From 7b54d8eb02a49e74e0df5df50e79fe83105d7ed8 Mon Sep 17 00:00:00 2001 From: //AM Date: Thu, 27 Aug 2026 10:53:07 -0400 Subject: [PATCH 1/3] license: adopt PolyForm Noncommercial 1.0.0 --- AGENTS.md | 11 ++- LICENSE | 131 +++++++++++++++++++++++++++++++++++ README.md | 7 +- docs/AGENT-USABILITY.md | 2 +- docs/RELEASE-READINESS.md | 28 +++----- docs/REPOSITORY-USABILITY.md | 9 ++- docs/SDLC-V1.2-STATUS.md | 2 +- pyproject.toml | 15 +--- 8 files changed, 154 insertions(+), 51 deletions(-) create mode 100644 LICENSE diff --git a/AGENTS.md b/AGENTS.md index 7af9a4b..f8a0bfa 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -261,13 +261,10 @@ Do not soften, omit, or paraphrase this ceiling when summarizing the project. ## 15. Licensing -**No license is declared.** No `LICENSE` file exists and `pyproject.toml` -declares no SPDX license field, so default copyright applies and no usage rights -are granted. `pyproject.toml` carries the Trove classifier -`License :: Other/Proprietary License` — a machine-readable statement that this -is **not** open source. That classifier is a description, not a grant. Treat this as source-available for evaluation and reading. **Do not -describe it as open source**, and do not assume redistribution or derivative -rights. Direct licensing questions to the repository owner. +Licensed under the PolyForm Noncommercial License 1.0.0. Noncommercial use, +modification, testing, and distribution are permitted subject to the license +terms. Commercial use requires a separate written license from Veraxis. Do not +describe the project as open source or imply commercial-use rights. ## 15a. Version and interface stability diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..1a71cb6 --- /dev/null +++ b/LICENSE @@ -0,0 +1,131 @@ +# PolyForm Noncommercial License 1.0.0 + + + +## Acceptance + +In order to get any license under these terms, you must agree +to them as both strict obligations and conditions to all +your licenses. + +## Copyright License + +The licensor grants you a copyright license for the +software to do everything you might do with the software +that would otherwise infringe the licensor's copyright +in it for any permitted purpose. However, you may +only distribute the software according to [Distribution +License](#distribution-license) and make changes or new works +based on the software according to [Changes and New Works +License](#changes-and-new-works-license). + +## Distribution License + +The licensor grants you an additional copyright license +to distribute copies of the software. Your license +to distribute covers distributing the software with +changes and new works permitted by [Changes and New Works +License](#changes-and-new-works-license). + +## Notices + +You must ensure that anyone who gets a copy of any part of +the software from you also gets a copy of these terms or the +URL for them above, as well as copies of any plain-text lines +beginning with `Required Notice:` that the licensor provided +with the software. For example: + +> Required Notice: Copyright Yoyodyne, Inc. (http://example.com) + +## Changes and New Works License + +The licensor grants you an additional copyright license to +make changes and new works based on the software for any +permitted purpose. + +## Patent License + +The licensor grants you a patent license for the software that +covers patent claims the licensor can license, or becomes able +to license, that you would infringe by using the software. + +## Noncommercial Purposes + +Any noncommercial purpose is a permitted purpose. + +## Personal Uses + +Personal use for research, experiment, and testing for +the benefit of public knowledge, personal study, private +entertainment, hobby projects, amateur pursuits, or religious +observance, without any anticipated commercial application, +is use for a permitted purpose. + +## Noncommercial Organizations + +Use by any charitable organization, educational institution, +public research organization, public safety or health +organization, environmental protection organization, +or government institution is use for a permitted purpose +regardless of the source of funding or obligations resulting +from the funding. + +## Fair Use + +You may have "fair use" rights for the software under the +law. These terms do not limit them. + +## No Other Rights + +These terms do not allow you to sublicense or transfer any of +your licenses to anyone else, or prevent the licensor from +granting licenses to anyone else. These terms do not imply +any other licenses. + +## Patent Defense + +If you make any written claim that the