License AuthContract under PolyForm Noncommercial 1.0.0

AGENTS.md

@@ -261,13 +261,10 @@ Do not soften, omit, or paraphrase this ceiling when summarizing the project.
 
 ## 15. Licensing
 
-**No license is declared.** No `LICENSE` file exists and `pyproject.toml`
-declares no SPDX license field, so default copyright applies and no usage rights
-are granted. `pyproject.toml` carries the Trove classifier
-`License :: Other/Proprietary License` — a machine-readable statement that this
-is **not** open source. That classifier is a description, not a grant. Treat this as source-available for evaluation and reading. **Do not
-describe it as open source**, and do not assume redistribution or derivative
-rights. Direct licensing questions to the repository owner.
+Licensed under the PolyForm Noncommercial License 1.0.0. Noncommercial use,
+modification, testing, and distribution are permitted subject to the license
+terms. Commercial use requires a separate written license from Veraxis. Do not
+describe the project as open source or imply commercial-use rights.
 
 ## 15a. Version and interface stability
 

LICENSE

@@ -0,0 +1,131 @@
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree
+to them as both strict obligations and conditions to all
+your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the
+software to do everything you might do with the software
+that would otherwise infringe the licensor's copyright
+in it for any permitted purpose.  However, you may
+only distribute the software according to [Distribution
+License](#distribution-license) and make changes or new works
+based on the software according to [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license
+to distribute copies of the software.  Your license
+to distribute covers distributing the software with
+changes and new works permitted by [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of
+the software from you also gets a copy of these terms or the
+URL for them above, as well as copies of any plain-text lines
+beginning with `Required Notice:` that the licensor provided
+with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to
+make changes and new works based on the software for any
+permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that
+covers patent claims the licensor can license, or becomes able
+to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for
+the benefit of public knowledge, personal study, private
+entertainment, hobby projects, amateur pursuits, or religious
+observance, without any anticipated commercial application,
+is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution,
+public research organization, public safety or health
+organization, environmental protection organization,
+or government institution is use for a permitted purpose
+regardless of the source of funding or obligations resulting
+from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the
+law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of
+your licenses to anyone else, or prevent the licensor from
+granting licenses to anyone else.  These terms do not imply
+any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If
+your company makes such a claim, your patent license ends
+immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have
+violated any of these terms, or done anything with the software
+not covered by your licenses, your licenses can nonetheless
+continue if you come into full compliance with these terms,
+and take practical steps to correct past violations, within
+32 days of receiving notice.  Otherwise, all your licenses
+end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without
+any warranty or condition, and the licensor will not be liable
+to you for any damages arising out of these terms or the use
+or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these
+terms, and the **software** is the software the licensor makes
+available under these terms.
+
+**You** refers to the individual or entity agreeing to these
+terms.
+
+**Your company** is any legal entity, sole proprietorship,
+or other kind of organization that you work for, plus all
+organizations that have control over, are under the control of,
+or are under common control with that organization.  **Control**
+means ownership of substantially all the assets of an entity,
+or the power to direct its management and policies by vote,
+contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the
+software under these terms.
+
+**Use** means anything you do with the software requiring one
+of your licenses.

README.md

@@ -278,9 +278,10 @@ Measured evidence and its limits: [`docs/BENCHMARKS-AC-039.md`](docs/BENCHMARKS-
 
 ## License
 
-**No license is currently declared.** This repository contains no `LICENSE` file and `pyproject.toml` declares no license field. Absent an explicit grant, default copyright applies and no usage rights are conferred — so treat this as source-available for evaluation and reading, not as open source. If you need licensed use, ask the repository owner.
-
-`pyproject.toml` declares the Trove classifier `License :: Other/Proprietary License`. That is the machine-readable statement of the situation described above — it marks the project as **not** open source without inventing a grant. It is a description of the current state, not a license, and it confers nothing. No SPDX identifier is declared, because declaring one would be false. Selecting an actual license is an owner decision that has not been made.
+Licensed under the PolyForm Noncommercial License 1.0.0.
+Noncommercial use, modification, testing, and distribution are permitted
+subject to the license terms. Commercial use requires a separate written
+license from Veraxis.
 
 ---
 

docs/AGENT-USABILITY.md

@@ -34,7 +34,7 @@ Every command below was executed. Results are pasted from real output.
 | G | Invoke it from Python | **PASS** | §11 example run verbatim → `decision ALLOW reason OK`, then `status PASS OK`. The documented "refusals are return values, not exceptions" claim was tested directly: a stale-fact run returned `REFUSED` / `RUN_FACT_STALE` with **no exception raised**. |
 | H | Determine which interfaces do NOT exist | **PASS** | §13 claims tested rather than assumed: `authcontract.server`, `.api`, `.http`, `.registry`, `.db` all raise `ModuleNotFoundError`. `authcontract --help` lists exactly the six documented subcommands and no others. |
 | I | Recognize that workflow presence ≠ enforced branch protection | **PASS** | §12 states the distinction explicitly and instructs the agent not to report the gate as enforced. Independently corroborated: `authcontract-gate.yml` is `on: pull_request` only. |
-| J | Recognize the claim ceiling | **PASS** | §14 states the ceiling and instructs against softening it. §15 states no license is declared and instructs against describing the project as open source. |
+| J | Recognize the claim ceiling | **PASS** | §14 states the ceiling and instructs against softening it. §15 states the PolyForm Noncommercial terms and instructs against describing the project as open source or implying commercial-use rights. |
 
 **Totals: 10 PASS · 0 FAIL · 0 NOT EVALUATED.**
 

docs/RELEASE-READINESS.md

@@ -110,11 +110,9 @@ commitment stated plainly.
 
