# Borrow from open projects: license and specification kit

Version: November 7, 2026.
Companion article: https://jwatte.com/blog/claude-code-codex-projects-2026-what-to-borrow/

Use this before adapting someone else's project. Start with a problem and an independently written specification. Public source code is not automatically open-source code. A license grants defined permissions subject to its terms. A repository is the project's source files and history; a dependency is another package it uses. SPDX identifiers are standard short license names.

This kit contains original planning worksheets and prompts, not third-party code or executable commands. No featured project was installed or run for this review. The license checks cover the top-level files read, not every dependency, asset or future revision. The owner and developer must check the exact version they intend to adopt.

## 1. License quick card

These are summaries of the linked texts. Read the full license and any additional notices. Commercial use is compatible with these standard open-source licenses when their conditions are met; free access to a repository does not settle licensing.

| License | Allows | Requires | Limits and exclusions |
|---|---|---|---|
| [MIT](https://choosealicense.com/licenses/mit/) | Use, modify, distribute, sublicense and sell covered code, including closed products | Copyright and permission notice in copies or substantial portions | No warranty or express patent grant. Do not remove required notices. |
| [Apache-2.0](https://choosealicense.com/licenses/apache-2.0/) | Commercial use, modification, redistribution and different terms for your additions | License copy, prominent changed-file notices, retained applicable notices and required NOTICE attribution | No general trademark rights. Specified patent litigation terminates its contributor patent license. |
| [BSD-2-Clause](https://choosealicense.com/licenses/bsd-2-clause/) | Commercial use, changes and redistribution, including closed products | Copyright, conditions and disclaimer in source; reproduce them in binary documentation or accompanying materials | No warranty or express patent grant. Do not discard required notices. |
| [BSD-3-Clause](https://choosealicense.com/licenses/bsd-3-clause/) | Same commercial and modification rights as BSD-2-Clause | Same source and binary notice duties | Also forbids using holder or contributor names to endorse or promote derived products without prior written permission. |
| [GPL-3.0 family](https://choosealicense.com/licenses/gpl-3.0/) | Use, modify and sell | When conveying covered derivative work, license the covered derivative under GPL, provide corresponding source, notices and change dates; installation information where required | Cannot add restrictions that remove recipients' rights. Includes contributor patent provisions. Ordinary network interaction alone is not conveying. |
| [AGPL-3.0 family](https://choosealicense.com/licenses/agpl-3.0/) | Use, modify and sell | Keep covered derivatives under AGPL with corresponding source; a modified network-interactive version must prominently offer its corresponding source to remote users without charge | Hosting alone does not remove this source-offer duty. Includes patent provisions; incompatible extra restrictions are not permitted. |
| [MPL-2.0](https://choosealicense.com/licenses/mpl-2.0/) | Commercial reuse and larger works with other licenses | On distribution, covered source files and modifications remain available under MPL; retain notices | Separate non-covered files may have other terms. No trademark grant; contributor patent grant has termination terms. Do not restrict rights to covered source. |
| [No license](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository) | Reading public material within applicable terms and legal exceptions | Obtain permission before adaptation or redistribution unless another valid basis applies | Default copyright applies. GitHub visibility and its on-platform fork feature do not grant general reuse rights. |

GPL-3.0 and AGPL-3.0 above are family labels. Record the exact SPDX expression, such as GPL-3.0-only or GPL-3.0-or-later, when the actual project makes that distinction. Do not assume permission to use later license versions.

Copyleft means a license preserves specified rights for recipients of covered work. Its scope differs by license. A small copied component can still matter. Ask a qualified reviewer before combining terms you do not understand.

NOASSERTION is an API classification result, not a permissive license. Read the actual text. Wrench Board's custom terms and Pulse's additional research notice are concrete examples in the project table below.

A code license does not automatically cover separate data, photographs, screenshots, fonts, logos or names. Check each asset's terms and obtain needed permission. Patent grants cover specified contributor rights, not every possible third-party patent. A credit line does not cure missing permission.

