License review for vendored standards XSDs in static/schemas/

[pedroanisio]

Context

In the recent CBM-MCP audit of the code-tools-inspect bundle, we vendored 16 industry-standard XSDs into static/schemas/ to use as classifier fixtures and a future vocab seed (see #2 below if/when filed).

Several of those files encode copyrighted standards and may be derivative works:

• ieee_12207.xsd — IEEE Std 12207 (Software life-cycle processes)
• ieee_29148.xsd — IEEE Std 29148 (Requirements engineering)
• iec_5055.xsd — IEC 5055

IEEE and IEC standards are not open-licensed by default. The XSD encodings may be derivative works that require permission to redistribute.

What to verify

For each file in static/schemas/:

1. Locate the upstream source of the XSD (the code-tools-inspect repo at commit 8f41642c0461fb9062e52e573d51a1abd71ac91e, path _data/schemas/).
2. Determine whether the original XSD ships with a license, public-domain dedication, or fair-use claim.
3. Decide per-file: keep / remove / replace with a synthetic equivalent.

Files to assess

File	SHA-256 (first 8)	Risk
static/schemas/ieee_12207.xsd	bd2636be	High — IEEE standard
static/schemas/ieee_29148.xsd	aba6cab0	High — IEEE standard
static/schemas/iec_5055.xsd	cf5e408c	High — IEC standard
static/schemas/eic_v1_0.xsd	b24873d7	Medium — EIC v1.0
static/schemas/ast_v1_0.xsd	ae207e52	Low — generic AST schema
static/schemas/c4_v2.xsd	88942a30	Low — C4 model (open)
static/schemas/ddd_v2_0.xsd	d2203b99	Low — DDD methodology
static/schemas/ddd/v3_0_0/*.xsd	(6 files)	Low — DDD methodology
static/schemas/bridge/v1_0/ddd-python-bridge-spec.xsd	a6f51df8	Low — project-internal
static/schemas/bridge_ast_treesitter_v1_0.xsd	6794c953	Low — project-internal
static/schemas/python-metacode/v1_4/py-metacode.xsd	572e99b0	Low — project-internal

Deliverable

• Per-file disposition (keep / remove / replace) recorded in a follow-up static/schemas/NOTICE.md documenting:
  • Source repo and commit (pedroanisio/code-tools-inspect@8f41642c… if that's the upstream)
  • Per-file license claim or attribution
  • Files that were synthesized instead of vendored

Block

This issue must be resolved before publishing the directory in any release artifact or shipping it with the wheel. Local-only use as test fixtures is unaffected.

References

• File copied in session: static/schemas/ (16 XSDs deduped from 27 source paths)
• Adjacent test: tests/verify_xsd_fixture.py (already landed)

[pedroanisio]

Blocks #2 (XSD → SKOS vocab seeder).

The seeder in #2 will read the same files this issue evaluates, then extract and redistribute element/complexType/attribute names as SKOS concepts in our codebase_mapper/vocab/. Any disposition reached here (keep / remove / replace with synthetic equivalents) directly determines which seeded collections #2 can ship publicly.

Fixture-only local use (today's state) is unaffected — tests/verify_xsd_fixture.py runs against the files as-is.