[sajor2000]

What

Adds a consolidated, machine-checked THIRD-PARTY-NOTICES.md — MedSci audit gap #10 (medium-impact parity item from docs/audits/2026-10-19-medsci-skills-competitive-audit.md).

• scripts/docs/third-party-notices.ts (new): renders THIRD-PARTY-NOTICES.md from guideline-registry.yaml plus the bolded source-and-licence header every bundled checklist must carry. bun run docs:third-party-notices writes it; --check fails on drift (CI-ready).
• Classification is fail-closed:
  • A header stating neither verbatim wording nor a faithful paraphrase fails generation (no silent defaults).
  • A missing checklist file fails generation.
  • Verbatim requires a strong marker ("quoted/reproduced ... verbatim", "reproduced from ... under CC BY 4.0"); paraphrase markers ("paraphras-", "not a verbatim copy", "shortened", "condense") take precedence only when no strong verbatim phrase applies.
  • Licence detection handles CC BY 4.0 / CC BY / CC BY-NC / CC BY-NC-ND / CC0 / public domain / no-open-licence ("exclusive rights", "not under an open licence") and mixed cases (e.g. CONSORT-N-of-1: verbatim CC BY checklist inside a CC BY-NC article) keep their full statement in the restricted section.
• tests/third-party-notices-doc.test.ts (new): the file matches the generator (drift check), all 49 registry guidelines appear exactly once with DOI + checklist link, every restricted source is pinned to the restricted section, and both fail-closed paths are covered.
• AGENTS.md: documents the generated file next to docs/guideline-sources.md.
• package.json: adds the docs:third-party-notices script.

Current output: 49 checklists — 21 quote item text verbatim under open terms, 28 are faithful paraphrases; 29 restricted or mixed-licence sources carry their full header statement.

Why

The audit (gap #10) found the competitor ships a THIRD-PARTY-NOTICES.md checked on every build while our licence status was scattered across per-checklist headers. This makes the licence posture visible in one file and enforced by bun test, without changing any checklist content.

Closes #148

Validation

• bun test — 1734 pass / 11 skip / 0 fail (full suite)
• bunx tsc --noEmit — clean
• bun run release:validate — in sync (55 agents, 67 skills, 0 MCP servers); no release-owned files touched

• Added generated THIRD-PARTY-NOTICES.md for 49 bundled checklists.
• Added bun run docs:third-party-notices and --check support.
• Added licence classification, restricted-source handling, and fail-closed validation.
• Added tests for drift, registry coverage, restricted sources, and invalid checklist data.
• Documented the generated-document workflow in AGENTS.md.

Author	Lines added	Lines removed
Not available	Not available	Not available

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 69ace787-774a-4a85-abb6-78bd4ed0c173

📥 Commits

Reviewing files that changed from the base of the PR and between 1811214 and 6c425be.

📒 Files selected for processing: 5

• AGENTS.md
• THIRD-PARTY-NOTICES.md
• package.json
• scripts/docs/third-party-notices.ts
• tests/third-party-notices-doc.test.ts

+--------------------------------------+
| Hold on, let me under-engineer this! |
+--------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}