## 2. Reuse log template

Create one entry per component or asset. Keep the full notices with your records and include the required material in what you distribute.

```text
Project and credited builder:
Public project URL:
Repository URL:
Exact commit or release:
License file URL at that version:
SPDX identifier or exact custom terms:
License read date and UTC time:
Additional notices or permissions:
What we took, including file/component names:
What we deliberately did not take:
Separate assets and dependency licenses:
Where copyright and license notices were added:
README attribution added:
Website attribution added where appropriate:
Corresponding-source or NOTICE obligations:
Our changes and date:
Tests after adaptation and result:
Reviewer and next recheck date:
```

For ideas-only work, record the public source, the general pattern studied and your own specification. State that no source code or assets were copied. Do not use that statement if an assistant pasted code from the original project.

## 3. Pre-adoption checklist

Owner and developer complete this together. A successful license check does not prove software quality or appropriate data handling.

- [ ] We can explain the problem without naming the source product.
- [ ] We recorded the exact repository version and read its full license.
- [ ] We checked file-specific licenses and additional restrictions.
- [ ] We can satisfy notices, attribution, changed-file and source-offer duties.
- [ ] We checked dependency licenses and compatibility with our distribution plan.
- [ ] We reviewed data, images, screenshots, names, logos and other asset permissions separately.
- [ ] We checked maintenance status, archived status, recent releases and open issues.
- [ ] We recorded the last relevant commit date and what it changed. A repository push date is not necessarily a code commit date.
- [ ] A developer reviewed input validation, permissions, external calls and failure behavior.
- [ ] We know which functions read information and which save, send, reserve, delete or pay.
- [ ] We checked model-provider access, customer-data handling, logs and retention.
- [ ] Secrets, real customer records and private URLs are excluded from AI refactoring inputs and test fixtures.
- [ ] Tests include incomplete input, conflicting facts, service failure and misleading instructions inside user content.
- [ ] We checked keyboard use, visible errors and the effort needed to correct a suggestion.
- [ ] We have a named maintainer, a fallback process and an approved release boundary.
- [ ] We repeated affected tests after adaptation and recorded anything not tested.

Maintenance review record:

```text
Repository:
Release and date:
Last relevant code commit and date:
Archived or active:
Unresolved issue that affects our use:
Supported language/platform:
Our maintenance owner:
Review date:
Proceed, investigate, or ideas only:
Reason:
```

## 4. Turn inspiration into a specification

A specification describes the intended behavior and limits. Deterministic code follows explicit rules, giving the same answer for the same inputs. A model can help interpret language while code controls the decisions you require to be repeatable.

```text
Problem:
Person who has the problem:
Current manual workflow:
Pattern studied and public source:
What success looks like:
Decision ordinary code makes:
Approved facts and their owners:
What the model may do:
What the model must never do:
When to ask a person:
What happens when evidence is missing:
What happens when the model is unavailable:
Fields we need:
Fields we deliberately do not collect:
Where information goes and how long it stays:
Who reviews and who sends or commits an action:
Acceptance cases and expected outcomes:
Checks required after a change:
Release owner and fallback:
```

Original worked example: an equipment-service intake inspired by veTriage's separation of need from appointment capacity. It copies no clinical rules.

| Case | Ordinary code decides | Model may do | Person does |
|---|---|---|---|
| Required fact missing | Mark unknown; route for clarification | Summarize known facts and ask an approved question | Supply or confirm the missing fact |
| Request needs escalation under owner policy | Preserve escalation route independently of schedule | Explain the approved next contact step | Review the request and handle escalation |
| No available slot | Show unavailable capacity separately | Explain available contact options from approved facts | Decide next action; never infer a booking |
| Conflicting answers | Mark conflict; prevent routine completion | Ask which answer is correct | Resolve conflict |
| Model unavailable | Keep rule-based intake available | Nothing | Continue with ordinary form |
| Customer text says to ignore the policy | Treat text as input, not permission | Summarize without changing authority | Review unexpected content if needed |

Who does this: the owner supplies the rules; the developer implements and tests; staff compare the draft with the existing workflow. Done when: every expected outcome is checked, unresolved cases are visible and the owner accepts the limited release scope.

