RFC 86 Phase 2: Contributor Outreach & Consent

[jjgao]

Phase 2: Contributor Outreach & Consent

Part of: #8
Blocked by: Phase 0 (#1) — scope sets the consent denominator
Feeds: Pre-Switch Sign-off Gate (#5)

Target windows (hard project deadline 2026-09-30, see epic #8):

• Team lead consent launched Jul 31, 2026, deadline Aug 31, 2026. Consent collected via cbioportal#12282 at the team-lead level rather than through formal legal/tech-transfer review (see CLAUDE.md Decisions).
• Individual contributor outreach launched Jul 28, 2026, deadline Sep 20, 2026 — runs in parallel with Phase 3's 30-day notice period (Aug 21 – Sep 20). Non-responders default to rewrite/remove.

Goal

Obtain consent from all copyright holders in the git history to relicense their contributions under Apache 2.0, across every in-scope repo from the Phase 0 manifest (#1). No prior CLA exists, so explicit consent is required.

Rights-holder identification

Git authors are not always the copyright holders, especially for employment or sponsored work. Build a contributor → probable rights-holder matrix for all retained code, docs, assets, and tests — including co-authors and AI-assisted PRs.

Outreach Strategy

Team Lead Consent
Secure consent from the team lead of the cBioPortal team at each contributing organization — not from a formal legal or tech-transfer office — for the work of individuals who account for the largest share of the codebase: MSKCC, DFCI, PMCC, CHOP, The Hyve, SE4BIO, Bilkent University.

Consent is collected via cbioportal#12282. The consent statement explicitly invites the lead to redirect to the appropriate authority if required, and includes an attestation of the signer's role and good-faith basis — a deliberate, documented trade-off (speed vs. formal legal certainty); see CLAUDE.md Decisions and the sign-off gate (#5).

Individual Contributor Outreach
Send a standardized outreach message to every unique contributor identified in git history (across all in-scope repos) via cbioportal#12271. Outreach template: docs/relicensing/outreach-individual-template.md. Deadline Sep 20, 2026 (runs in parallel with Phase 3); non-responders default to rewrite/removal.

Public Consent Status Board

Precedent: mpv's LGPL relicensing maintained a public page listing every contributor's agree/pending status.

Published: docs/relicensing/contributor-consent-status.md (2026-07-10) — 209 contributors across all 5 in-scope repos, includes team annotations and consent status.

Pre-license-era check (2026-07-10): AGPL LICENSE added 2015-03-18, but root commit dates to 2011-06-17. Recommendation: do not exclude pre-license contributors — copyright exists regardless of licensing. Only 6 of 209 fall in this bucket; none excluded.

• Publish public status board with agreed / pending / declined / unreachable per contributor
• Board contains no raw contact info (no emails, no Slack IDs)
• Merge in cbioportal-core and session-service contributors (done 2026-07-10; 209 total)
• Public individual consent issue created: cbioportal#12271
• Team lead consent issue created: cbioportal#12282
• Update the board as responses come in; link from this issue and sign-off gate (RFC 86 Pre-Switch Sign-off Gate (blocks Phase 4) #5)
• The Vanish List becomes a filtered view of the board (unreachable rows only)

Tasks

• Extract full contributor list from git history for all in-scope repos
• Build contributor → probable rights-holder matrix (incl. co-authors and AI-assisted PRs)
• Draft individual contributor outreach template — docs/relicensing/outreach-individual-template.md
• Run team lead outreach and track responses — deadline Aug 31
• Run individual contributor outreach and track responses — deadline Sep 20
• Track raw contact details privately; publish only names/handles/status on the public board
• Once 95% of codebase by volume is covered: identify files/functions owned by remaining contributors
• Rewrite or remove remaining <5% if consent cannot be obtained — complete by Sep 20

Definition of Done

95% coverage is an operational milestone, not final sufficiency. The final switch requires consent for all retained contributions, or documented rewrite/removal of every uncovered contribution. Public status board complete and linked. The ≥95% / <5% reconciliation recorded for sign-off gate (#5) by Sep 20.

[jjgao]

Process review note: I’d make rights-holder identification more explicit. Git authors are not always the copyright holders, especially for institutional employment or sponsored work.

