A conventions test holds every shipping dependency's license to an allow-list #181

What you're trying to do

Keep a dependency under a license that conflicts with MIT out of the shipping packages. TypeKit is MIT and
its packages reference Metalama, Roslyn, EF Core, ASP.NET Core OpenAPI and Serilog. Nothing today reads the
license of what a package reference resolves to, so a new reference under GPL, or under a source-available
license, would pass the build and flow to consumers.

What you'd like

A rule in test/CodoMetis.TypeKit.Conventions.Tests, in the idiom of the existing Metalama rule:

• It reads the restore output of the shipping projects (discovered by globbing src/, so a new package needs
  no edit) and, for each resolved package, the license in its nuspec in the global packages folder.
• It holds each to an allow-list of SPDX ids, which the decision record of Third-party licenses: a package documents what it contains #180 sets.
• A package with only a licenseUrl, or none, fails unless an exceptions list names it with a reason.
• Test and tooling packages (test/, tools/, spikes/) are outside it: they are not shipped.
• It needs the SDK alone. No model, no extra tool, so CI keeps its rule of not depending on AI.

Not yet measured: that every shipping dependency declares a license expression rather than a bare URL. That
decides the size of the exceptions list. The test is shown caught by seeding a disallowed license
(verify-the-guard).

Also to measure here, because decision 125
has no guard for its second rule: a pack-contents rule, that a package holds only assemblies this repository
builds, so a bundled third-party assembly fails until it brings its THIRD-PARTY-NOTICES.txt. Whether it
belongs in this test or beside the packaging tests, and whether packing inside a conventions test is
affordable, is for the measurement to say.

Does it change something that compiles or works today?

No library change. A future dependency under an unlisted license fails the conventions tests until it is
added to the list on purpose.