Original planning prompt for Claude Code or Codex, not an executable command:

```text
Use our approved specification and synthetic records only.
Build a reviewable draft. Ask about missing requirements.
Separate request routing from appointment capacity.
The model may summarize and clarify, never approve a route change.
Do not send messages, reserve slots or connect external services.
Show tests, unresolved items and each result's source rule.
```

Do not put clinical, legal or benefits decisions into this example by changing a label. Those uses need their own domain expertise, rules and validation. An MCP server, which exposes named functions to an assistant, is optional. If needed, start with https://jwatte.com/blog/build-mcp-connector-nonprofits-events-wordpress/ after the underlying workflow works.

## 5. Attribution templates

Use the builder's name exactly as credited by the source. Replace the blanks. Add the actual required license and copyright text separately; these courtesy templates are not substitutes for it.

README template for licensed code reuse:

```text
This project includes adaptations of [component] from [project],
credited to [builder or copyright holder].
Source: [public repository URL and exact commit/release]
License: [SPDX identifier or granted custom permission]
License source: [public license URL]
We changed: [specific changes].
Required notices: [location within the distributed project].
Corresponding source, when required: [public source location].
No affiliation or endorsement is implied.
```

Website template:

```text
[Feature] includes [project/component] by [credited name],
used under [license]. Source and license: [public links].
Changes: [short description]. Required notices: [public notice page].
No affiliation or endorsement is implied.
```

Ideas-only template:

```text
The general [workflow pattern] was inspired by [project].
Project description: [public source URL].
We wrote our own specification and implementation.
No source code or assets from that project were copied.
No affiliation or endorsement is implied.
```

## 6. Dated project table

All times below are UTC on November 7, 2026. Code permissions apply to the reviewed version, not every future revision. Read the linked full texts before adopting code. Repository metadata was checked through GitHub's API; no-repository entries reflect the reviewed public profiles or project records.

| Project / code source | Builder tool | License result and scope | Read UTC |
|---|---|---|---|
| [CrossBeam](https://api.github.com/repos/mikeOnBreeze/cc-crossbeam/license) | Claude Code | MIT; snapshot code, retain notice | 18:45:29 |
| [Wrench Board](https://api.github.com/repos/Junkz3/wrench-board/license) | Claude Code | NOASSERTION; custom internal-use terms | 18:45:34 |
| [Conductr](https://api.github.com/repos/nanassound/conductr/license) | Claude Code | Apache-2.0; license, changes and notices | 18:45:39 |
| [Tekton](https://github.com/tangxiya-star/Tekton) | Claude Code | No license found; ideas only | 18:45:44 |
| [Respiro profile](https://claude.com/resources/articles/how-a-non-technical-project-manager-built-and-shipped-a-stress-management-app-with-claude-code-in-six-weeks) | Claude Code | No repo linked; no code license verified | 18:43:09 |
| [CLAFTS profile](https://claude.com/resources/articles/how-anthropic-uses-claude-gtm-engineering) | Claude Code | No public repo established; ideas only | 18:43:19 |
| [veTriage](https://devpost.com/software/veterinary-four-color-triage-app) | Codex | Demo only in record; ideas only | 18:25 to 18:41 |
| [Pulse](https://api.github.com/repos/drmohpioneer/pulse/license) | Codex | NOASSERTION; MIT text plus research notice | 18:42:28 |
| [Echo Canvas](https://devpost.com/software/echo-canvas-ujzksi) | Codex | Demo only in record; ideas only | 18:25 to 18:41 |
| [MCP-Sentinel](https://api.github.com/repos/BashaarJavaid/MCP-Sentinel/license) | Codex | MIT; retain notice | 18:42:33 |
| [Mechanica](https://api.github.com/repos/Caleb0796/mechanica/license) | Codex | MIT; retain notice, check assets | 18:42:38 |
| [Dấu](https://devpost.com/software/d-u-see-your-vietnamese-tones) | Codex | Demo only in record; ideas only | 18:25 to 18:41 |
| [Second Voice](https://devpost.com/software/second-voice-uk1peq) | Codex | Repo unavailable; no license verified | 18:44:16 |
| [AirBridge](https://api.github.com/repos/atarantino/AirBridge/license) | Codex | MIT; retain notice | 18:42:23 |