software infringes or +contributes to infringement of any patent, your patent license +for the software granted under these terms ends immediately. If +your company makes such a claim, your patent license ends +immediately for work on behalf of your company. + +## Violations + +The first time you are notified in writing that you have +violated any of these terms, or done anything with the software +not covered by your licenses, your licenses can nonetheless +continue if you come into full compliance with these terms, +and take practical steps to correct past violations, within +32 days of receiving notice. Otherwise, all your licenses +end immediately. + +## No Liability + +***As far as the law allows, the software comes as is, without +any warranty or condition, and the licensor will not be liable +to you for any damages arising out of these terms or the use +or nature of the software, under any kind of legal claim.*** + +## Definitions + +The **licensor** is the individual or entity offering these +terms, and the **software** is the software the licensor makes +available under these terms. + +**You** refers to the individual or entity agreeing to these +terms. + +**Your company** is any legal entity, sole proprietorship, +or other kind of organization that you work for, plus all +organizations that have control over, are under the control of, +or are under common control with that organization. **Control** +means ownership of substantially all the assets of an entity, +or the power to direct its management and policies by vote, +contract, or otherwise. Control can be direct or indirect. + +**Your licenses** are all the licenses granted to you for the +software under these terms. + +**Use** means anything you do with the software requiring one +of your licenses. diff --git a/README.md b/README.md index 7bd44d2..22e8cb4 100644 --- a/README.md +++ b/README.md @@ -278,9 +278,10 @@ Measured evidence and its limits: [`docs/BENCHMARKS-AC-039.md`](docs/BENCHMARKS- ## License -**No license is currently declared.** This repository contains no `LICENSE` file and `pyproject.toml` declares no license field. Absent an explicit grant, default copyright applies and no usage rights are conferred — so treat this as source-available for evaluation and reading, not as open source. If you need licensed use, ask the repository owner. - -`pyproject.toml` declares the Trove classifier `License :: Other/Proprietary License`. That is the machine-readable statement of the situation described above — it marks the project as **not** open source without inventing a grant. It is a description of the current state, not a license, and it confers nothing. No SPDX identifier is declared, because declaring one would be false. Selecting an actual license is an owner decision that has not been made. +Licensed under the PolyForm Noncommercial License 1.0.0. +Noncommercial use, modification, testing, and distribution are permitted +subject to the license terms. Commercial use requires a separate written +license from Veraxis. --- diff --git a/docs/AGENT-USABILITY.md b/docs/AGENT-USABILITY.md index f30f327..ed8f6c7 100644 --- a/docs/AGENT-USABILITY.md +++ b/docs/AGENT-USABILITY.md @@ -34,7 +34,7 @@ Every command below was executed. Results are pasted from real output. | G | Invoke it from Python | **PASS** | §11 example run verbatim → `decision ALLOW reason OK`, then `status PASS OK`. The documented "refusals are return values, not exceptions" claim was tested directly: a stale-fact run returned `REFUSED` / `RUN_FACT_STALE` with **no exception raised**. | | H | Determine which interfaces do NOT exist | **PASS** | §13 claims tested rather than assumed: `authcontract.server`, `.api`, `.http`, `.registry`, `.db` all raise `ModuleNotFoundError`. `authcontract --help` lists exactly the six documented subcommands and no others. | | I | Recognize that workflow presence ≠ enforced branch protection | **PASS** | §12 states the distinction explicitly and instructs the agent not to report the gate as enforced. Independently corroborated: `authcontract-gate.yml` is `on: pull_request` only. | -| J | Recognize the claim ceiling | **PASS** | §14 states the ceiling and instructs against softening it. §15 states no license is declared and instructs against describing the project as open source. | +| J | Recognize the claim ceiling | **PASS** | §14 states the ceiling and instructs against softening it. §15 states the PolyForm Noncommercial terms and instructs against describing the project as open source or implying commercial-use rights. | **Totals: 10 PASS · 0 FAIL · 0 NOT EVALUATED.