Add SPDX license policy gate

The SBOM recorded each component's license name but never judged it, so
a disallowed or copyleft license could ship unnoticed. Add a policy gate
that normalizes license strings to SPDX ids and evaluates them against
allow/deny lists (with a built-in strong-copyleft set), understanding
SPDX OR/AND expressions, then bridges violations into the SARIF exporter.
Pure stdlib and fully offline; wired through the facade, AC_check_licenses
executor command, ac_check_licenses MCP tool and Script Builder.

Author: JE-Chen

README.md

@@ -13,6 +13,7 @@
 
 ## Table of Contents
 
+- [What's new (2026-06-21) — License Policy Gate](#whats-new-2026-06-21--license-policy-gate)
 - [What's new (2026-06-21) — OpenVEX Vulnerability Triage](#whats-new-2026-06-21--openvex-vulnerability-triage)
 - [What's new (2026-06-21) — Dependency Vulnerability Scanning (OSV)](#whats-new-2026-06-21--dependency-vulnerability-scanning-osv)
 - [What's new (2026-06-21) — JSON Schema Validation](#whats-new-2026-06-21--json-schema-validation)
@@ -112,6 +113,12 @@
 
 ---
 
+## What's new (2026-06-21) — License Policy Gate
+
+Flag disallowed dependency licenses. Full reference: [`docs/source/Eng/doc/new_features/v60_features_doc.rst`](docs/source/Eng/doc/new_features/v60_features_doc.rst).
+
+- **`evaluate_sbom` / `evaluate_license` / `normalize_spdx` / `license_findings_to_sarif`** (`AC_check_licenses`, `ac_check_licenses`): the SBOM recorded each dependency's license name but never *judged* it. This normalizes license strings to SPDX ids and evaluates them against an allowlist/denylist (with a built-in `DEFAULT_COPYLEFT` set), understanding SPDX expressions (`OR` = choice, `AND` = all), then bridges violations into SARIF (`denied`→error, `unknown`→warning). Pure-stdlib, fully offline — the license-compliance lane beside the OSV vulnerability lane.
+
 ## What's new (2026-06-21) — OpenVEX Vulnerability Triage
 
 Suppress the vulns that don't affect you. Full reference: [`docs/source/Eng/doc/new_features/v59_features_doc.rst`](docs/source/Eng/doc/new_features/v59_features_doc.rst).

README/README_zh-CN.md

@@ -12,6 +12,7 @@
 
 ## 目录
 
+- [本次更新 (2026-06-21) — 许可证策略闸门](#本次更新-2026-06-21--许可证策略闸门)
 - [本次更新 (2026-06-21) — OpenVEX 漏洞分级](#本次更新-2026-06-21--openvex-漏洞分级)
 - [本次更新 (2026-06-21) — 依赖项漏洞扫描(OSV)](#本次更新-2026-06-21--依赖项漏洞扫描osv)
 - [本次更新 (2026-06-21) — JSON Schema 验证](#本次更新-2026-06-21--json-schema-验证)
@@ -111,6 +112,12 @@
 
 ---
 
+## 本次更新 (2026-06-21) — 许可证策略闸门
+
+标记不被允许的依赖项许可证。完整参考:[`docs/source/Zh/doc/new_features/v60_features_doc.rst`](../docs/source/Zh/doc/new_features/v60_features_doc.rst)。
+
+- **`evaluate_sbom` / `evaluate_license` / `normalize_spdx` / `license_findings_to_sarif`**(`AC_check_licenses`、`ac_check_licenses`):SBOM 记录了每个依赖项的许可证名称却从未*判断*它。本功能把许可证字符串规范化为 SPDX id,以允许列表/拒绝列表(内建 `DEFAULT_COPYLEFT` 集合)评估,理解 SPDX 表达式(`OR` = 择一、`AND` = 全部),再把违规桥接到 SARIF(`denied`→error、`unknown`→warning)。纯标准库、完全离线 —— 与 OSV 漏洞通道并列的许可证合规通道。
+
 ## 本次更新 (2026-06-21) — OpenVEX 漏洞分级
 
