License OIC under PolyForm Noncommercial 1.0.0

AGENTS.md

@@ -37,8 +37,9 @@ semantic gate.
 ## Claims and licensing
 
 Follow `CLAIMS.md`, `LIMITATIONS.md`, and `STATUS.md` literally. This repository
-has no license grant; do not add a LICENSE file, SPDX grant, or open-source usage
-claim without separate written owner authorization.
+is licensed under the PolyForm Noncommercial License 1.0.0. Do not describe it
+as open source or imply commercial-use rights; commercial use requires a
+separate written license from Veraxis.
 
 ## Telemetry and provenance
 
@@ -56,4 +57,3 @@ Agent-Execution-ID: <optional attributable execution identifier>
 
 Trailers are supplemental provenance, not institutional authority or
 independent review.
-

LICENSE

@@ -0,0 +1,131 @@
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree
+to them as both strict obligations and conditions to all
+your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the
+software to do everything you might do with the software
+that would otherwise infringe the licensor's copyright
+in it for any permitted purpose.  However, you may
+only distribute the software according to [Distribution
+License](#distribution-license) and make changes or new works
+based on the software according to [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license
+to distribute copies of the software.  Your license
+to distribute covers distributing the software with
+changes and new works permitted by [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of
+the software from you also gets a copy of these terms or the
+URL for them above, as well as copies of any plain-text lines
+beginning with `Required Notice:` that the licensor provided
+with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to
+make changes and new works based on the software for any
+permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that
+covers patent claims the licensor can license, or becomes able
+to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for
+the benefit of public knowledge, personal study, private
+entertainment, hobby projects, amateur pursuits, or religious
+observance, without any anticipated commercial application,
+is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution,
+public research organization, public safety or health
+organization, environmental protection organization,
+or government institution is use for a permitted purpose
+regardless of the source of funding or obligations resulting
+from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the
+law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of
+your licenses to anyone else, or prevent the licensor from
+granting licenses to anyone else.  These terms do not imply
+any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If
+your company makes such a claim, your patent license ends
+immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have
+violated any of these terms, or done anything with the software
+not covered by your licenses, your licenses can nonetheless
+continue if you come into full compliance with these terms,
+and take practical steps to correct past violations, within
+32 days of receiving notice.  Otherwise, all your licenses
+end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without
+any warranty or condition, and the licensor will not be liable
+to you for any damages arising out of these terms or the use
+or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these
+terms, and the **software** is the software the licensor makes
+available under these terms.
+
+**You** refers to the individual or entity agreeing to these
+terms.
+
+**Your company** is any legal entity, sole proprietorship,
+or other kind of organization that you work for, plus all
+organizations that have control over, are under the control of,
+or are under common control with that organization.  **Control**
+means ownership of substantially all the assets of an entity,
+or the power to direct its management and policies by vote,
+contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the
+software under these terms.
+
+**Use** means anything you do with the software requiring one
+of your licenses.

README.md

@@ -460,8 +460,10 @@ foundation. It is not a functioning institutional compiler. Current scope,
 provisional interfaces, corpus restrictions, human-judgment boundaries, and
 benchmark limitations are recorded in [`LIMITATIONS.md`](LIMITATIONS.md).
 
-No license grant or SPDX identity is established. Licensing remains pending
-counsel review.
+Licensed under the PolyForm Noncommercial License 1.0.0.
+Noncommercial use, modification, testing, and distribution are permitted
+subject to the license terms. Commercial use requires a separate written
+license from Veraxis.
 
 ## Claims discipline
 

VERSIONING.md

@@ -26,5 +26,6 @@ identities and migration notes; existing bytes are not silently reinterpreted.
 - Admitted artifacts: never mutated in place; supersede with a new version.
 - Experimental releases: `0.x` tags and explicit evidence/limitation manifests.
 
