RFC 86 Pre-Switch Sign-off Gate (blocks Phase 4)

[jjgao]

Pre-Switch Sign-off Gate

Part of: #8
Blocked by: Phase 3 (#4) — community comment period must close first
Blocks: Phase 4 (#6) — the Switch Commit must not start until this gate is signed

Target window: Sep 20–23, 2026. Hard project deadline is 2026-09-30 (see epic #8). To keep this window short, assemble the record continuously throughout Phases 1–3 rather than starting it here — this issue should be a fast formality (consolidate + sign), not a fresh assembly exercise. Team lead consents (deadline Aug 31 via #3) should be in hand well before this gate.

Goal

Consolidate the entire relicensing record into a single, auditable, signed artifact before the Switch Commit, so the rationale isn't scattered across phase issues and the switch is defensible under later audit.

Make it enforceable and durable

• Hard blocker: Phase 4 (RFC 86 Phase 4: Technical Execution (Switch Commit) #6) is Blocked by this issue.
• Immutable record: commit the record into the repo (e.g. docs/relicensing/) so the decision record lives in git history alongside the switch itself; this issue links to it.
• Named signatories: the team lead of the cBioPortal team at each contributing organization that holds the bulk of the copyright — MSKCC, DFCI, PMCC, CHOP, The Hyve, SE4BIO (per RFC 86 Phase 2: Contributor Outreach & Consent #3). Record explicitly that team lead consent was obtained at the team-lead level, not through formal institutional legal/tech-transfer review — this is a documented, deliberate choice (see CLAUDE.md Decisions) made to fit the project timeline.

Private records (signed originals, not committed to this public repo)

Any legal correspondence and other documents containing sensitive details are stored privately at https://drive.google.com/drive/folders/1pGq4cS1S_gKhCsOsIO7sTEo5IQ9i4pTI (Google Drive, access-restricted). The public record links to this folder as the location of record.

The record (public index) must link

• Component/release manifest (Phase 0 RFC 86 Phase 0: Release & Component Scope #1), incl. the combined-distribution effective license
• Final SBOM / dependency resolution table (Phase 1 RFC 86 Phase 1: Compliance & Dependency Audit #2) — each restricted-license dependency actually resolved
• Contributor → rights-holder consent matrix (Phase 2 RFC 86 Phase 2: Contributor Outreach & Consent #3) — spanning all in-scope repos, with the ≥95% / <5% reconciliation
• Public consent status board (Phase 2 RFC 86 Phase 2: Contributor Outreach & Consent #3), final snapshot linked/archived alongside the record
• Unreachable-contributor disposition/removal evidence (Phase 2 RFC 86 Phase 2: Contributor Outreach & Consent #3)
• AI-authorship legal determination — the legal conclusion on AI-assisted commits/PRs across all tools (Claude and GitHub Copilot confirmed present, per Phase 1 RFC 86 Phase 1: Compliance & Dependency Audit #2)
• Community notice + feedback summary and go/no-go decision (Phase 3 RFC 86 Phase 3: Community Feedback & 30-Day Notice Period #4)
• DCO enforcement live in CI before the switch (pulled forward from Phase 5 RFC 86 Phase 5: Future Governance (DCO + License Scanning) #7)
• Planned switch release/commit decision record
• Reference to the private records folder (signed originals) above

Definition of Done

The consolidated record is published and committed to the repo, every line item above is linked and closed, and the named signatories have signed off. Only then may Phase 4 (#6) begin.