** diff --git a/docs/RELEASE-READINESS.md b/docs/RELEASE-READINESS.md index de2b8f4..cf27130 100644 --- a/docs/RELEASE-READINESS.md +++ b/docs/RELEASE-READINESS.md @@ -110,11 +110,9 @@ commitment stated plainly. ### Open, with disposition -**U1 — no licence is declared.** Default copyright applies and no usage rights -are granted. **OPEN — owner decision.** Choosing a licence has legal effect and -is not an executor decision. Stated truthfully in `README.md` and `AGENTS.md` -§15 rather than left for a reader to discover. This is the single largest -adoption barrier in the repository. +**U1 — licensing is declared.** **CLOSED by owner decision.** The root `LICENSE` +contains PolyForm Noncommercial License 1.0.0, and `pyproject.toml` identifies +that file. Commercial use requires a separate written license from Veraxis. **U5 — the benchmark DUT guard treats `README.md` as a protected surface, so documentation-only changes trip it.** **OPEN — deliberately not worked around.** @@ -260,21 +258,11 @@ Key truthful reconciliations: ## Machine-readable licensing -`pyproject.toml` now declares the Trove classifier -`License :: Other/Proprietary License`. That is the ecosystem-standard -machine-readable way to state that this project is **not** open source, and it -confers no rights — it describes the existing default-copyright state rather -than creating a new one. - -No SPDX identifier was declared, because none would be true. A PEP 639 -`license = "LicenseRef-…"` expression was considered and rejected: it would -require an accompanying license text file that only the owner can author. - -**BLOCKED-OWNER-DECISION.** The exact decision needed, and nothing more: *under -what license, if any, is AuthContract offered to third parties?* Until that is -answered, no license file can be added, downstream use remains legally -impossible, and 1.0 remains unreachable. This is the single largest adoption -barrier in the repository (finding U1). +The root `LICENSE` contains the PolyForm Noncommercial License 1.0.0 and +`pyproject.toml` identifies that license file. Noncommercial use, modification, +testing, and distribution are permitted subject to its terms. Commercial use +requires a separate written license from Veraxis. No conflicting SPDX grant is +declared, and no third-party license-compatibility conclusion is established. ## Public falsification diff --git a/docs/REPOSITORY-USABILITY.md b/docs/REPOSITORY-USABILITY.md index 12f195e..e42d527 100644 --- a/docs/REPOSITORY-USABILITY.md +++ b/docs/REPOSITORY-USABILITY.md @@ -107,11 +107,10 @@ persistence layer, no multi-contract registry, and no replay protection. ## Findings -**U1 — No license is declared.** There is no `LICENSE` file and -`pyproject.toml` declares no license field, so default copyright applies and -no usage rights are granted. This is now stated truthfully in the README -rather than left for a reader to discover. **Not resolved here:** choosing a -license is an owner decision with legal effect, not an executor decision. +**U1 — Licensing is declared.** The root `LICENSE` contains the PolyForm +Noncommercial License 1.0.0 and `pyproject.toml` identifies that file. +Commercial use requires a separate written license from Veraxis. This does not +make the project open source or establish third-party license compatibility. **U2 — The README is long (1,215 lines).** The runnable product surface is the first ~250; the remainder is conceptual material describing target behavior, diff --git a/docs/SDLC-V1.2-STATUS.md b/docs/SDLC-V1.2-STATUS.md index 9ec9cd4..31039da 100644 --- a/docs/SDLC-V1.2-STATUS.md +++ b/docs/SDLC-V1.2-STATUS.md @@ -14,7 +14,7 @@ claims, and is **NOT SELF-ADJUDICATED**. | H | Supply-Chain & Release Integrity | PASS | Consequential Actions are immutable-SHA pinned; PR dependency review, advisory scanning, and SBOM generation run in CI. No package/release artifact is published, so artifact digest, provenance, and attestation are not applicable to the current source-only state and are not claimed. | | I | Security & Vulnerability Management | NOT ESTABLISHED | `SECURITY.md` states supported scope, triage expectations, scanner limits, and that a verified private disclosure route is not established. Dependency review and `pip-audit` provide bounded dependency evidence; a scanner result is not represented as an audit. | | J | API & Versioning Integrity | PASS | `VERSIONING.md` declares the pre-1.0 Python API/import, CLI, exit, reason-code, artifact, receipt, and compatibility surfaces. | -| K | Machine-Readable Discovery & Licensing | NOT ESTABLISHED | `pyproject.toml` provides