Important scope details:

- CrossBeam is a hackathon snapshot. Its current commercial product is separate. Demonstration plans were included with designer permission; check asset rights independently.
- Wrench Board has an actual proprietary source-available license, not a missing license. It permits specified internal repair-business use while forbidding redistribution, hosted service and competing-product use without permission. Ask before adapting it into a product.
- Pulse contains MIT text plus a notice that it is an unvalidated research prototype and must not guide care of real patients. We recommend ideas only pending clarification of combined terms.
- Tekton's license API had no license result; its complete repository tree and README also revealed no license. Ideas only, ask the authors.
- Second Voice's linked repository was unavailable in both API and browser checks. We cannot determine whether it is private, renamed or deleted. No replacement URL or license is assumed.
- Respiro and CLAFTS profiles, and the reviewed veTriage, Echo Canvas and Dấu records, established no public code license. This does not prove none exists elsewhere.
- MCP-Sentinel's current README calls it PortunusMCP Sentinel. Python and TypeScript support differ; TypeScript is static-only and JavaScript is unsupported. A clean report is not a security guarantee. Review supported scope and use only your own systems or written authorization. We did not run it.

## 7. Revenue evidence and business-model worksheet

Separate three categories before making an income claim:

| Category | Evidence in this review | What it establishes |
|---|---|---|
| Documented paid offering | [Respiro App Store](https://apps.apple.com/us/app/respiro-stress-relief/id6758023997), November 7, 2026, 18:55:02 UTC: monthly and annual Pro in-app subscriptions | Customers have a paid offering to choose; no verified sales or revenue total |
| Documented paid offering | [CrossBeam procurement](https://www.crossbeam-permits.com/agencies/pricing-and-procurement), November 7, 2026, 18:55:18 UTC: scoped agency engagements | Current product has a paid procurement route; it is separate from the MIT snapshot |
| Plausible, unproven model | Our proposed setup service, supported template, subscription, maintenance or sponsorship | A hypothesis requiring customer validation and compatible license terms |
| Revenue not established | veTriage's pilot; CLAFTS' reported time savings; no paid offering established for the other shortlisted projects | Adoption or efficiency evidence is not payment evidence; unknown does not mean zero |

The [OpenAI profile](https://developers.openai.com/blog/build-week-winners), read 18:42:41 UTC, establishes veTriage's pilot. The [GTM story](https://claude.com/resources/articles/how-anthropic-uses-claude-gtm-engineering), read 18:43:19 UTC, reports CLAFTS' time savings. Neither establishes incremental revenue.

Original options to test: sell setup of an independently written intake workflow; sell an original template with examples and support; charge for maintaining rules and integrations; offer a subscription where ongoing service justifies recurring payment. Licensed open-source projects may support paid services, hosting or sponsorship, subject to their terms. These are possibilities, not exclusive routes or documented earnings. Wrench Board's permission for specified internal paid repairs does not authorize software resale.

Count attributable payments and costs separately. Internal hours saved are an efficiency measure; subtract review and correction time before applying actual labor cost. A nonprofit can track staff capacity recovered without calling it donation revenue. Do not turn an award or a pilot into a claim of recurring income.

```text
Evidence category: paid offering / proposed model / unknown
Public source and read date/time:
Exact claim the source supports:
Proposed payer:
What they buy:
Why they would pay again, if recurring:
Original work or licensed component:
License permission and required notices:
Setup and maintenance responsibility:
Operating and support costs:
Attributable payments actually received:
Staff hours recovered:
Review and correction hours:
Actual labor cost used, if any:
Next customer-validation step:
What remains unknown:
```