 抑制不影响你的漏洞。完整参考:[`docs/source/Zh/doc/new_features/v59_features_doc.rst`](../docs/source/Zh/doc/new_features/v59_features_doc.rst)。

README/README_zh-TW.md

@@ -12,6 +12,7 @@
 
 ## 目錄
 
+- [本次更新 (2026-06-21) — 授權政策閘門](#本次更新-2026-06-21--授權政策閘門)
 - [本次更新 (2026-06-21) — OpenVEX 漏洞分級](#本次更新-2026-06-21--openvex-漏洞分級)
 - [本次更新 (2026-06-21) — 相依套件漏洞掃描(OSV)](#本次更新-2026-06-21--相依套件漏洞掃描osv)
 - [本次更新 (2026-06-21) — JSON Schema 驗證](#本次更新-2026-06-21--json-schema-驗證)
@@ -111,6 +112,12 @@
 
 ---
 
+## 本次更新 (2026-06-21) — 授權政策閘門
+
+標記不被允許的相依套件授權。完整參考:[`docs/source/Zh/doc/new_features/v60_features_doc.rst`](../docs/source/Zh/doc/new_features/v60_features_doc.rst)。
+
+- **`evaluate_sbom` / `evaluate_license` / `normalize_spdx` / `license_findings_to_sarif`**(`AC_check_licenses`、`ac_check_licenses`):SBOM 記錄了每個相依套件的授權名稱卻從未*判斷*它。本功能把授權字串正規化為 SPDX id,以允許清單/拒絕清單(內建 `DEFAULT_COPYLEFT` 集合)評估,理解 SPDX 運算式(`OR` = 擇一、`AND` = 全部),再把違規橋接到 SARIF(`denied`→error、`unknown`→warning)。純標準函式庫、完全離線 —— 與 OSV 漏洞通道並列的授權合規通道。
+
 ## 本次更新 (2026-06-21) — OpenVEX 漏洞分級
 
 抑制不影響你的漏洞。完整參考:[`docs/source/Zh/doc/new_features/v59_features_doc.rst`](../docs/source/Zh/doc/new_features/v59_features_doc.rst)。

docs/source/Eng/doc/new_features/v60_features_doc.rst

@@ -0,0 +1,49 @@
+License Policy Gate
+===================
+
+``build_sbom`` records each component's license *name*, but nothing ever judged
+it — a copyleft or otherwise-disallowed license could ship unnoticed. This adds
+the policy gate: normalize the SBOM's license strings to SPDX ids, evaluate them
+against an allowlist / denylist (with a built-in strong-copyleft set), and emit
+violations that bridge into the existing SARIF exporter — the license-compliance
+lane beside the OSV vulnerability lane.
+
+Pure standard library (``re``); fully offline; imports no ``PySide6``.
+
+Headless API
+------------
+
+.. code-block:: python
+
+    from je_auto_control import (
+        build_sbom, evaluate_sbom, evaluate_license,
+        license_findings_to_sarif, write_sarif, DEFAULT_COPYLEFT)
+
+    sbom = build_sbom("je_auto_control")
+
+    # Allowlist mode: anything outside the list is a violation.
+    violations = evaluate_sbom(sbom["components"],
+                               allow=["MIT", "Apache-2.0", "BSD-3-Clause"])
+
+    # Or denylist mode using the built-in strong-copyleft set.
+    violations = evaluate_sbom(sbom["components"], deny=DEFAULT_COPYLEFT)
+
+    write_sarif(license_findings_to_sarif(violations), "licenses.sarif",
+                tool_name="AutoControl-License")
+
+``normalize_spdx`` maps loose names (``"MIT License"`` → ``MIT``, ``"Apache
+2.0"`` → ``Apache-2.0``) to SPDX ids. ``evaluate_license`` returns ``allowed`` /
+``denied`` / ``unknown``: ``deny`` takes precedence; an empty ``allow`` means
+"not constrained"; a missing license is ``unknown``. SPDX **expressions** are
+understood — ``"MIT OR GPL-3.0-only"`` is a *choice* (allowed if any operand is
+allowed), while ``"MIT AND GPL-3.0-only"`` requires every operand. Each
+violation is ``{name, version, license, status}``; ``denied`` maps to a SARIF
+``error`` and ``unknown`` to a ``warning``.
+
+Executor command
+----------------
+
+``AC_check_licenses`` takes ``components`` (a component list, a full SBOM dict,
+or a JSON string) and optional ``allow`` / ``deny`` lists; it returns
+``{violations, count}``. The same operation is exposed as the MCP tool
+``ac_check_licenses`` and as a Script Builder command under **Security**.

