Open Source License Audit: One Ticket per Dependency, Every Exception on Record

Every new dependency brings a license with it

The license policy is short. Permissive licenses pass, weak copyleft needs a review ticket, strong copyleft in shipped code is blocked, an unknown license is blocked until someone finds out, and an exception approved by legal overrides the rule for that one dependency. The scanner opens a GitHub issue for each new dependency, so the inputs are tidy. Keeping the tickets tidy is the hard part.

Dependency issues live in GitHub, approved exceptions on a Notion page, review tickets in ClickUp, and the policy and the blocker sheet in Google Drive. Legal answers by email, engineers argue in Slack, and the blocker sheet is updated by hand from whatever someone remembers. The familiar failures are a second ticket for a dependency that already has one, an exception that never reaches its ticket, and a sheet that still lists a package that changed its license last week.

Who works in the room

A new Kylon room opens for each quarter's audit. Ryan answers anything not addressed to another agent and owns classes and tickets, Ada re-checks the blocker sheet against the live records, and Myco handles everything addressed to legal, which is how the room guidelines divide the work. Engineers who use a coding agent such as Claude Code can bring it into the room to prepare the pull request that replaces a blocked dependency; a person reviews and merges it, and Ryan reads the merged change from GitHub on its next pass.

From scanner issues to a clean blocker sheet

Each stage starts from the live records in GitHub, Notion and ClickUp rather than the last stage's notes, and every write waits for the program lead.

When legal clears the queue and a package relicenses

Legal tends to answer in batches. When counsel approves the whole exception queue at once, four dependencies change at the same moment, and each already has a ClickUp ticket from the first pass. Ryan checks the ticket list before proposing anything, proposes four updates and no new tickets, and the program lead approves them together. Myco drafts the reply to counsel listing the four dependency ids for a person to send.

A relicense and a dropped dependency look alike and are handled differently. When swift-parse moves to MIT, Ryan re-classes it as allow and proposes closing its ticket with the reason. When a merged pull request removes DEP-07 entirely, its ticket is set to Merged, because the fix was a code change, and nothing new is opened. Ada then re-checks the blocker sheet against the live records, so neither change is lost in a row someone forgot to edit.

What the checks catch

• A second ClickUp ticket for a dependency that already has one, caught by checking the list first
• An approved exception written up as a new ticket instead of an update to the existing one
• A blocker sheet row that disagrees with GitHub or ClickUp, however recently it was edited
• An exception on the Notion page that covers a different version from the one in the issue

What stays with people

• Approving every class and ticket change before ClickUp is written
• Granting an exception, which stays with legal counsel
• Reviewing and merging any pull request that replaces or drops a dependency
• Sending anything to legal, since Myco's Gmail drafts wait for a person

Integrations in this workflow

Kylon is not a license scanner or a software composition analysis tool, and it does not replace one. It works with the code host, the exceptions page and the tracker the team already uses, and keeps the audit's coordination in one room.

• ClickUp
• GitHub
• Gmail
• Google Drive
• Notion
• Slack

• GitHub holds one issue per dependency from the scanner, and the pull requests that replace or drop them
• Notion keeps the exceptions legal has approved
• ClickUp carries exactly one review ticket per weak copyleft or blocked dependency
• Google Drive keeps the license policy and the blocker sheet
• Gmail carries messages to legal, which leave only when a person sends Myco's draft
• Slack is where engineers raise dependency questions and where the closeout is shared

Where to start

Begin with one repository's dependency issues for one quarter. Connect the repository and the ClickUp list for license tickets, share the Notion exceptions page with the room, and write one rule in the room guidelines: check for an existing ticket before proposing one, and never open a second ticket for the same dependency.

“Legal cleared four exceptions in one email. Four tickets changed, and none were added.”

Set it up with your agent

Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.