| 1 | # Image Sourcing Policy |
| 2 | |
| 3 | This document defines the copyright-safe image sourcing policy for Claracle (SquadScope). |
| 4 | |
| 5 | ## Core Principle |
| 6 | |
| 7 | **Fair use is not an automated image policy.** All images used in generated content must be explicitly licensed, locally hosted, and registry-tracked. |
| 8 | |
| 9 | ## Image Preference Order |
| 10 | |
| 11 | 1. **Generated data visuals (preferred):** Mermaid diagrams, SVG charts, repo trend cards, signal/noise summaries, star/topic visualizations. These are original works created by the pipeline. |
| 12 | 2. **CC0 / Openverse images:** Only when downloaded, locally hosted, resized to required dimensions, attributed where the source requests it, and recorded in `data/image-registry.json`. |
| 13 | 3. **Local assets:** Original artwork or icons created for the project, registered as `local-asset` license type. |
| 14 | |
| 15 | ## Prohibited Practices |
| 16 | |
| 17 | - **No hotlinking:** Never reference external image URLs in published content. All images must be served from the local repository/deploy. |
| 18 | - **No `og:image` reuse:** Do not scrape or reuse `og:image` meta tags from external articles. An Open Graph tag is not a reuse license. |
| 19 | - **No fair-use automation:** Do not rely on fair use as a justification for automated image sourcing. Fair use requires case-by-case human judgment. |
| 20 | - **No unattributed use:** CC0 images do not legally require attribution, but the registry should still record the source for provenance. |
| 21 | - **No secrets in URLs:** Image paths must never contain SAS tokens, API keys, credentials, or tracking parameters. |
| 22 | |
| 23 | ## GitHub OG Previews |
| 24 | |
| 25 | GitHub auto-generated Open Graph preview images may be used **only when**: |
| 26 | - They are generated/controlled by this repo or repo owner |
| 27 | - They are downloaded and stored locally |
| 28 | - Provenance is recorded in the image registry |
| 29 | - They are NOT scraped from third-party repositories |
| 30 | |
| 31 | ## Image Registry |
| 32 | |
| 33 | All non-generated cover images are tracked in `data/image-registry.json`: |
| 34 | - **Schema:** `data/image-registry.schema.json` |
| 35 | - **Management:** `scripts/manage_image_registry.py` (add, validate, list) |
| 36 | - **Validation:** `scripts/validate_content_images.py` (CI gate) |
| 37 | |
| 38 | ### Required Registry Fields |
| 39 | |
| 40 | | Field | Description | |
| 41 | |-------|-------------| |
| 42 | | `filename` | Relative path from repo root | |
| 43 | | `license` | One of: `CC0`, `Openverse`, `local-asset` | |
| 44 | | `added_by` | Person or automation identifier | |
| 45 | |
| 46 | ### Recommended Fields |
| 47 | |
| 48 | | Field | Description | |
| 49 | |-------|-------------| |
| 50 | | `source_url` | Original source for provenance | |
| 51 | | `attribution` | Attribution text | |
| 52 | | `added_at` | ISO date added | |
| 53 | | `used_in` | Content paths using this image | |
| 54 | | `dimensions` | Width/height object | |
| 55 | |
| 56 | ## Validation Gates |
| 57 | |
| 58 | CI enforces: |
| 59 | 1. `scripts/manage_image_registry.py validate` — registry schema integrity |
| 60 | 2. `scripts/validate_content_images.py` — no hotlinks, no secrets, no unregistered covers in published content |
| 61 | |
| 62 | ## Hugo Configuration |
| 63 | |
| 64 | Hugo Goldmark must remain configured with `unsafe = false`. Image rendering relies on local paths and Hugo's resource pipeline, not raw HTML injection. |
| 65 | |
| 66 | ## Workflow |
| 67 | |
| 68 | 1. Pipeline generates data visuals (Mermaid/SVG) → used directly, no registry needed |
| 69 | 2. If a non-generated cover is needed: |
| 70 | a. Find CC0/Openverse source |
| 71 | b. Download to `assets/covers/` |
| 72 | c. Resize to required dimensions |
| 73 | d. Register via `scripts/manage_image_registry.py add` |
| 74 | e. Reference in frontmatter using the Hugo asset-relative path (e.g., `covers/foo.webp`) |
| 75 | — Hugo resolves this via `resources.Get`; the on-disk file lives at `assets/covers/foo.webp` |
| 76 | 3. CI validates on every PR (registry must exist; path normalization handles both forms) |
| 77 | |
| 78 | ## Ownership |
| 79 | |
| 80 | - **Bender:** Pipeline metadata, registry schema, download/resize automation |
| 81 | - **Hermes:** Copyright/privacy/security policy review |
| 82 | - **Calculon:** Visual/cover design decisions |
| 83 | - **Amy:** Hugo/frontmatter consumption of registered images |
| 84 | - **Fry:** Validation tests and CI gates |