Policy: list only source reviewers may read; every update is reviewed

MOD-POLICY gets the licence rule reviewers already follow: a new project or
a new version needs source under a permissive licence (MIT, MIT-0, BSD,
0BSD, Apache-2.0, ISC, zlib, Unlicense, CC0) or a written grant to the
Horizon reviewers. classic_zoom, distant_horizons, fly_speed and serverify,
listed before, stay as they are until their next version.

The README no longer promises owner updates without a review: every version
of a native mod runs with the player's account permissions, so a reviewer
reads it first.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

MOD-POLICY.md

@@ -36,6 +36,21 @@ Submitting a project, through the form or a pull request, means you confirm that
 You alone are responsible for what you publish and for any claim about it. The Horizon project may refuse, hide or
 remove any project, at any time, without having to give a reason.
 
+## Licences reviewers can read
+
+Reviewers read a project's source before each version is listed; that is how they check it holds nothing harmful.
+They may only read source under a licence that lets them, so a new project, and every new version of a listed one,
+needs source under one of:
+
+- MIT, MIT-0, BSD-2-Clause, BSD-3-Clause, 0BSD, Apache-2.0, ISC, zlib, Unlicense or CC0-1.0;
+- or any licence, with a written grant from its authors that lets the Horizon reviewers read the source to review it
+  (say so in the pull request, with a link to the grant).
+
+Source under GPL, LGPL, MPL or all rights reserved, without such a grant, can't be reviewed, so it can't be listed or
+updated. The projects already listed under other licences when this rule was written (classic_zoom,
+distant_horizons, fly_speed, serverify) stay listed as they are; their next version needs a licence above or a
+grant. A port also has to follow promise 2 above.
+
 ## Copyright and takedowns
 
 If a project in this registry uses your work without your permission:

README.md

@@ -18,8 +18,8 @@ and the launcher to have shipped first.
 
 **Who is responsible.** Except the projects marked Official (made by the Horizon project), everything here is made and
 owned by its own authors, not by the Horizon project or its maintainers. A listing is not an endorsement. See the
-[mod policy](MOD-POLICY.md): what authors promise when they submit (ports of other mods included) and how to have
-a project taken down.
+[mod policy](MOD-POLICY.md): what authors promise when they submit (ports of other mods included), the licences
+whose source reviewers can read, and how to have a project taken down.
 
 ## Submit
 
@@ -41,8 +41,9 @@ cargo install --git https://github.com/horizon-rust/horizon cargo-horizon-mod
 cargo horizon-mod check target/horizon-mod/my_mod.hmod
 ```
 
-**Updates** come the same way: the form adds a version to your entry. Only an entry's `owners` publish its updates
-without a reviewer's extra look. A published file never changes: publish a new version.
+**Updates** come the same way: the form adds a version to your entry, and a reviewer reads it before it is
+published. Only an entry's `owners` can add versions, and every version of a native mod is reviewed, owner or
+not: its code runs with the player's account permissions. A published file never changes: publish a new version.
 
 **Signing** is optional and recommended: put your [minisign](https://jedisct1.github.io/minisign/) public key in your
 entry, and every later version must be signed with it, so nobody else can publish an update in your name.