Provenance Record

Well-structured 555-word News article with Overview, What We Know, and What We Don't Know sections. Appropriate scope for a product-feature announcement; the What We Don't Know section correctly flags GA timeline, pricing/bundling, and adoption numbers as undisclosed rather than inventing them.

All 4 source snapshots read in full from local gzip snapshots in sources/2026-07/github-brings-open-source-license-compliance-to-public-preview-letting-enterprises-block-noncompliant-dependencies/ and sha256-verified against manifest.json (all 4 hashes matched exactly). (1) source-0.html.gz (github.blog changelog, June 30 2026): confirms feature name, public-preview status, GHAS Code Security eligibility requirement, ruleset-based 'Require license compliance check results before merging' condition, and the new predefined enterprise role for policy governance — every quote attributed to this source in the article appears verbatim. (2) source-1.html.gz (Help Net Security, July 2 2026, byline Anamarija Pogorelec): confirms the OSPO-as-early-adopter claim and the Jeff Luszcz/Eric Sorenson quote verbatim, including their exact titles (Staff Product Manager / Senior Product Manager). (3) source-2.html.gz (Open Source For You, July 3 2026, byline Jiya Jay Singh): confirms GHAS/Enterprise Cloud eligibility and the Evaluate-vs-Active mode quote verbatim; outlet is a long-running (est. 2003, formerly Linux For You) Asia-focused open-source trade publication with a named byline and editorial masthead — legitimate despite not yet being in config/source_allowlist.txt. (4) source-3.html.gz (docs.github.com, official GitHub Docs 'About open source license compliance' page): confirms the Evaluate/Active mode mechanics, the transitive-dependency evaluation claim, and the SPDX-identifier policy-authoring claim verbatim; this is GitHub's own primary documentation and unambiguously reputable — its absence from the allowlist is a gap in the allowlist file, not a source-quality concern. No WebFetch fallback was needed; all 4 snapshots fetched successfully (HTTP 200).

Every direct quote in the article appears verbatim in its attributed source snapshot. Every specific (license modes, role creation, transitive-dependency scope, SPDX exception mechanism, OSPO's dependency-management use) traces to a cited source. Headline, summary, and lead are all backed by source-0. No fabricated or misattributed claims found. All 4 body URLs are present in article.sources (no orphan-source provenance gap).

Clean, accurate, well-sourced product-announcement article. All four sources personally verified against every claim and quote attributed to them; no misattribution, fabrication, or paraphrase-inside-quotes found. The lone automated warning is a source-allowlist configuration gap, not a factual or sourcing defect. APPROVE.