-No release or attestation is authorized by this policy. Licensing remains
-pending counsel and is not a versioned grant.
+No release or attestation is authorized by this policy. The repository license
+is PolyForm Noncommercial License 1.0.0; commercial use requires a separate
+written license from Veraxis.

docs/SDLC-V1.2-STATUS.md

@@ -14,7 +14,7 @@ owner-authorized `CURRENT-SDLC.md` v1.2, and is **NOT SELF-ADJUDICATED**.
 | H | Supply-Chain & Release Integrity | PASS | Dependencies are hash-locked; consequential Actions are immutable-SHA pinned; CI performs dependency review, advisory scanning, reproducible SBOM generation, and wheel smoke verification. No release is authorized or published, so public artifact provenance/attestation is not claimed. |
 | I | Security & Vulnerability Management | PASS | `SECURITY.md` states the non-service scope, private disclosure route, supported state, triage boundary, and scanner limitations; dependency review and advisory scan are green on the exact PR head. |
 | J | API & Versioning Integrity | PASS | `VERSIONING.md` declares provisional pre-1.0 CLI, exit-code, schema, manifest, import, and artifact contracts for implemented infrastructure. |
-| K | Machine-Readable Discovery & Licensing | NOT ESTABLISHED | Package metadata, schemas, and machine-readable manifests exist, but the explicit no-license/pending-counsel state remains unchanged. No license or SPDX grant is invented. |
+| K | Machine-Readable Discovery & Licensing | PASS | Package metadata identifies the root `LICENSE`, which contains the PolyForm Noncommercial License 1.0.0. Commercial use requires a separate written license from Veraxis. No conflicting SPDX grant is declared. |
 | L | Public Falsification Completeness | PASS | `make falsify` publicly exercises invalid schema, manifest digest mismatch, semantic-contract mutation, and forbidden semantic code-start for implemented infrastructure (4/4). It does not establish semantic compiler behavior. |
 | M | Agent Interaction Observability | NOT ESTABLISHED | `AGENTS.md` documents GitHub attribution, contribution trailers, dark local activity, and zero hidden telemetry. No approved GitHub-event ingestion, hosted gateway, MCP surface, or Agent Interaction Ledger pipeline is implemented. |
 

docs/operations/FOUNDATION.md

@@ -277,8 +277,9 @@ enforcement artifact (none exists to produce).
   provides the executable evidence.
 - **The credential scan is a coarse tripwire.** It does not scan git history, encoded
   values, or binaries. Passing it is not evidence that the repository contains no secrets.
-- **No license-compatibility determination has been made.** The repository carries no
-  license; licensing is pending counsel (`OWNERS.md`).
+- **No third-party license-compatibility determination has been made.** The repository
+  is licensed under PolyForm Noncommercial License 1.0.0; dependency and corpus-source
+  rights remain separately bounded and unadjudicated.
 - **Verification means byte integrity only.** A digest match proves two byte sequences are
   identical. It establishes no source authority, institutional validity, or semantic
   equivalence.

pyproject.toml

@@ -1,17 +1,14 @@
 [build-system]
-requires = ["setuptools>=77.0.0"]
+requires = ["setuptools>=77.0.3"]
 build-backend = "setuptools.build_meta"
 
-# NOTE ON LICENSING
-# No `license` field, no license classifier, and no LICENSE file are declared.
-# Repository licensing remains pending counsel review (see OWNERS.md).
-# Do not add a license here without written authorization.
-
 [project]
 name = "oic"
 version = "0.1.0a0"
 description = "Open Institutional Compiler - non-semantic infrastructure foundation"
 readme = "README.md"
+license = "PolyForm-Noncommercial-1.0.0"
+license-files = ["LICENSE"]
 requires-python = ">=3.12,<3.13"
 dependencies = [
   "jsonschema>=4.23,<5",

sbom/DEPENDENCY_INVENTORY.md

@@ -3,8 +3,9 @@
 Generated by `scripts/generate_sbom.sh` from the installed environment.
 Do not edit by hand. Regenerate after changing `requirements/*.in`.
 
-The repository itself carries **no license**. Licensing is pending counsel
-review (see `OWNERS.md`). The licenses listed below are those of third-party
+The repository is licensed under the PolyForm Noncommercial License 1.0.0.
+Commercial use requires a separate written license from Veraxis. The licenses
+listed below are those of third-party
 dependencies and are recorded for inventory purposes only; no compatibility
 determination has been made.
 

sbom/README.md

@@ -31,10 +31,11 @@ differs between a local run and a CI run. Everything else is environment-indepen
 
 ## Licensing
 
-**This repository carries no license.** Licensing is pending counsel review (`OWNERS.md`).
+This repository is licensed under the PolyForm Noncommercial License 1.0.0.
+Commercial use requires a separate written license from Veraxis.
 
