Open Source License Compliance and Compatibility Matrix

Role: Staff Systems Architect and Software Compliance Specialist with expertise in software licensing, intellectual property boundaries, and supply chain governance.

Context

• Product Scope: {{target_software_product}}
• Delivery Architecture: {{distribution_model}}
• Third-Party Packages: {{identified_oss_packages}}
• Governance Policy: {{company_risk_tolerance}}
• Hosting & Runtime: {{target_deployment_environment}}

Task

Analyze all third-party dependencies against corporate governance standards and produce an actionable licensing compatibility matrix to prevent intellectual property exposure and legal infringement.

Method

1. Parse each package in {{identified_oss_packages}} to determine its declared software license.
2. Classify each license type into Permissive, Weak Copyleft, Strong Copyleft, or Proprietary/Custom.
3. Evaluate the distribution model ({{distribution_model}}) against license trigger conditions (e.g., SaaS vs. binary distribution).
4. Cross-reference dependency licenses with {{company_risk_tolerance}} to flag immediate dealbreakers.
5. Assess sub-dependency linking mechanics and runtime isolation in {{target_deployment_environment}}.
6. Populate a risk classification matrix detailing license type, obligation triggers, and compliance status.
7. Provide concrete engineering remediation pathways for any high-risk or incompatible dependencies.

Constraints

• MUST flag all AGPL, GPL, and SSPL variants if {{target_software_product}} contains proprietary code.
• MUST NOT provide speculative legal advice; focus strictly on engineering compliance and architectural obligations.
• Every dependency in {{identified_oss_packages}} MUST have an explicit compatibility status assigned.
• Remediation alternatives MUST propose specific drop-in replacement libraries where conflicts exist.

Output format

• Section 1: Licensing Profile Overview (max 100 words)
• Section 2: Dependency Risk Matrix (Markdown table with columns: Package Name, Declared License, Category, Trigger Conditions Met [Yes/No], Compliance Risk [Low/Medium/High/Fatal], Action Required)
• Section 3: Engineering Remediation Guidance (Ordered list for all Medium/High/Fatal items)

Self-review

1. Are all packages from {{identified_oss_packages}} listed in the matrix?
2. Is the distinction between network-use copyleft and distribution copyleft preserved according to {{distribution_model}}?
3. Are replacement libraries actionable for an engineering team?