fix: produce complete dependency license reports

.github/workflows/format.yml

@@ -9,6 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: "22"
       - uses: actions/setup-go@v4
         with:
           go-version: "1.22"

.github/workflows/test.yml

@@ -12,6 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: "22"
       - id: cache-node
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:

licenses/Makefile

@@ -24,7 +24,8 @@ help:  # shows all available Make commands
 
 ps: format test  # performs all automated assistance functions during development ("pitstop")
 
-test: .bin/shellcheck .bin/shfmt  # runs all automated tests
+test: .bin/shellcheck .bin/shfmt node_modules  # runs all automated tests
+	node --test report-licenses.test.cjs
 	echo running tests ...
 	find . -type f | grep -v node_modules | grep -v '^\.\/\.bin\/' | grep -v '\.json$$' | grep -v '\.yml$$' | xargs grep -l '^\#!\/' | xargs .bin/shellcheck
 	.bin/shfmt --diff .

licenses/README.md

@@ -20,3 +20,41 @@ To check licenses, run this in your repo:
 
 This script applies all known license checkers for all technology stacks that it
 recognizes in the current directory.
+
+## Inventory reports
+
+Use Node.js 22 or 24 and the installed `license-checker` package for JavaScript
+projects. Install the project's locked dependencies first. For pnpm projects,
+the scanner uses `pnpm list` to follow the installed dependency graph, including
+transitive packages in the virtual store. Missing required packages fail the
+scan. Optional packages absent on the current platform are not included. npm
+projects use the installed license-checker dependency walker.
+
+Go reports scan `./...` and its imports once. Set `GOFLAGS` for the build tags
+used by the product. Test-only imports, other build configurations, and non-Go
+native dependencies are outside this report's scope.
+
+```sh
+.bin/list-licenses > dependency-licenses.csv
+.bin/list-licenses --json > dependency-licenses.json
+```
+
+JSON records preserve the raw `detected_license`, a separate `reviewed_license`,
+the evidence reference, module version, and whether the source resolves locally.
+Local source is not automatically classified as first-party or Apache-licensed.
+The CSV uses the reviewed license when available and otherwise the detected
+license. Policy approval remains a separate step performed by `.bin/licenses`.
+
+Reviewed evidence applies only when the package name, version, and every
+recorded file hash match the installed artifact. A changed artifact keeps its
+detected result. These records correct specific detection gaps; they are not
+wildcard license approvals. `linkio` remains unresolved pending verification of
+its BSD and MIT notices.
+
+The historical Keto namespace package's Apache-2.0 grant was confirmed by an Ory
+maintainer. That record applies only to the exact published artifact; new
+releases should contain their own license metadata and text.
+
+The psx v1.2.77 license explicitly offers `BSD-3-Clause OR GPL-2.0-only`. Its
+reviewed record preserves that choice when the Go detector emits separate BSD
+and GPL rows; it does not infer OR from arbitrary lists of licenses.