

<https://nvbugs/5443768>.

9. Updating CONTRIBUTING.md

The DCO v1.1 text is reproduced verbatim in CONTRIBUTING.md:108-133.

Do not paraphrase, summarize, or "modernize" it — the reuse-lint

collateral step looks for the exact pattern

Developer.{1,40}Certificate.{1,10}of.{1,10}Origin|Signed-off-by|sign-off,

and OSRB approval is on the *verbatim* text.

When extending CONTRIBUTING.md:

• Keep the DCO section anchored at `## Developer Certificate of Origin

(DCO)` — the README and external docs link to it by anchor.

• The SPDX header preamble at CONTRIBUTING.md:200-235 doubles as the

agent-and-human source for what every new source file's header should

look like. Update it and python-docstring-style/SKILL.md together.

• The IP-review-process reference in CONTRIBUTING.md is an OSRB

pointer — don't change it without OSRB sign-off.

10. CI gates — what reuse-lint enforces

The workflow has two jobs and five checks. Read

.github/workflows/reuse-lint.yml if you need to add a new gate.

The gate set is intentionally narrow — these files change rarely and

the cost of over-fitted CI (false positives, sweeping rewrites

needed when wording shifts) exceeds the benefit. Treat the lint as a

backstop for structural regressions (missing collateral file, missing

SPDX header, legacy banner) and trust human review for content shape

(preamble references, contribution policy wording, attribution-table

sections).

reuse job (fsfe/reuse-action@v5):

• REUSE 3.3 lint: every tracked file has an SPDX identifier, either

inline or via REUSE.toml. New files without coverage fail.

collateral job (custom bash):

• LICENSE and LICENSES/Apache-2.0.txt both contain the canonical

Apache-2.0 sentinel strings. (Byte-identical equality is no longer

required — LICENSE carries a multi-license preamble in front of

the Apache-2.0 body.)

• The five core OSRB collateral files exist at the repo root:

LICENSE, LICENSES/Apache-2.0.txt, CONTRIBUTING.md, NOTICE,

REUSE.toml. (LICENSES/BSD-3-Clause.txt, LICENSES/Zlib.txt,

and THIRD-PARTY-NOTICES also need to be present per OSRB

approval, but are not lint-gated — they change slowly and a

manual review catches drift sooner than the cost of over-fitted

CI would justify.)

• CONTRIBUTING.md references the DCO / sign-off. (The explicit

"Apache-2.0-only" sentence, "Signing Your Work" subsection, and

git commit -s short-form example are required by the OSRB

template but are not separately lint-asserted.)

• Every tracked source file (.py, .pyx, .pyi, .c, .cc,

.cpp, .cxx, .h, .hh, .hpp, .hxx, .cu, .cuh,

.inl, .sh, .proto, Dockerfile / *.dockerfile) carries

an inline SPDX-License-Identifier in its first 20 lines — with

the documented exclusions (cudaraster/**, generated protobuf

stubs).

• No file contains the legacy NVIDIA proprietary-banner sentinel

phrases checked by .github/workflows/reuse-lint.yml.

Triggers: every PR, every push to main, and every merge-queue group

(see b84fe7d for the merge_group trigger landing).

11. Common pitfalls

• Editing LICENSE without mirroring into LICENSES/Apache-2.0.txt

— the collateral step compares them byte-for-byte. If you fix a typo

in one, fix it in both.

• Adding a new direct dep and forgetting THIRD-PARTY-NOTICES.

The lint won't catch this (the file is free-form prose). Add the

attribution row in the same commit that touches pyproject.toml /

uv.lock and the matching PR.

• **Touching NOTICE when only THIRD-PARTY-NOTICES should

change**. NOTICE is the small Apache 2.0 §4(d) file that

downstream consumers carry forward verbatim — keep it minimal.

Routine dep additions belong in THIRD-PARTY-NOTICES. Touch

NOTICE only when (a) the year on line 2 rolls forward, (b) a new

source-level redistribution subtree appears (rare), or (c) the

pointer text needs to mention a new top-level OSS file.

• Renaming an integration (e.g., alpadreams → omnidreams) —

remember to update the matching path in REUSE.toml's annotations,

the path in THIRD-PARTY-NOTICES's "Source-level redistributions"

block, the path in the NOTICE two-subtree bullet list, the path

in the LICENSE preamble, and the exclusion regex in

.github/workflows/reuse-lint.yml. The rename in PRs #128 / #132

is the reference.

• Using single-quoted SPDX-FileCopyrightText. REUSE is forgiving;

the rest of the repo uses double-quoted strings. Mismatch breaks

human grep, not the lint.

• Year stamp drift. The SPDX header year is *when the file was

first authored*, not when it was last touched — never mass-rewrite

the year across the tree. The two exceptions are line 2 of NOTICE

and line 2 of THIRD-PARTY-NOTICES (and the project copyright in

the LICENSE preamble), which are the project's overall copyright

year and are allowed to roll forward annually.