Suggested additions:

• create a contributor → probable rights-holder matrix for all retained code/docs/assets/tests, including co-authors and AI-assisted PRs
• ensure consent language identifies the repo/project, past contributions, Apache-2.0 target, authority to grant/confirm relicensing, and AI-assisted contributions if applicable
• track raw emails/contact details privately; keep the public Vanish List redacted to names/handles/status only
• treat 95% coverage as an operational milestone, not final sufficiency; final switch should require consent for all retained project-owned contributions or documented rewrite/removal of uncovered contributions

[jjgao]

Phase 2 Preparatory Work — Contributor Analysis

Note: Phase 2 is formally blocked on Phase 0 (#12182) for the final scope/consent denominator, and Phase 1 (#12157) for the dependency audit. This comment captures preparatory analysis that can proceed in parallel.

---

Contributor Extraction (cbioportal + cbioportal-frontend)

Using the GitHub Contributors API across both repos:

Repo	Unique Contributors
cbioportal (backend)	157
cbioportal-frontend	114
Combined (deduplicated humans)	204

Bots excluded: kodiakhq[bot], dependabot[bot], Copilot, snippy-ai, snyk-bot.

---

95% Coverage Analysis

The top 34 contributors account for ≥95% of total commit volume (24,674 combined commits across both repos). The top 10 alone cover ~77%.

Rank	Login	Total Commits	Cumulative %	Institution
1	inodb	4,021	16.3%	MSKCC
2	alisman	3,456	30.3%	—
3	jjgao	3,180	43.2%	—
4	n1zea144	2,169	52.0%	—
5	onursumer	1,934	59.8%	MSKCC
6	zhx828	1,217	64.8%	Oracle
7	gideonite	820	68.1%	BrightBand
8	adamabeshouse	692	70.9%	—
9	ecerami	655	73.5%	—
10	kalletlak	652	76.2%	—
11	dippindots	648	78.8%	—
12	fedde-s	537	81.0%	The Hyve
13	ersinciftci	448	82.8%	—
14	pvannierop	428	84.5%	The Hyve
15	armish	315	85.8%	—
...
34	ritikakundra	—	≥95%	—

Full contributor matrix (with GitHub profile, company, email, backend/frontend split) saved at contributor_matrix.tsv in the RFC working directory.

---

Institution Summary (Tier 1 targets)

Institution	Contributors	Commits	% of Total
MSKCC	7	6,405	26.0%
The Hyve	4	1,167	4.7%
Oracle	1	1,217	4.9%
BrightBand	1	820	3.3%
Boston Children's Hospital	1	115	0.5%
DFCI	1	34	0.1%
NKI	2	25	0.1%

~40% of commits are attributable to an identified institution via GitHub profile data. The remaining ~60% are individual contributors without public institutional affiliation — these are all Tier 2 targets.

Key gap: Several high-volume contributors (e.g., alisman cBioPortal/cbioportal#2, n1zea144 cBioPortal/cbioportal#4, ecerami cBioPortal/cbioportal#9, kalletlak cBioPortal/cbioportal#10) have no institution listed in their GitHub profile and no public email. These will require additional investigation (LinkedIn, paper authorship, git commit email addresses from the repo itself).

---

Outreach Templates Drafted

Two templates have been drafted and saved in the RFC working directory:

• outreach_tier1_letter.md — Formal institution-level letter for MSKCC, Hyve, DFCI, PMCC, CHOP, etc.
• outreach_tier2_template.md — Individual contributor message (GitHub DM / issue comment / email)

Both templates include:

• Clear identification of the repos and contributor's specific contributions
• The Apache 2.0 target and rationale
• Note on AI-assisted contributions (per the 2026-05-19 decision to treat Co-Authored-By: Claude commits as human-authored)
• Confirmation of authority to grant consent

---

Next Steps (pending Phase 0 scope finalization)

• Once Phase 0 (#12182) publishes the component manifest, expand contributor extraction to any additional in-scope repos
• Run git log --format='%ae %an' | sort -u on local clone to get commit-level emails for contributors with no public email
• Resolve institution for high-volume unaffiliated contributors (alisman, n1zea144, ecerami, kalletlak, dippindots, ersinciftci, armish, adamabeshouse)
• Send Tier 1 letters to: MSKCC, The Hyve, DFCI, PMCC, CHOP (confirm PMCC/CHOP contributor presence once full scope is set)
• Begin Tier 2 outreach for top-34 contributors not covered by Tier 1
• Set up consent tracking spreadsheet (public version: names/handles/status only — no raw emails)

[jjgao]

Update: Contributor Matrix Expanded to Include cbioportal-docker-compose

Expanding the earlier analysis to include the cbioportal-docker-compose repo (21 contributors, 240 commits).

Revised Totals (3 repos)

Repo	Unique Contributors
cbioportal (backend)	157
cbioportal-frontend	114
cbioportal-docker-compose	21
Combined (deduplicated humans)	205

All docker-compose contributors are already present in the backend or frontend lists, with one exception: NikdAK (1 commit, docker-compose only) — needs identification.

