California gets roads, traffic, and a car to follow

.gitea/workflows/gates.yml

@@ -13,6 +13,7 @@
 #   clean-clone       a fresh checkout installs, builds and passes its tests
 #   zero-config-boot  the API answers health when handed nothing at all
 #   no-binary-art     src/** carries no committed binary assets
+#   dependency-terms  every locked package uses a reviewed permissive license
 #
 # They are deliberately independent and run in parallel: a broken build should
 # not hide a licensing regression.
@@ -120,3 +121,23 @@ jobs:
 
       - name: no binary art under src/
         run: node scripts/check-no-binaries.mjs
+
+  # ---- Job 4: package terms stay inside the reviewed perimeter ----
+  #
+  # Lockfile metadata makes this dependency-free. A new license stops here and
+  # gets reviewed explicitly instead of arriving transitively with a routine
+  # version bump.
+  dependency-terms:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: dependency license allowlist
+        run: node scripts/check-dependency-licenses.mjs
+
+      - name: SPDX SBOM can be generated from the lockfile
+        run: npm sbom --package-lock-only --sbom-format=spdx > /tmp/tera.spdx.json