ORA-2.2
A consultancy or agency producing an sbom, under ORA 2.2
Delivering client work using the Work, billing the client for services. Generating a software bill of materials for a customer or regulator. This resolves to the Root tier.
Tier
Owed
Nothing. No fee, no report, no filing.
Sections in play
1.7, 16.1, 2.1, 2.2, 8.1
Who and what
The situation being resolved.
Actor
A consultancy or agency
Delivering client work using the Work, billing the client for services.
under 2M USD
Situation
Producing an SBOM
Generating a software bill of materials for a customer or regulator.
Rulings
3 questions resolved against the text.
Which tier applies?
Root. Delivering client work using the Work, billing the client for services. Below $20,000,000 in trailing revenue, or within an exempt category, no Canopy royalty applies. Sections 4, 6, 8, and 10 still bind every Licensee.
Sections 1.7, 2.1, 2.2
Is anything owed?
Nothing. No fee, no report, no filing.
Sections 2.1
What goes in the SBOM?
Use the SPDX-valid LicenseRef form, the version, the canonical URL, and the attribution records Section 8.1 requires. Until a listed SPDX identifier is issued, do not use an unqualified ORL short form as though it were already on the SPDX License List.
Sections 8.1, 16.1
Cautions
What this situation gets wrong most often.
Revenue is measured across entities under common control, per Section 1.4. A parent company above the threshold makes its subsidiary a Canopy Licensee regardless of that subsidiary's own turnover.
Attribution lives in the package manifest under ORA 8.1, not only in documentation, because an agent package is installed by a machine that never reads a directory listing.
Same actor
Other situations for this party.
Non-normative. Where this and the licence text disagree, the licence text applies.