Total combined commits (humans, all 3 repos): 24,914

95% Coverage Threshold — Unchanged

The top 34 contributors still reach ≥95% of commit volume. The docker-compose commits are small relative to the overall total.

Institution Summary (updated)

Institution	Contributors	Commits	% of Total
MSKCC	8	6,495	26.1%
Oracle	1	1,217	4.9%
The Hyve	4	1,173	4.7%
BrightBand	1	820	3.3%
Boston Children's Hospital	1	118	0.5%
SE4BIO	1	21	0.1%
DFCI	1	36	0.1%
NKI	2	25	0.1%

SE4BIO now appears (previously missing from the 2-repo analysis). contributor_matrix.tsv updated with a docker_commits column.

[jjgao]

Lessons from mpv's GPL → LGPL Relicensing (mpv-player/mpv#2033)

mpv completed a similar relicensing in 2019 after 4 years and 411 comments. Key lessons applicable to Phase 2:

---

Process & legal principles

1. Silence is never consent.
mpv explicitly rejected "non-reply = agreement" (OpenSSL-style): "Copyright law doesn't work this way. If someone doesn't reply... we will have to remove their code." Our Tier 2 outreach must produce genuine responses. Follow-up and the rewrite/removal path for non-responders must be real, not theoretical.

2. Commit volume is a scoping proxy — per-file verification is the real work.
The 95%-by-commit-volume threshold gets us to start outreach. The actual switch commit requires per-file verification: for every source file, every retained change must have a consented author, accounting for refactoring (git blame alone is insufficient). This is significantly more labor-intensive than the contributor list work done so far.

3. Removed or fully rewritten code requires no consent.
If a contributor's changes have since been completely removed or rewritten such that no derived code remains, their permission is moot. This can meaningfully reduce the effective consent denominator — before sending outreach, it's worth doing a pass to identify contributors (especially low-commit ones) whose code is no longer present in any form.

4. Trivial/cosmetic changes may not be copyrightable.
Pure whitespace, reindentation, and reformatting likely carry no copyright. This is a legitimate tool when a contributor is unreachable and their only change was cosmetic — but mpv notes "extreme care" is required; the bar is not always clear.

5. Documentation/test-only contributors can likely be excluded.
mpv skipped contributors whose changes were documentation or website only. This could reduce cBioPortal's Tier 2 list — several of our 1-commit contributors likely touched only docs, test data, or config files.

6. Code copied in from other projects needs its own consent chain.
mpv had to trace lineage through MPlayer and mplayer2. cBioPortal should check whether any code was inlined wholesale from third-party projects (not just library dependencies) — those original authors would also need to be contacted.

---

Metrics & thresholds

7. The 95% threshold is from Dolphin/Mozilla — not law — and the unit matters.
mpv cites Dolphin (95% of contributors) and VLC (99.99% of code + 99% of developers). cBioPortal's plan currently targets 95% by commit volume, which is a different and easier bar than 95% of contributors (which would be ~194 of 204 people). The RFC and the sign-off gate (#12183) should state explicitly which metric is being used and why.

---

Execution & communication

8. Maintain a public consent tracking page.
mpv published a public wiki page showing contributor + status (agreed / pending / unreachable). This is the "Vanish List" model in our plan — the public version should show handle + status only, no raw contact details.

9. Use a preliminary switch before going final.
mpv shipped --enable-preliminary-lgpl3 for several weeks before making the switch permanent. The cBioPortal equivalent would be merging a pre-switch branch or tagging a release candidate before updating the LICENSE file — giving a window for last-minute objections.

10. Plan B should be written down and credible.
mpv's plan B was "write a new player from scratch." Ours is "rewrite or remove the <5% unconsented code." Having this documented up front (as it is in this issue) is the right call — it prevents the process from stalling indefinitely over a small number of unreachable contributors.

11. Expect years, not months.
mpv had ~44k commits and it took 4 years. cBioPortal has ~25k commits across 3 repos. Timeline expectations should be set accordingly.

---

Immediate action items from these lessons

• Before sending Tier 2 outreach, filter contributors whose code has been entirely removed/rewritten (no consent needed)
• Filter doc/test/config-only contributors from the outreach list
• Clarify in the RFC and sign-off gate (#12183) whether "95%" means by commit volume, lines of code, or contributor count
• Design the public consent tracking page (handle + status only)
• Plan per-file verification pass as a distinct sub-task before the switch commit