From c1c349dbb4696b63d0c11a921744ee33d43acc33 Mon Sep 17 00:00:00 2001 From: //AM Date: Thu, 27 Aug 2026 10:53:07 -0400 Subject: [PATCH 1/3] license: adopt PolyForm Noncommercial 1.0.0 --- AGENTS.md | 6 +- LICENSE | 131 +++++++++++++++++++++++ README.md | 6 +- VERSIONING.md | 5 +- docs/SDLC-V1.2-STATUS.md | 2 +- docs/operations/FOUNDATION.md | 5 +- pyproject.toml | 6 +- sbom/DEPENDENCY_INVENTORY.md | 5 +- sbom/README.md | 5 +- scripts/generate_sbom.sh | 7 +- tests/contract/test_claims_discipline.py | 10 +- 11 files changed, 162 insertions(+), 26 deletions(-) create mode 100644 LICENSE diff --git a/AGENTS.md b/AGENTS.md index b81b6ed..508821b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -37,8 +37,9 @@ semantic gate. ## Claims and licensing Follow `CLAIMS.md`, `LIMITATIONS.md`, and `STATUS.md` literally. This repository -has no license grant; do not add a LICENSE file, SPDX grant, or open-source usage -claim without separate written owner authorization. +is licensed under the PolyForm Noncommercial License 1.0.0. Do not describe it +as open source or imply commercial-use rights; commercial use requires a +separate written license from Veraxis. ## Telemetry and provenance @@ -56,4 +57,3 @@ Agent-Execution-ID: Trailers are supplemental provenance, not institutional authority or independent review. - diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..1a71cb6 --- /dev/null +++ b/LICENSE @@ -0,0 +1,131 @@ +# PolyForm Noncommercial License 1.0.0 + + + +## Acceptance + +In order to get any license under these terms, you must agree +to them as both strict obligations and conditions to all +your licenses. + +## Copyright License + +The licensor grants you a copyright license for the +software to do everything you might do with the software +that would otherwise infringe the licensor's copyright +in it for any permitted purpose. However, you may +only distribute the software according to [Distribution +License](#distribution-license) and make changes or new works +based on the software according to [Changes and New Works +License](#changes-and-new-works-license). + +## Distribution License + +The licensor grants you an additional copyright license +to distribute copies of the software. Your license +to distribute covers distributing the software with +changes and new works permitted by [Changes and New Works +License](#changes-and-new-works-license). + +## Notices + +You must ensure that anyone who gets a copy of any part of +the software from you also gets a copy of these terms or the +URL for them above, as well as copies of any plain-text lines +beginning with `Required Notice:` that the licensor provided +with the software. For example: + +> Required Notice: Copyright Yoyodyne, Inc. (http://example.com) + +## Changes and New Works License + +The licensor grants you an additional copyright license to +make changes and new works based on the software for any +permitted purpose. + +## Patent License + +The licensor grants you a patent license for the software that +covers patent claims the licensor can license, or becomes able +to license, that you would infringe by using the software. + +## Noncommercial Purposes + +Any noncommercial purpose is a permitted purpose. + +## Personal Uses + +Personal use for research, experiment, and testing for +the benefit of public knowledge, personal study, private +entertainment, hobby projects, amateur pursuits, or religious +observance, without any anticipated commercial application, +is use for a permitted purpose. + +## Noncommercial Organizations + +Use by any charitable organization, educational institution, +public research organization, public safety or health +organization, environmental protection organization, +or government institution is use for a permitted purpose +regardless of the source of funding or obligations resulting +from the funding. + +## Fair Use + +You may have "fair use" rights for the software under the +law. These terms do not limit them. + +## No Other Rights + +These terms do not allow you to sublicense or transfer any of +your licenses to anyone else, or prevent the licensor from +granting licenses to anyone else. These terms do not imply +any other licenses. + +## Patent Defense + +If you make any written claim that the software infringes or +contributes to infringement of any patent, your patent license +for the software granted under these terms ends immediately. If +your company makes such a claim, your patent license ends +immediately for work on behalf of your company. + +## Violations + +The first time you are notified in writing that you have +violated any of these terms, or done anything with the software +not covered by your licenses, your licenses can nonetheless +continue if you come into full compliance with these terms, +and take practical steps to correct past violations, within +32 days of receiving notice. Otherwise, all your licenses +end immediately. + +## No Liability + +***As far as the law allows, the software comes as is, without +any warranty or condition, and the licensor will not be liable +to you for any damages arising out of these terms or the use +or nature of the software, under any kind of legal claim.