Define opt-in licensing for traces, code, and datasets #84

Outcome

Define one visibility- and consent-gated licensing contract for traces, uploaded code, and derived datasets.

Current behavior

The platform can store traces and repositories, but it has no unified contract for training use, commercial reuse, compensation, revocation, or derived artifacts. Earlier everything-public defaults are incompatible with current transparency tiers.

Source: docs/episode-triage.md, episodes 215, 228, 244, 245, and 272.

Contract

• Require explicit opt-in for use beyond delivery.
• Bind consent to owner, artifact digest, permitted uses, visibility tier, term, compensation policy, and license version.
• Distinguish source artifacts, redacted derivatives, aggregates, study packets, model inputs, and learned outputs.
• Define export, revocation, retention, deletion evidence, and already-completed-use behavior.
• Prevent repository membership or public issue state from implying training consent.
• Record redaction and provenance receipts before listing or use.
• Keep self-custody and payout destination independent from data access.
• Publish the contract through web and API before any paid data listing launches.

Acceptance criteria

• A user can see, grant, export, narrow, and revoke consent for each eligible artifact.
• A revoked or expired grant blocks new use and produces a bounded audit record.
• Private code, traces, and customer data never become licensable through an inherited default.
• Every derived dataset records its admitted source grants and transformation digest.
• Compensation terms remain bound to the exact licensed artifact and use.

Verification

Test consent combinations, ownership changes, revocation, derivation, redaction, export, deletion evidence, and cross-tenant isolation. Complete a privacy and legal review before implementation ships.

Dependencies

Depends on project 3 transparency tiers and exact receipt linkage.