Merge pull request #21738 from github/updates

Added 2026/09/2026-09-30-aletyx-counternotice.md

Author: dmca-sync-bot

2026/09/2026-09-30-aletyx-counternotice.md

@@ -0,0 +1,108 @@
+DMCA COUNTER NOTIFICATION  
+Pursuant to 17 U.S.C. § 512(g) 
+
+To: GitHub, Inc. — Designated Copyright Agent  
+Email: [private]
+
+Re: Counter Notification under 17 U.S.C. § 512(g) in response to the takedown notice submitted by Aletyx, Inc. on April 22, 2026, published at 
+github.com/github/dmca/blob/master/2026/04/2026-04-22-aletyx.md 
+
+To Whom It May Concern: 
+
+I, [private] (GitHub username: [private]; sole 
+representative and registered owner of [private], the registered owner of the GitHub organization @veridtools), submit this Counter Notification under Section 512(g) of the United States Copyright Act, 17 U.S.C. § 512(g), in response to the takedown notice referenced above (the "Takedown Notice") submitted by Aletyx, Inc. 
+
+1.  Identification of the material disabled, and the location at which it appeared before it was removed (17 U.S.C. § 512(g)(3)(B)) 
+
+The Takedown Notice identified the following three (3) GitHub-hosted repositories, in their entirety, as allegedly infringing — these are the repositories that were disabled by GitHub and are the subject of this Counter Notification:  
+
+• https://github.com/veridtools/dmn-fixtures  
+
+• https://github.com/veridtools/dmn-diff  
+
+• https://github.com/veridtools/dmn-diff-highlight  
+
+I note for completeness that the Takedown Notice also identified npm packages associated with these repositories. A parallel Counter Notification will be submitted to npm, Inc. with respect to those packages. 
+
+2.  Statement under penalty of perjury (17 U.S.C. § 512(g)(3)(C)) 
+
+I swear, under penalty of perjury, that I have a good-faith belief that the material identified above was removed or disabled as a result of mistake or misidentification of the material to be removed or disabled. 
+
+3.  Basis of good-faith belief 
+
+The good-faith belief expressed in Section 2 above is based, inter alia, on the following. 
+
+Independent authorship and ownership. All source code in the three (3) disabled repositories was authored and developed by me, on my own equipment, and is published under the MIT License. The copyright in the original works is mine (or that of [private], my Brazilian operating company). All such development occurred after the termination of my prior engagement with Aletyx, Inc. on April 6, 2026 and after Aletyx revoked all of my access to its systems on that same date. 
+
+Aletyx's own admissions in the Takedown Notice. The Takedown Notice itself 
+contains statements that, under United States copyright law, defeat the 
+infringement theory advanced: 
+
+• Concession that no copyrighted work has been registered. The Takedown 
+Notice expressly states: "It has not been registered with the U.S. Copyright 
+Office." Under 17 U.S.C. § 411(a), registration is a precondition to a civil action for infringement of a U.S. work. Absence of registration also bears directly on the good-faith requirement under 17 U.S.C. § 512(c)(3)(A)(v). 
+
+• Concession that the allegedly infringed work cannot be exhibited. The 
+Takedown Notice further states: "The original work is proprietary and not 
+publicly available. It is maintained in private repositories that are not publicly accessible." The complaining party has not provided any specific portion of any specific work for comparison. The "identification of the copyrighted work claimed to have been infringed" required by 17 U.S.C. § 512(c)(3)(A)(ii) was made in conclusory and global terms only, and is not capable of being verified by GitHub against any particular file. 
+
+• Concession that the alleged infringement is one of "concept and purpose," 
+not of expression. The Takedown Notice characterises the allegedly 
+infringing material as packages that "map directly in concept and purpose to 
+the work the contractor was assigned to perform for Aletyx." Concept and 
+purpose are exactly what 17 U.S.C. § 102(b) excludes from copyright 
+protection: "In no case does copyright protection for an original work of 
+authorship extend to any idea, procedure, process, system, method of operation, concept, principle, or discovery, regardless of the form in which it is described, explained, illustrated, or embodied in such work." The Takedown Notice does not allege literal copying of source code; it alleges, on its face, copying of an unprotectable category. 
+
+• Misreading of Article 5.6 of the underlying contract. The Takedown Notice 