*** + +## Definitions + +The **licensor** is the individual or entity offering these +terms, and the **software** is the software the licensor makes +available under these terms. + +**You** refers to the individual or entity agreeing to these +terms. + +**Your company** is any legal entity, sole proprietorship, +or other kind of organization that you work for, plus all +organizations that have control over, are under the control of, +or are under common control with that organization. **Control** +means ownership of substantially all the assets of an entity, +or the power to direct its management and policies by vote, +contract, or otherwise. Control can be direct or indirect. + +**Your licenses** are all the licenses granted to you for the +software under these terms. + +**Use** means anything you do with the software requiring one +of your licenses. diff --git a/README.md b/README.md index 586b2d5..40027a4 100644 --- a/README.md +++ b/README.md @@ -460,8 +460,10 @@ foundation. It is not a functioning institutional compiler. Current scope, provisional interfaces, corpus restrictions, human-judgment boundaries, and benchmark limitations are recorded in [`LIMITATIONS.md`](LIMITATIONS.md). -No license grant or SPDX identity is established. Licensing remains pending -counsel review. +Licensed under the PolyForm Noncommercial License 1.0.0. +Noncommercial use, modification, testing, and distribution are permitted +subject to the license terms. Commercial use requires a separate written +license from Veraxis. ## Claims discipline diff --git a/VERSIONING.md b/VERSIONING.md index 2d927d9..0fa4c93 100644 --- a/VERSIONING.md +++ b/VERSIONING.md @@ -26,5 +26,6 @@ identities and migration notes; existing bytes are not silently reinterpreted. - Admitted artifacts: never mutated in place; supersede with a new version. - Experimental releases: `0.x` tags and explicit evidence/limitation manifests. -No release or attestation is authorized by this policy. Licensing remains -pending counsel and is not a versioned grant. +No release or attestation is authorized by this policy. The repository license +is PolyForm Noncommercial License 1.0.0; commercial use requires a separate +written license from Veraxis. diff --git a/docs/SDLC-V1.2-STATUS.md b/docs/SDLC-V1.2-STATUS.md index cfc8837..0f03f3f 100644 --- a/docs/SDLC-V1.2-STATUS.md +++ b/docs/SDLC-V1.2-STATUS.md @@ -14,7 +14,7 @@ owner-authorized `CURRENT-SDLC.md` v1.2, and is **NOT SELF-ADJUDICATED**. | H | Supply-Chain & Release Integrity | PASS | Dependencies are hash-locked; consequential Actions are immutable-SHA pinned; CI performs dependency review, advisory scanning, reproducible SBOM generation, and wheel smoke verification. No release is authorized or published, so public artifact provenance/attestation is not claimed. | | I | Security & Vulnerability Management | PASS | `SECURITY.md` states the non-service scope, private disclosure route, supported state, triage boundary, and scanner limitations; dependency review and advisory scan are green on the exact PR head. | | J | API & Versioning Integrity | PASS | `VERSIONING.md` declares provisional pre-1.0 CLI, exit-code, schema, manifest, import, and artifact contracts for implemented infrastructure. | -| K | Machine-Readable Discovery & Licensing | NOT ESTABLISHED | Package metadata, schemas, and machine-readable manifests exist, but the explicit no-license/pending-counsel state remains unchanged. No license or SPDX grant is invented. | +| K | Machine-Readable Discovery & Licensing | PASS | Package metadata identifies the root `LICENSE`, which contains the PolyForm Noncommercial License 1.0.0. Commercial use requires a separate written license from Veraxis. No conflicting SPDX grant is declared. | | L | Public Falsification Completeness | PASS | `make falsify` publicly exercises invalid schema, manifest digest mismatch, semantic-contract mutation, and forbidden semantic code-start for implemented infrastructure (4/4). It does not establish semantic compiler behavior. | | M | Agent Interaction Observability | NOT ESTABLISHED | `AGENTS.md` documents GitHub attribution, contribution trailers, dark local activity, and zero hidden telemetry. No approved GitHub-event ingestion, hosted gateway, MCP surface, or Agent Interaction Ledger pipeline is implemented. | diff --git a/docs/operations/FOUNDATION.md b/docs/operations/FOUNDATION.md index 35b7a1c..afdd1e7 100644 --- a/docs/operations/FOUNDATION.md +++ b/docs/operations/FOUNDATION.md @@ -277,8 +277,9 @@ enforcement artifact (none exists to produce). provides the executable evidence. - **The credential scan is a coarse tripwire.