foretop lading — AI asset licence checker
Know every licence obligation before it ships.
Lading discovers Python dependencies and AI assets, resolves their licences, and turns them into reviewable obligations and explicit policy decisions.
Available now · Apache-2.0
What it checks
A bounded scanner with explicit evidence and an honest unknown state.
Trace packages and AI assets
Read uv.lock, Hugging Face model and dataset references, vendored PEFT adapters, and optional CycloneDX SBOM input.
Keep provenance attached
Resolve licence metadata through PyPI, Hugging Face, and curated overrides while leaving missing or conflicting evidence unknown.
Apply only the policy you chose
Decompose attribution, redistribution, acceptable-use, field-of-use, and share-alike obligations before evaluating an explicit policy.
Use it locally or as a CI gate
Start report-only
Without --policy, Lading reports and exits successfully. A named preset or YAML policy makes exit 1 mean an explicit violation; warnings alone never fail CI.
One result, several renderers
Choose table, JSON, Mermaid, Markdown, SARIF, annotations, and triage JSON without changing what the scan concluded.
Annotate the pull request
The public repository includes a composite GitHub Action that emits annotations, maintains one summary comment, and preserves the CLI's exit code.
Trust boundary
What leaves the machine?
Repository discovery is local. Licence resolution sends package or asset identifiers—not source contents—to the public PyPI and Hugging Face APIs. The machine-wide Hugging Face cache is read only when requested.
What is outside today's boundary?
- Native dependency discovery currently reads uv.lock; other ecosystems can be supplied through CycloneDX.
- Namespace-less Hugging Face model identifiers may be indistinguishable from ordinary strings.
- This is engineering evidence to review with counsel, not legal advice.
Run it on yours
Install the published package, scan the current directory, and inspect every result before deciding whether to gate CI.