• Adding an OSRB self-cert ticket to a public branch. OSRB tickets

are NVIDIA-internal — file them on the gitlab remote

(gitlab-master.nvidia.com/sil/flashdreams), not on origin

(github.com/NVIDIA/flashdreams). Public-facing skill, drafts, and

process docs are fine on origin.

• Skipping uv lock after a pyproject.toml edit. The lockfile

is the source of truth for what consumers actually install; an

out-of-sync uv.lock is a real bug, not a cosmetic one.

• Adding a dep "just for tests" without [dev] extra placement.

If a dep lives in the dev extra, it's not in the product delivery

and is out of OSRB scope per the policy bullet. If it's in

dependencies = [...], it ships to every consumer — OSRB-scoped.

The [dev] extras in flashdreams/pyproject.toml and

integrations/*/pyproject.toml are the seams.

• Forgetting that gitlab/main and origin/main have diverged.

Internal gitlab main carries 10+ commits not on origin

(Add --offload-text-encoder for batch run, etc.) and is missing

~77 from origin. When opening MRs against gitlab, base your branch

on gitlab/main; when opening PRs against github, base on

origin/main. Tooling-and-doc branches like this one belong on

github (canonical project home); OSRB-ticket-draft branches belong

on gitlab (NVIDIA-internal).

12. Scaffolding checklist — full operations

Add a new direct runtime dep foo (semver-stable, Apache/MIT/BSD):

• Add "foo>=X.Y" to the right workspace's pyproject.toml

dependencies = [...].

• uv lock from the workspace root; commit pyproject.toml +

uv.lock together.

• Add row to THIRD-PARTY-NOTICES "Direct runtime dependencies":

foo <SPDX> <upstream-URL>.

• Reopen OSRB Bug 6107043, amend §14 with the new row, and ping for

re-approval.

• PR + CI passes reuse-lint → merge.

**Add a new direct runtime dep bar (MPL-2.0 / LGPL / other

weak-copyleft):**

• Verify dynamic-import / no-mod / no-redistribute trio (§8). If any

fails, stop and engage OSRB.

• Same four steps above.
• *Also* file a self-cert ticket under osrb/selfcert-bar-<ver>.md

on the gitlab remote (cf. existing certifi / regendoc drafts).

Bump dep baz from 2.x to 3.x (same license):

• Verify SPDX unchanged at the new version.
• Update pyproject.toml floor if API contract requires.
• uv lock; commit pyproject.toml + uv.lock.
• No OSRB action.
• (Optional) Update THIRD-PARTY-NOTICES if its row drifts

(e.g., URL changed).

Vendor upstream qux (BSD-3) into integrations/foo/qux/:

• Drop source in with upstream banners preserved.
• Add LICENSES/BSD-3-Clause.txt if not already present.
• New [[annotations]] block in REUSE.toml with

precedence = "override", BSD-3 SPDX, upstream copyright, path

"integrations/foo/qux/**".

• New block in THIRD-PARTY-NOTICES "Source-level

redistributions" — path,

License: BSD-3-Clause (see LICENSES/BSD-3-Clause.txt),

upstream URL, modification paragraph. Also add a bullet to the

NOTICE two-subtree list and a pointer in the LICENSE

preamble.

• Extend the excludes regex in

.github/workflows/reuse-lint.yml's inline-SPDX step.

• Reopen OSRB Bug 6107043; file a sub-OSRB if qux has its own

project-level OSRB process.

Triage a reuse-lint failure:

• Read the failed step name.
• REUSE 3.3 compliance → run pipx run reuse lint locally; add

inline SPDX or extend REUSE.toml.

• LICENSE / LICENSES/Apache-2.0.txt are byte-identical →

diff LICENSE LICENSES/Apache-2.0.txt, restore parity.

• Required OSRB collateral present → recreate the missing file

from history (git log -- <file> to find the original commit).

• CONTRIBUTING.md references the DCO → restore the DCO section

anchor and verbatim text.

• Inline SPDX headers on first-party source files → the step

prints every offending path as a GitHub annotation. Add the header

to each.

• No NVIDIA proprietary banners → strip the legacy banner from

the listed file(s), replace with the Apache-2.0 SPDX header.

13. Where this maps in the codebase

| Question | File / pointer |

|---|---|

| What's the canonical Apache-2.0 text? | LICENSE (= LICENSES/Apache-2.0.txt) |

| What deps does FlashDreams ship? | THIRD-PARTY-NOTICES "Direct runtime dependencies" + flashdreams/pyproject.toml |

| What does a SPDX header look like? | CONTRIBUTING.md:215-232 |

| Where do I declare a config / asset file's license? | REUSE.toml |

| Where do I record vendored upstream source? | NOTICE "Source-level redistributions" + REUSE.toml override block |

| What does the CI gate enforce? | .github/workflows/reuse-lint.yml (read top to bottom) |

| Which deps did OSRB approve under 6107043? | The §14 table on the bug itself (kept in sync with NOTICE) |

| Where do OSRB self-cert drafts live? | osrb/ on the gitlab remote |

| Who do I tag if OSRB needs reopening? | The reviewer on 6107043 (Michael Hasper / MHASPER for FlashDreams) |