 The licenses recorded here are those of third-party dependencies, captured for inventory
-purposes only. **No license-compatibility determination has been made**, and nothing in
+purposes only. **No third-party license-compatibility determination has been made**, and nothing in
 this directory should be read as one. `DEPENDENCIES.md` notes that dependency licence
 compatibility is part of the pending licensing review.
 

scripts/generate_sbom.sh

@@ -65,7 +65,7 @@ echo "==> License inventory"
 # module as the license file for at least one dependency, embedding binary content and
 # the generating machine's absolute paths into the output. That is both junk data and a
 # path leak in a committed artifact. The declared license name is what the inventory
-# needs; full license texts belong in a licensing review, which is pending counsel.
+# needs; full third-party license texts belong in a separate compatibility review.
 pip-licenses \
   --format=json \
   --with-authors \
@@ -79,8 +79,9 @@ echo "==> Dependency inventory"
   echo "Generated by \`scripts/generate_sbom.sh\` from the installed environment."
   echo "Do not edit by hand. Regenerate after changing \`requirements/*.in\`."
   echo
-  echo "The repository itself carries **no license**. Licensing is pending counsel"
-  echo "review (see \`OWNERS.md\`). The licenses listed below are those of third-party"
+  echo "The repository is licensed under the PolyForm Noncommercial License 1.0.0."
+  echo "Commercial use requires a separate written license from Veraxis. The licenses"
+  echo "listed below are those of third-party"
   echo "dependencies and are recorded for inventory purposes only; no compatibility"
   echo "determination has been made."
   echo

tests/contract/test_claims_discipline.py

@@ -182,13 +182,15 @@ def test_ci_guide_documents_secret_scan_limitations(documents: dict[str, str]) -
     assert "never git history" in text
 
 
-def test_no_license_file_was_added(repo_root: Path) -> None:
-    """Licensing remains pending counsel; adding a license is prohibited."""
-    for name in ("LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING", "COPYING.txt"):
-        assert not (repo_root / name).exists(), f"{name} must not exist"
+def test_polyform_noncommercial_license_is_declared(repo_root: Path) -> None:
+    """The owner-selected license is present without a conflicting grant."""
+    license_text = (repo_root / "LICENSE").read_text(encoding="utf-8")
+    assert license_text.startswith("# PolyForm Noncommercial License 1.0.0\n")
+    assert "https://polyformproject.org/licenses/noncommercial/1.0.0" in license_text
     pyproject = (repo_root / "pyproject.toml").read_text(encoding="utf-8")
-    assert "\nlicense =" not in pyproject
+    assert '\nlicense = "PolyForm-Noncommercial-1.0.0"' in pyproject
     assert "License ::" not in pyproject
+    assert 'license-files = ["LICENSE"]' in pyproject
 
 
 def test_claims_bearing_documents_are_unchanged_by_this_work_order(repo_root: Path) -> None:

tests/contract/test_dependency_metadata.py

@@ -206,11 +206,15 @@ def test_no_forbidden_dependency_is_declared_or_locked(repo_root: Path) -> None:
         assert overlap == [], f"{lockfile} locks forbidden dependencies: {overlap}"
 
 
-def test_package_declares_no_license(repo_root: Path, pyproject: dict[str, object]) -> None:
+def test_package_declares_polyform_license_file(
+    repo_root: Path, pyproject: dict[str, object]
+) -> None:
     project = pyproject["project"]
     assert isinstance(project, dict)
-    assert "license" not in project
-    assert "license-files" not in project
+    assert project["license"] == "PolyForm-Noncommercial-1.0.0"
+    assert project["license-files"] == ["LICENSE"]
+    license_text = (repo_root / "LICENSE").read_text(encoding="utf-8")
+    assert license_text.startswith("# PolyForm Noncommercial License 1.0.0\n")
     classifiers = project.get("classifiers", [])
     assert isinstance(classifiers, list)
     assert not any("License" in str(item) for item in classifiers)