** It does not scan git history, encoded values, or binaries. Passing it is not evidence that the repository contains no secrets. -- **No license-compatibility determination has been made.** The repository carries no - license; licensing is pending counsel (`OWNERS.md`). +- **No third-party license-compatibility determination has been made.** The repository + is licensed under PolyForm Noncommercial License 1.0.0; dependency and corpus-source + rights remain separately bounded and unadjudicated. - **Verification means byte integrity only.** A digest match proves two byte sequences are identical. It establishes no source authority, institutional validity, or semantic equivalence. diff --git a/pyproject.toml b/pyproject.toml index dd17dfa..65826e0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -2,16 +2,12 @@ requires = ["setuptools>=77.0.0"] build-backend = "setuptools.build_meta" -# NOTE ON LICENSING -# No `license` field, no license classifier, and no LICENSE file are declared. -# Repository licensing remains pending counsel review (see OWNERS.md). -# Do not add a license here without written authorization. - [project] name = "oic" version = "0.1.0a0" description = "Open Institutional Compiler - non-semantic infrastructure foundation" readme = "README.md" +license-files = ["LICENSE"] requires-python = ">=3.12,<3.13" dependencies = [ "jsonschema>=4.23,<5", diff --git a/sbom/DEPENDENCY_INVENTORY.md b/sbom/DEPENDENCY_INVENTORY.md index f44e56e..bb8bb28 100644 --- a/sbom/DEPENDENCY_INVENTORY.md +++ b/sbom/DEPENDENCY_INVENTORY.md @@ -3,8 +3,9 @@ Generated by `scripts/generate_sbom.sh` from the installed environment. Do not edit by hand. Regenerate after changing `requirements/*.in`. -The repository itself carries **no license**. Licensing is pending counsel -review (see `OWNERS.md`). The licenses listed below are those of third-party +The repository is licensed under the PolyForm Noncommercial License 1.0.0. +Commercial use requires a separate written license from Veraxis. The licenses +listed below are those of third-party dependencies and are recorded for inventory purposes only; no compatibility determination has been made. diff --git a/sbom/README.md b/sbom/README.md index 4e05d42..a93b4ef 100644 --- a/sbom/README.md +++ b/sbom/README.md @@ -31,10 +31,11 @@ differs between a local run and a CI run. Everything else is environment-indepen ## Licensing -**This repository carries no license.** Licensing is pending counsel review (`OWNERS.md`). +This repository is licensed under the PolyForm Noncommercial License 1.0.0. +Commercial use requires a separate written license from Veraxis. The licenses recorded here are those of third-party dependencies, captured for inventory -purposes only. **No license-compatibility determination has been made**, and nothing in +purposes only. **No third-party license-compatibility determination has been made**, and nothing in this directory should be read as one. `DEPENDENCIES.md` notes that dependency licence compatibility is part of the pending licensing review. diff --git a/scripts/generate_sbom.sh b/scripts/generate_sbom.sh index af6be53..448fe29 100755 --- a/scripts/generate_sbom.sh +++ b/scripts/generate_sbom.sh @@ -65,7 +65,7 @@ echo "==> License inventory" # module as the license file for at least one dependency, embedding binary content and # the generating machine's absolute paths into the output. That is both junk data and a # path leak in a committed artifact. The declared license name is what the inventory -# needs; full license texts belong in a licensing review, which is pending counsel. +# needs; full third-party license texts belong in a separate compatibility review. pip-licenses \ --format=json \ --with-authors \ @@ -79,8 +79,9 @@ echo "==> Dependency inventory" echo "Generated by \`scripts/generate_sbom.sh\` from the installed environment." echo "Do not edit by hand. Regenerate after changing \`requirements/*.in\`." echo - echo "The repository itself carries **no license**. Licensing is pending counsel" - echo "review (see \`OWNERS.md\`). The licenses listed below are those of third-party" + echo "The repository is licensed under the PolyForm Noncommercial License 1.0.0." + echo "Commercial use requires a separate written license from Veraxis. The licenses" + echo "listed below are those of third-party" echo "dependencies and are recorded for inventory purposes only; no compatibility" echo "determination has been made." echo diff --git a/tests/contract/test_claims_discipline.py b/tests/contract/test_claims_discipline.py index 8399692..15506e4 100644 --- a/tests/contract/test_claims_discipline.py +++ b/tests/contract/test_claims_discipline.py @@ -182,13 +182,15 @@ def test_ci_guide_documents_secret_scan_limitations(documents: dict[str, str]) - assert "never git history" in text -def test_no_license_file_was_added(repo_root: Path) -> None: - """Licensing remains pending counsel; adding a license is prohibited.""" - for name in ("LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING", "COPYING.txt"): - assert not (repo_root / name).exists(), f"{name} must not exist" +def test_polyform_noncommercial_license_is_declared(repo_root: Path) -> None: + """The owner-selected license is present without a conflicting grant.""" + license_text = (repo_root / "LICENSE").read_text(encoding="utf-8") + assert license_text.startswith("# PolyForm Noncommercial License 1.0.0\n") + assert "https://polyformproject.org/licenses/noncommercial/1.0.0" in license_text pyproject = (repo_root / "pyproject.toml").read_text(encoding="utf-8") assert "\nlicense =" not in pyproject assert "License ::" not in pyproject + assert 'license-files = ["LICENSE"]' in pyproject def test_claims_bearing_documents_are_unchanged_by_this_work_order(repo_root: Path) -> None: From 275c8753987f53efede89a48b77f4f07f51a2b2d Mon Sep 17 00:00:00 2001 From: //AM Date: Thu, 27 Aug 2026 10:55:59 -0400 Subject: [PATCH 2/3] test: reconcile package license metadata assertion --- tests/contract/test_dependency_metadata.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tests/contract/test_dependency_metadata.py b/tests/contract/test_dependency_metadata.py index 78e5bee..3b01a80 100644 --- a/tests/contract/test_dependency_metadata.py +++ b/tests/contract/test_dependency_metadata.py @@ -206,11 +206,15 @@ def test_no_forbidden_dependency_is_declared_or_locked(repo_root: Path) -> None: assert overlap == [], f"{lockfile} locks forbidden dependencies: {overlap}" -def test_package_declares_no_license(repo_root: Path, pyproject: dict[str, object]) -> None: +def test_package_declares_polyform_license_file( + repo_root: Path, pyproject: dict[str, object] +) -> None: project = pyproject["project"] assert isinstance(project, dict) assert "license" not in project - assert "license-files" not in project + assert project["license-files"] == ["LICENSE"] + license_text = (repo_root / "LICENSE").read_text(encoding="utf-8") + assert license_text.startswith("# PolyForm Noncommercial License 1.0.0\n") classifiers = project.get("classifiers", []) assert isinstance(classifiers, list) assert not any("License" in str(item) for item in classifiers) From 3e9f91d81e5292ed618b03e8e4c6e0ce0ae06c3c Mon Sep 17 00:00:00 2001 From: //AM Date: Thu, 27 Aug 2026 11:06:06 -0400 Subject: [PATCH 3/3] license: declare PolyForm SPDX metadata --- pyproject.toml | 3 ++- tests/contract/test_claims_discipline.py | 2 +- tests/contract/test_dependency_metadata.py | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 65826e0..ab4af6f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,5 +1,5 @@ [build-system] -requires = ["setuptools>=77.0.0"] +requires = ["setuptools>=77.0.3"] build-backend = "setuptools.build_meta" [project] @@ -7,6 +7,7 @@ name = "oic" version = "0.1.0a0" description = "Open Institutional Compiler - non-semantic infrastructure foundation" readme = "README.md" +license = "PolyForm-Noncommercial-1.0.0" license-files = ["LICENSE"] requires-python = ">=3.12,<3.13" dependencies = [ diff --git a/tests/contract/test_claims_discipline.py b/tests/contract/test_claims_discipline.py index 15506e4..7789df6 100644 --- a/tests/contract/test_claims_discipline.py +++ b/tests/contract/test_claims_discipline.py @@ -188,7 +188,7 @@ def test_polyform_noncommercial_license_is_declared(repo_root: Path) -> None: assert license_text.startswith("# PolyForm Noncommercial License 1.0.0\n") assert "https://polyformproject.org/licenses/noncommercial/1.0.0" in license_text pyproject = (repo_root / "pyproject.toml").read_text(encoding="utf-8") - assert "\nlicense =" not in pyproject + assert '\nlicense = "PolyForm-Noncommercial-1.0.0"' in pyproject assert "License ::" not in pyproject assert 'license-files = ["LICENSE"]' in pyproject diff --git a/tests/contract/test_dependency_metadata.py b/tests/contract/test_dependency_metadata.py index 3b01a80..a99a647 100644 --- a/tests/contract/test_dependency_metadata.py +++ b/tests/contract/test_dependency_metadata.py @@ -211,7 +211,7 @@ def test_package_declares_polyform_license_file( ) -> None: project = pyproject["project"] assert isinstance(project, dict) - assert "license" not in project + assert project["license"] == "PolyForm-Noncommercial-1.0.0" assert project["license-files"] == ["LICENSE"] license_text = (repo_root / "LICENSE").read_text(encoding="utf-8") assert license_text.startswith("# PolyForm Noncommercial License 1.0.0\n")