Legal Review Checklist

Simple Summary

No private learner data or paid GPU work can enter Scooling Lab until legal, security, dependency, and data controls are reviewed and accepted.

Pre-Private-Data Checklist

• Confirm the repository license and distribution model for Scooling Lab.
• Confirm every runtime dependency is listed in DEPENDENCIES.md.
• Confirm every runtime dependency license is allowlisted or separately approved.
• Confirm no AGPL-covered Studio or CLI path is imported, copied, bundled, or exposed.
• Confirm dataset consent, scope, retention, export, and deletion policies are approved.
• Confirm the API rejects browser-supplied worker URLs, callback URLs, shell commands, file paths, and unapproved model ids.
• Confirm logs exclude prompt bodies, private notes, secrets, tokens, local paths, and raw payloads.
• Confirm artifact retention and deletion rules are written and tested.
• Confirm incident response ownership before any private-data pilot.

Pre-Paid-GPU Checklist

• Confirm payer-visible cost policy and spending caps.
• Confirm quota and replay controls for duplicate jobs.
• Confirm cancellation and cleanup behavior before work starts.
• Confirm GPU credentials are environment-scoped and not shared with the browser.
• Confirm network egress rules are allowlisted.
• Confirm no private data reaches test fixtures, logs, telemetry, or artifacts.
• Confirm generated model artifacts have provenance, retention, deletion, and export records.
• Confirm legal approval covers the exact package versions, model licenses, data sources, and deployment lane.

Required Seven-Tier Evidence

• Unit tests for schema, state, license, and error decisions.
• Integration tests for API-to-worker and BOM generation.
• End-to-end tests for fixture job completion and artifact listing.
• Stress tests for deterministic duplicate creation and queue limits.
• Data-integrity tests for stable ids, stable hashes, restart persistence, and Unsloth evidence.
• Performance tests for bounded status/list endpoints and BOM runtime.
• Security tests for path traversal, command injection, URL injection, secret scanning, and AGPL path blocking.