docs/source/Eng/eng_index.rst

@@ -82,6 +82,7 @@ Comprehensive guides for all AutoControl features.
    doc/new_features/v57_features_doc
    doc/new_features/v58_features_doc
    doc/new_features/v59_features_doc
+   doc/new_features/v60_features_doc
    doc/ocr_backends/ocr_backends_doc
    doc/observability/observability_doc
    doc/operations_layer/operations_layer_doc

docs/source/Zh/doc/new_features/v60_features_doc.rst

@@ -0,0 +1,45 @@
+授權政策閘門
+===========
+
+``build_sbom`` 會記錄每個元件的授權*名稱*,但從未對它做判斷 —— copyleft 或其他不被允許的授權
+可能在無人察覺下隨產品出貨。本功能補上政策閘門:把 SBOM 的授權字串正規化為 SPDX id,以
+允許清單 / 拒絕清單(內建強 copyleft 集合)評估,並產生可橋接到既有 SARIF 匯出器的違規項目
+—— 與 OSV 漏洞通道並列的授權合規通道。
+
+純標準函式庫(``re``);完全離線;不匯入 ``PySide6``。
+
+無頭 API
+--------
+
+.. code-block:: python
+
+    from je_auto_control import (
+        build_sbom, evaluate_sbom, evaluate_license,
+        license_findings_to_sarif, write_sarif, DEFAULT_COPYLEFT)
+
+    sbom = build_sbom("je_auto_control")
+
+    # 允許清單模式:清單之外的一律視為違規。
+    violations = evaluate_sbom(sbom["components"],
+                               allow=["MIT", "Apache-2.0", "BSD-3-Clause"])
+
+    # 或以內建強 copyleft 集合做拒絕清單模式。
+    violations = evaluate_sbom(sbom["components"], deny=DEFAULT_COPYLEFT)
+
+    write_sarif(license_findings_to_sarif(violations), "licenses.sarif",
+                tool_name="AutoControl-License")
+
+``normalize_spdx`` 把寬鬆的名稱(``"MIT License"`` → ``MIT``、``"Apache 2.0"`` →
+``Apache-2.0``)對應到 SPDX id。``evaluate_license`` 回傳 ``allowed`` / ``denied`` /
+``unknown``:``deny`` 優先;空的 ``allow`` 代表「不受限制」;缺少授權則為 ``unknown``。亦理解
+SPDX **運算式** —— ``"MIT OR GPL-3.0-only"`` 是*擇一*(任一運算元被允許即允許),而
+``"MIT AND GPL-3.0-only"`` 需要每個運算元都被允許。每個違規為
+``{name, version, license, status}``;``denied`` 對應 SARIF ``error``,``unknown`` 對應
+``warning``。
+
+執行器命令
+----------
+
+``AC_check_licenses`` 接受 ``components``(元件清單、完整 SBOM dict 或 JSON 字串)與選用的
+``allow`` / ``deny`` 清單;回傳 ``{violations, count}``。同一操作亦以 MCP 工具
+``ac_check_licenses`` 以及 Script Builder 中 **Security** 分類下的命令提供。

docs/source/Zh/zh_index.rst

@@ -82,6 +82,7 @@ AutoControl 所有功能的完整使用指南。
    doc/new_features/v57_features_doc
    doc/new_features/v58_features_doc
    doc/new_features/v59_features_doc
+   doc/new_features/v60_features_doc
    doc/ocr_backends/ocr_backends_doc
    doc/observability/observability_doc
    doc/operations_layer/operations_layer_doc

