Finding
crates/theatron/desktop (periskopio) sat on license = "AGPL-3.0-or-later" for the entire life of the fleet licence posture, while [workspace.package] declared LicenseRef-PolyForm-Noncommercial-1.0.0. The repository was publishing one crate under a licence the project does not use, and nothing reported it.
The cause is structural rather than an oversight by whoever ran the migration.
Evidence
The crate is in the root manifest's exclude list, not members (Cargo.toml:27-30):
exclude = [
"akouo/shared/akouo-core",
"crates/theatron/desktop",
]Every one of the other twenty-one crates carries license.workspace = true and therefore tracked the posture automatically. An excluded crate has no workspace root to inherit from — cargo refuses the manifest outright:
error inheriting `license` from workspace root manifest's `workspace.package.license`
Caused by: failed to find a workspace root
So the excluded crates are precisely the ones that must restate workspace-wide facts, and precisely the ones a workspace-wide edit does not reach.
Note akouo/shared/akouo-core is excluded by the same list and needs the same check.
Why this matters
Licence is the visible instance, but the class is any fact declared once in [workspace.package] — edition, rust-version, version, repository, authors. A change to any of them updates twenty-one crates and silently skips the excluded ones, and the resulting disagreement is invisible until someone reads the two manifests side by side. Here it went unnoticed long enough that the fix arrived as an uncommitted edit in a shared clone rather than as a PR.
The failure is also quiet in the direction that matters: the excluded crate keeps building fine. Nothing about a stale value breaks a compile, so there is no signal at all until a human notices — and for a licence, "nobody noticed" is the expensive part.
Desired correction
A check that every workspace-excluded crate's [package] keys agree with [workspace.package] for the keys that are meant to be uniform, run in CI alongside the existing gates.
Licence is the one that must not drift. edition and rust-version are near-certainly meant to be uniform too. version is deliberately independent here — periskopio is on 0.1.14 against the workspace's 0.4.0 — so the check needs an explicit allowlist of keys permitted to diverge rather than asserting blanket equality.
Done when: changing a value in [workspace.package] without updating the excluded crates fails CI, naming the crate and the key that disagrees.
Related
#725 fixes the licence instance.
Finding
crates/theatron/desktop(periskopio) sat onlicense = "AGPL-3.0-or-later"for the entire life of the fleet licence posture, while[workspace.package]declaredLicenseRef-PolyForm-Noncommercial-1.0.0. The repository was publishing one crate under a licence the project does not use, and nothing reported it.The cause is structural rather than an oversight by whoever ran the migration.
Evidence
The crate is in the root manifest's
excludelist, notmembers(Cargo.toml:27-30):Every one of the other twenty-one crates carries
license.workspace = trueand therefore tracked the posture automatically. An excluded crate has no workspace root to inherit from —cargorefuses the manifest outright:So the excluded crates are precisely the ones that must restate workspace-wide facts, and precisely the ones a workspace-wide edit does not reach.
Note
akouo/shared/akouo-coreis excluded by the same list and needs the same check.Why this matters
Licence is the visible instance, but the class is any fact declared once in
[workspace.package]—edition,rust-version,version,repository,authors. A change to any of them updates twenty-one crates and silently skips the excluded ones, and the resulting disagreement is invisible until someone reads the two manifests side by side. Here it went unnoticed long enough that the fix arrived as an uncommitted edit in a shared clone rather than as a PR.The failure is also quiet in the direction that matters: the excluded crate keeps building fine. Nothing about a stale value breaks a compile, so there is no signal at all until a human notices — and for a licence, "nobody noticed" is the expensive part.
Desired correction
A check that every workspace-excluded crate's
[package]keys agree with[workspace.package]for the keys that are meant to be uniform, run in CI alongside the existing gates.Licence is the one that must not drift.
editionandrust-versionare near-certainly meant to be uniform too.versionis deliberately independent here —periskopiois on0.1.14against the workspace's0.4.0— so the check needs an explicit allowlist of keys permitted to diverge rather than asserting blanket equality.Done when: changing a value in
[workspace.package]without updating the excluded crates fails CI, naming the crate and the key that disagrees.Related
#725 fixes the licence instance.