truthful package metadata, but the repository grants no license and declares no SPDX license identity. No grant is invented. | +| K | Machine-Readable Discovery & Licensing | PASS | `pyproject.toml` identifies the root `LICENSE`, which contains the PolyForm Noncommercial License 1.0.0. Commercial use requires a separate written license from Veraxis. No conflicting SPDX grant is declared. | | L | Public Falsification Completeness | PASS | `make falsify` publicly exercises one valid decision and three meaningful refusal/tamper paths: unclassified action, stale fact, and receipt mismatch (4/4). | | M | Agent Interaction Observability | NOT ESTABLISHED | `docs/AGENT-OBSERVABILITY.md` truthfully documents GitHub-attributable versus dark local activity and the no-hidden-telemetry/no-network boundary. No approved ingestion pipeline, hosted gateway, or MCP observability implementation is established. | diff --git a/pyproject.toml b/pyproject.toml index 6e4d9e7..2c24e2b 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -5,21 +5,8 @@ description = "AuthContract reference implementation — canonical digest and ru requires-python = ">=3.10" dependencies = ["rfc8785>=0.1.2,<0.2"] -# Machine-readable licensing state (AC-039). -# -# This project has NO license grant. Default copyright applies and no usage, -# redistribution, or derivative rights are conferred. The Trove classifier below -# is the ecosystem-standard machine-readable way to say exactly that: it marks -# the project as proprietary — i.e. NOT open source — without inventing rights -# that the owner has not granted. -# -# Deliberately NOT declared: any SPDX identifier (MIT/Apache-2.0/BSD/etc.). -# Using one would be false. A PEP 639 `license = "LicenseRef-..."` expression -# would also require an accompanying license text file, which only the owner can -# author. Selecting an actual license remains an open owner decision — see -# docs/VERSIONING.md and README.md. +license-files = ["LICENSE"] classifiers = [ - "License :: Other/Proprietary License", "Development Status :: 2 - Pre-Alpha", "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.12", From 6a768192b5d1cf9de0f46ee6462dfdaf2adb1a2c Mon Sep 17 00:00:00 2001 From: //AM Date: Thu, 27 Aug 2026 11:06:06 -0400 Subject: [PATCH 2/3] license: declare PolyForm SPDX metadata --- pyproject.toml | 3 ++- tests/test_license_metadata.py | 17 +++++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 tests/test_license_metadata.py diff --git a/pyproject.toml b/pyproject.toml index 2c24e2b..59b8400 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -5,6 +5,7 @@ description = "AuthContract reference implementation — canonical digest and ru requires-python = ">=3.10" dependencies = ["rfc8785>=0.1.2,<0.2"] +license = "PolyForm-Noncommercial-1.0.0" license-files = ["LICENSE"] classifiers = [ "Development Status :: 2 - Pre-Alpha", @@ -22,7 +23,7 @@ test = ["pytest>=7.0,<10"] include = ["authcontract*"] [build-system] -requires = ["setuptools>=61"] +requires = ["setuptools>=77.0.3"] build-backend = "setuptools.build_meta" [tool.pytest.ini_options] diff --git a/tests/test_license_metadata.py b/tests/test_license_metadata.py new file mode 100644 index 0000000..dd8273d --- /dev/null +++ b/tests/test_license_metadata.py @@ -0,0 +1,17 @@ +import tomllib +from pathlib import Path + + +ROOT = Path(__file__).parents[1] + + +def test_polyform_noncommercial_metadata_is_exact() -> None: + pyproject = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8")) + project = pyproject["project"] + assert project["license"] == "PolyForm-Noncommercial-1.0.0" + assert project["license-files"] == ["LICENSE"] + assert pyproject["build-system"]["requires"] == ["setuptools>=77.0.3"] + + license_text = (ROOT / "LICENSE").read_text(encoding="utf-8") + assert license_text.startswith("# PolyForm Noncommercial License 1.0.0\n") + assert "https://polyformproject.org/licenses/noncommercial/1.0.0" in license_text From 48b4b6ea5c95a66c3bc597cf61cbf3d41faa2980 Mon Sep 17 00:00:00 2001 From: //AM Date: Thu, 27 Aug 2026 13:01:44 -0400 Subject: [PATCH 3/3] test: support Python 3.10 TOML parsing --- tests/test_license_metadata.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/test_license_metadata.py b/tests/test_license_metadata.py index dd8273d..117b2b8 100644 --- a/tests/test_license_metadata.py +++ b/tests/test_license_metadata.py @@ -1,6 +1,10 @@ -import tomllib from pathlib import Path +try: + import tomllib +except ModuleNotFoundError: # pragma: no cover - exercised by the Python 3.10 CI matrix + import tomli as tomllib + ROOT = Path(__file__).parents[1]