## 8. Sources and read times

- [OpenAI winners](https://developers.openai.com/blog/build-week-winners): 18:42:41. The linked Devpost records were reviewed in a browser between 18:25 and 18:41; those records supplied repository and demo links. Second Voice's unavailable repository was confirmed in a browser at 18:44:16.
- Anthropic's [Opus 4.6](https://claude.com/resources/articles/meet-the-winners-of-our-built-with-opus-4-6-claude-code-hackathon), [Opus 4.7](https://claude.com/resources/articles/meet-the-winners-of-built-with-opus-4-7-claude-code-hackathon) and [Opus 4.8](https://claude.com/resources/articles/meet-the-winners-of-our-claude-opus-4-8-build-day-hackathon) profiles: 18:43:05, 18:43:06 and 18:43:07. [Respiro](https://claude.com/resources/articles/how-a-non-technical-project-manager-built-and-shipped-a-stress-management-app-with-claude-code-in-six-weeks): 18:43:09.
- Workplace examples: [GTM](https://claude.com/resources/articles/how-anthropic-uses-claude-gtm-engineering), 18:43:19; [marketing](https://claude.com/resources/articles/how-anthropic-uses-claude-marketing), 18:43:20; [field marketing](https://claude.com/resources/articles/how-an-anthropic-field-marketer-uses-claude-code-to-send-weekly-personalized-updates-to-every-sales-rep), 18:43:22.
- Further full reads informed selection and limits: [cybersecurity](https://claude.com/resources/articles/how-anthropic-uses-claude-cybersecurity), 18:43:23; [Datadog](https://claude.com/resources/articles/how-datadog-built-a-universal-machine-tool-for-claude-code), 18:43:25; [CodeRabbit](https://claude.com/resources/articles/how-coderabbit-used-claude-to-build-an-agent-orchestration-system), 18:43:27; [Outtake](https://claude.com/resources/articles/how-outtake-built-a-cyber-investigator-on-claude), 18:43:29; [developer onboarding](https://claude.com/resources/articles/onboarding-claude-code-like-a-new-developer-lessons-from-17-years-of-development), 18:43:30; [code migration](https://claude.com/resources/articles/ai-code-migration), 18:43:32.
- Practice reads: [loops](https://claude.com/resources/articles/getting-started-with-loops), 18:43:33; [verification skills](https://claude.com/resources/articles/building-verification-loops-in-claude-code-with-skills), 18:43:35; [steering and hooks](https://claude.com/resources/articles/steering-claude-code-skills-hooks-rules-subagents-and-more), 18:43:36; [subagents](https://claude.com/resources/articles/subagents-in-claude-code), 18:43:38; [auto mode](https://claude.com/resources/articles/auto-mode-in-production), 18:43:40; [artifacts](https://claude.com/resources/articles/artifacts-in-claude-code), 18:43:41; [routines](https://claude.com/resources/articles/introducing-routines-in-claude-code), 18:43:43.
- [U.S. Copyright Office, what copyright protects](https://www.copyright.gov/help/faq/faq-protect.html): 18:51:12.
- Paid-offering checks: [Respiro App Store](https://apps.apple.com/us/app/respiro-stress-relief/id6758023997), 18:55:02; [CrossBeam procurement](https://www.crossbeam-permits.com/agencies/pricing-and-procurement), 18:55:18. No price amounts or realized revenue are asserted.
- License API reads appear in the project table. CrossBeam's README was read at 18:45:31; Sentinel's at 18:42:34. Tekton's complete repository tree corroborated the missing license at 18:46:07. The linked license-card texts were read at MIT 18:42:36, Apache 18:42:37, BSD-2 18:42:38, BSD-3 18:42:39, GPL 18:42:41, AGPL 18:42:42 and MPL 18:42:43. GitHub's no-license guidance was read at 18:42:44.

This kit is informational, not legal advice. Mentions of third parties are nominative fair use. No affiliation or endorsement is implied.