veredictum 0.1.5

The independent conformance instrument for openEHR clinical data repositories: a machine-readable catalogue of spec-cited test cases, executed against any running CDR, judged by pure-function verdicts
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

# REUSE Specification 3.3 — https://reuse.software/spec-3.3/
#
# WHAT THIS ADDS. Licensing is also recorded per file where a header fits, and
# per vendored tree by a `PROVENANCE.md` naming the upstream source, the pinned
# revision and the licence. What neither of those does is SURVIVE A FILE LEAVING
# THIS REPOSITORY — the property REUSE exists for, that licensing "is preserved
# when the file is copied and reused by third parties". Someone who lifts one
# case out of the catalogue, or one archetype out of a corpus, takes a file whose
# terms are otherwise stated only in a manifest they did not copy. This
# instrument is built to be forked and re-run by other people, so downstream
# file-level reuse is the expected case.
#
# HOW THE TABLES COMPOSE, because ordering is load-bearing: "If a Covered File
# is covered by multiple [[annotations]] tables in the same REUSE.toml file,
# then exclusively the LAST matching table in the file is used" (spec 3.3). So
# the catch-all comes first and every later table narrows it.
#
# PRECEDENCE, likewise from the spec: `closest` associates licensing found
# INSIDE the file (a comment header or a `.license` sidecar) and falls back to
# the table only when the file carries none; `override` ignores anything closer.
# First-party globs use `closest`, so adding a real SPDX header to a source file
# is an improvement that takes effect immediately and never contradicts this
# file. Vendored globs use `override`, where the upstream tree's terms are
# settled by its `PROVENANCE.md` rather than by any per-file marking.

version = 1

# ── Catch-all: everything in this repository is Veredictum's own, Apache-2.0 ──
# `closest` means a file carrying its own SPDX header wins over this
# declaration. `LICENSES/Apache-2.0.txt` is the licence text REUSE requires,
# and it is byte-identical to the root `LICENSE`.
[[annotations]]
path = "**"
precedence = "closest"
SPDX-FileCopyrightText = "Veredictum contributors"
SPDX-License-Identifier = "Apache-2.0"

# ── The vendored openEHR specification text: the oracle ─────────────────────
# CC-BY-SA-3.0, the terms the specification documents themselves carry.
[[annotations]]
path = "specs/openehr/**"
precedence = "override"
SPDX-FileCopyrightText = "openEHR Foundation"
SPDX-License-Identifier = "CC-BY-SA-3.0"

# ── The vendored machine-readable openEHR artifacts ─────────────────────────
# The XSD bundles, the ITS-JSON schemas and the ITS-REST OpenAPI documents come
# from the specification repositories, which carry Apache-2.0 at their root.
# (Each OAS bundle declares CC-BY-ND-3.0 in its own `info.license` stanza,
# contradicting that grant; the contradiction is reported upstream and the files
# are taken under the repository LICENSE — see `specs/rest-oas/PROVENANCE.md`.)
[[annotations]]
path = [
  "specs/its-xml-schemas/**",
  "specs/its-json-schemas/**",
  "specs/rest-oas/**",
]
precedence = "override"
SPDX-FileCopyrightText = "openEHR Foundation"
SPDX-License-Identifier = "Apache-2.0"

# ── The clinical-model corpora ──────────────────────────────────────────────
# CKM-derived archetypes and operational templates, plus the upstream ADL 2
# reference pack. Both CC-BY-SA versions occur across these trees, so `AND` is
# the only true statement about the tree as a whole; each archetype's own
# `licence` metadata remains the authority for that individual file.
[[annotations]]
path = "artifacts/corpus/**"
precedence = "override"
SPDX-FileCopyrightText = ["openEHR Foundation", "the respective archetype authors"]
SPDX-License-Identifier = "CC-BY-SA-3.0 AND CC-BY-SA-4.0"

# ── The embedded bench fixtures: third-party bytes inside our own tree ──────
# A bench pack is compiled into the binary, so the bytes it offers a system
# live under `app/` where the catch-all above would claim them for Veredictum.
# They are not ours. The operational template is byte-identical to the vendored
# CKM export under `artifacts/corpus/templates/ckm/`, so it carries that tree's
# declaration.
[[annotations]]
path = "app/veredictum/src/bench/fixtures/vital_signs.opt"
precedence = "override"
SPDX-FileCopyrightText = ["openEHR Foundation", "the respective archetype authors"]
SPDX-License-Identifier = "CC-BY-SA-3.0 AND CC-BY-SA-4.0"

# The composition instance comes from a public attachment on the openEHR
# Discourse forum, where the publisher declared no licence. Nothing here
# asserts a grant on the publisher's behalf; the LicenseRef text records what
# is known and what is not. Its invalid twin, which the commit-validation
# canary offers, is those same bytes with one member deleted, so it is a
# derivative and carries the same declaration.
[[annotations]]
path = [
  "app/veredictum/src/bench/fixtures/vital_signs_composition.json",
  "app/veredictum/src/bench/fixtures/vital_signs_composition.missing_composer.json",
]
precedence = "override"
SPDX-FileCopyrightText = "the publisher of the openEHR Discourse benchmark harness attachment"
SPDX-License-Identifier = "LicenseRef-openEHR-forum-attachment"

# ── One vendored file whose NAME contains a newline character ───────────────
# A file in the vendored CNF suite is tracked with a literal U+000A inside its
# filename — an upstream defect, and not something this repository may rename,
# because hand-editing a vendored tree is forbidden and the fix belongs
# upstream. Glob matching over a newline-bearing path does not reach it, so it
# is named explicitly.
[[annotations]]
path = "specs/openehr/CNF/tests/platform/robot/I_EHR_COMPOSITION/get_composition/I_EHR_COMPOSITION.get_composition_version-bad_ehr\n.robot"
precedence = "override"
SPDX-FileCopyrightText = "openEHR Foundation"
SPDX-License-Identifier = "CC-BY-SA-3.0"

# ── Our own provenance records inside the vendored trees ────────────────────
# The PROVENANCE.md files are FIRST-PARTY prose about the upstream material:
# what was fetched, from which commit, under which terms, and what exercises it.
# They are ours, Apache-2.0, and they sit inside directories the tables above
# claim for the openEHR Foundation. Placed LAST, because a later matching
# annotation wins.
[[annotations]]
path = [
  "specs/its-xml-schemas/PROVENANCE.md",
  "specs/its-json-schemas/PROVENANCE.md",
  "specs/rest-oas/PROVENANCE.md",
  "artifacts/corpus/archetypes/adl2/PROVENANCE.md",
  "artifacts/corpus/archetypes/ckm/PROVENANCE.md",
  "artifacts/corpus/templates/ckm/PROVENANCE.md",
  "artifacts/corpus/templates/ckm/full/PROVENANCE.md",
]
precedence = "override"
SPDX-FileCopyrightText = "Veredictum contributors"
SPDX-License-Identifier = "Apache-2.0"