je_auto_control/__init__.py

@@ -310,6 +310,11 @@
 from je_auto_control.utils.vex import (
     VEX_JUSTIFICATIONS, VEX_STATUSES, apply_vex, build_vex, vex_statement,
 )
+# SPDX license allow/deny policy over SBOM components
+from je_auto_control.utils.license_policy import (
+    DEFAULT_COPYLEFT, evaluate_license, evaluate_sbom,
+    license_findings_to_sarif, normalize_spdx,
+)
 # Background popup/interrupt watchdog (unattended automation)
 from je_auto_control.utils.watchdog import (
     PopupWatchdog, WatchdogRule, default_popup_watchdog,
@@ -784,6 +789,8 @@ def start_autocontrol_gui(*args, **kwargs):
     "version_key",
     "VEX_JUSTIFICATIONS", "VEX_STATUSES", "apply_vex", "build_vex",
     "vex_statement",
+    "DEFAULT_COPYLEFT", "evaluate_license", "evaluate_sbom",
+    "license_findings_to_sarif", "normalize_spdx",
     # MCP server
     "AuditLogger", "HttpMCPServer", "MCPContent", "MCPPrompt",
     "MCPPromptArgument", "MCPResource", "MCPServer", "MCPTool",

je_auto_control/gui/script_builder/command_schema.py

@@ -1179,6 +1179,19 @@ def _add_misc_specs(specs: List[CommandSpec]) -> None:
         ),
         description="Suppress not_affected/fixed vulns via an OpenVEX document.",
     ))
+    specs.append(CommandSpec(
+        "AC_check_licenses", "Security", "Check Dependency Licenses",
+        fields=(
+            FieldSpec("components", FieldType.STRING,
+                      placeholder='{"components": [{"name": "x", '
+                                  '"licenses": [{"license": {"name": "MIT"}}]}]}'),
+            FieldSpec("allow", FieldType.STRING, optional=True,
+                      placeholder='["MIT", "Apache-2.0", "BSD-3-Clause"]'),
+            FieldSpec("deny", FieldType.STRING, optional=True,
+                      placeholder='["GPL-3.0-only", "AGPL-3.0-only"]'),
+        ),
+        description="Evaluate SBOM licenses against allow/deny SPDX lists.",
+    ))
     specs.append(CommandSpec(
         "AC_run_saga", "Flow", "Run Saga (Compensating Rollback)",
         fields=(

je_auto_control/utils/executor/action_executor.py

@@ -2897,6 +2897,23 @@ def _apply_vex(findings: Any, vex: Any) -> Dict[str, Any]:
     return {"findings": kept, "count": len(kept)}
 
 
+def _check_licenses(components: Any, allow: Any = None,
+                    deny: Any = None) -> Dict[str, Any]:
+    """Adapter: evaluate SBOM component licenses against allow/deny lists."""
+    import json
+    from je_auto_control.utils.license_policy import evaluate_sbom
+    if isinstance(components, str):
+        components = json.loads(components)
+    if isinstance(components, dict):
+        components = components.get("components", [])
+    if isinstance(allow, str):
+        allow = json.loads(allow)
+    if isinstance(deny, str):
+        deny = json.loads(deny)
+    violations = evaluate_sbom(components, allow=allow, deny=deny)
+    return {"violations": violations, "count": len(violations)}
+
+
 def _generate_sop(actions: List[Any], title: str = "Automation Procedure",
                   path: Optional[str] = None) -> Dict[str, Any]:
     """Adapter: build (or write) a step-by-step SOP from an action list."""
@@ -3678,6 +3695,7 @@ def __init__(self):
             "AC_scan_secrets": _scan_secrets,
             "AC_scan_vulns": _scan_vulns,
             "AC_apply_vex": _apply_vex,
+            "AC_check_licenses": _check_licenses,
             "AC_generate_sop": _generate_sop,
             "AC_tween_drag": _tween_drag,
             "AC_list_plugins": _list_plugins,