+asserts that "Article 5.6 of the Agreement prohibits the incorporation of open source licensing into work product without Aletyx's prior written consent." Article 5.6, in its actual text, restricts the inbound incorporation of third-party open source software into Aletyx Work Product. It does not — and by its words cannot — restrict the outbound release of separate, independently created code under any licence chosen by its author. 
+
+• Theory that the contract was "still active" during the notice period 
+contradicts Aletyx's own Termination Notice. The Takedown Notice asserts 
+that the Veridtools project "was published while the Agreement was still in 
+effect during the 30-day notice period (April 6 through May 6, 2026), during 
+which all intellectual property assignment provisions remained binding". The 
+Termination Notice issued by Aletyx on April 6, 2026 expressly states that "no further Services are required during the notice period" and that access to all Company systems was "revoked effective immediately". Article 5 of the 
+Agreement reaches only Work Product "in connection with the Services." 
+Aletyx cannot simultaneously suspend the very Services to which the IP 
+assignment attaches and assert that the same assignment continues to 
+operate against independent post-termination activity. 
+
+Repository-specific rebuttals. Each of the three disabled repositories is materially distinguishable from any work proprietary to the complaining party:
+
+• @veridtools/dmn-fixtures. This repository contains DMN test fixtures 
+organized for conformance testing. DMN test fixtures are not proprietary to 
+any vendor: they are public, vendor-neutral artifacts curated by the Object 
+Management Group (OMG) — the standards body that authored the DMN 
+specification — and made publicly available through the DMN Technology 
+Compatibility Kit (DMN TCK) at https://github.com/dmn-tck/tck, under the 
+Apache License 2.0. Using and re-organizing public TCK material is the 
+standard practice for any developer validating conformance with the DMN 
+standard. 
+
+• @veridtools/dmn-diff. This repository implements semantic diffing of DMN 
+documents. The Takedown Notice asserts that this technique "is proprietary 
+to Aletyx [and] does not exist elsewhere in the DMN ecosystem". That assertion is factually incorrect. Direct, publicly available prior art has been maintained for years by bpmn-io (the open source organization behind the modeler of Camunda, the largest BPMN/DMN vendor in the world): bpmn-io/dmn-js-differ at https://github.com/bpmn-io/dmn-js-differ (Apache 2.0). The same group also maintains bpmn-io/bpmn-js-differ for the sister BPMN standard. Semantic diffing of DMN documents exists in the public DMN ecosystem under permissive open source licenses; it is neither novel nor proprietary to the complaining party. 
+
+• @veridtools/dmn-diff-highlight. This repository implements text/syntax 
+highlighting for the textual output of a DMN diff — a lightweight presentation utility for diff text. The complaining party has not publicly announced, documented, marketed, or released any product feature corresponding to this repository, and the Takedown Notice does not identify any specific Aletyx work against which the disabled material could be compared. Generic text/syntax highlighting of diff output is, in any event, well-established prior art (e.g., semanticdiff.com, and the visualization integrated into bpmn-io/dmn-js-differ). 
+
+• Underlying technical foundations are public. Across all three repositories, the underlying foundations are public, well-documented industry standards: the OMG DMN specification, the OMG DMN TCK, and W3C XML 
+Canonicalization (Canonical XML 1.0, W3C Recommendation of March 15, 
+2001) — none of which is proprietary to any single vendor. The complaining 
+party itself, in the Statement of Work attached to the contract, describes the relevant services as "Integration with Apache KIE technologies (Drools, Kogito, jBPM)" — public projects of the Apache Software Foundation distributed under the Apache License 2.0. 
+
+4. SUBSCRIBER INFORMATION AND CONSENT TO JURISDICTION  
+
+Subscriber Name: [private]  
+Address: [private]  
+Email: [private]  
+GitHub username: [private]  
+Organization: @veridtools (https://github.com/veridtools) 
+
+Consent to jurisdiction. I consent to the jurisdiction of the Federal District Court for the Northern District of California (the judicial district in which GitHub, Inc. is located), and I will accept service of process from the person who provided the DMCA notification under 17 U.S.C. § 512(c)(1)(C) — namely, Aletyx, Inc., through its counsel, [private] ([private]) — or an agent of such person.
+
+I have read and understand GitHub's Guide to Filing a DMCA Counter Notice.
+
+Best,  
+[private]