 ### Open, with disposition
 
-**U1 — no licence is declared.** Default copyright applies and no usage rights
-are granted. **OPEN — owner decision.** Choosing a licence has legal effect and
-is not an executor decision. Stated truthfully in `README.md` and `AGENTS.md`
-§15 rather than left for a reader to discover. This is the single largest
-adoption barrier in the repository.
+**U1 — licensing is declared.** **CLOSED by owner decision.** The root `LICENSE`
+contains PolyForm Noncommercial License 1.0.0, and `pyproject.toml` identifies
+that file. Commercial use requires a separate written license from Veraxis.
 
 **U5 — the benchmark DUT guard treats `README.md` as a protected surface, so
 documentation-only changes trip it.** **OPEN — deliberately not worked around.**
@@ -260,21 +258,11 @@ Key truthful reconciliations:
 
 ## Machine-readable licensing
 
-`pyproject.toml` now declares the Trove classifier
-`License :: Other/Proprietary License`. That is the ecosystem-standard
-machine-readable way to state that this project is **not** open source, and it
-confers no rights — it describes the existing default-copyright state rather
-than creating a new one.
-
-No SPDX identifier was declared, because none would be true. A PEP 639
-`license = "LicenseRef-…"` expression was considered and rejected: it would
-require an accompanying license text file that only the owner can author.
-
-**BLOCKED-OWNER-DECISION.** The exact decision needed, and nothing more: *under
-what license, if any, is AuthContract offered to third parties?* Until that is
-answered, no license file can be added, downstream use remains legally
-impossible, and 1.0 remains unreachable. This is the single largest adoption
-barrier in the repository (finding U1).
+The root `LICENSE` contains the PolyForm Noncommercial License 1.0.0 and
+`pyproject.toml` identifies that license file. Noncommercial use, modification,
+testing, and distribution are permitted subject to its terms. Commercial use
+requires a separate written license from Veraxis. No conflicting SPDX grant is
+declared, and no third-party license-compatibility conclusion is established.
 
 ## Public falsification
 

docs/REPOSITORY-USABILITY.md

@@ -107,11 +107,10 @@ persistence layer, no multi-contract registry, and no replay protection.
 
 ## Findings
 
-**U1 — No license is declared.** There is no `LICENSE` file and
-`pyproject.toml` declares no license field, so default copyright applies and
-no usage rights are granted. This is now stated truthfully in the README
-rather than left for a reader to discover. **Not resolved here:** choosing a
-license is an owner decision with legal effect, not an executor decision.
+**U1 — Licensing is declared.** The root `LICENSE` contains the PolyForm
+Noncommercial License 1.0.0 and `pyproject.toml` identifies that file.
+Commercial use requires a separate written license from Veraxis. This does not
+make the project open source or establish third-party license compatibility.
 
 **U2 — The README is long (1,215 lines).** The runnable product surface is the
 first ~250; the remainder is conceptual material describing target behavior,

docs/SDLC-V1.2-STATUS.md

@@ -14,7 +14,7 @@ claims, and is **NOT SELF-ADJUDICATED**.
 | H | Supply-Chain & Release Integrity | PASS | Consequential Actions are immutable-SHA pinned; PR dependency review, advisory scanning, and SBOM generation run in CI. No package/release artifact is published, so artifact digest, provenance, and attestation are not applicable to the current source-only state and are not claimed. |
 | I | Security & Vulnerability Management | NOT ESTABLISHED | `SECURITY.md` states supported scope, triage expectations, scanner limits, and that a verified private disclosure route is not established. Dependency review and `pip-audit` provide bounded dependency evidence; a scanner result is not represented as an audit. |
 | J | API & Versioning Integrity | PASS | `VERSIONING.md` declares the pre-1.0 Python API/import, CLI, exit, reason-code, artifact, receipt, and compatibility surfaces. |
-| K | Machine-Readable Discovery & Licensing | NOT ESTABLISHED | `pyproject.toml` provides truthful package metadata, but the repository grants no license and declares no SPDX license identity. No grant is invented. |
+| K | Machine-Readable Discovery & Licensing | PASS | `pyproject.toml` identifies the root `LICENSE`, which contains the PolyForm Noncommercial License 1.0.0. Commercial use requires a separate written license from Veraxis. No conflicting SPDX grant is declared. |
 | L | Public Falsification Completeness | PASS | `make falsify` publicly exercises one valid decision and three meaningful refusal/tamper paths: unclassified action, stale fact, and receipt mismatch (4/4). |
 | M | Agent Interaction Observability | NOT ESTABLISHED | `docs/AGENT-OBSERVABILITY.md` truthfully documents GitHub-attributable versus dark local activity and the no-hidden-telemetry/no-network boundary. No approved ingestion pipeline, hosted gateway, or MCP observability implementation is established. |
 

pyproject.toml

@@ -5,21 +5,9 @@ description = "AuthContract reference implementation — canonical digest and ru
 requires-python = ">=3.10"
 dependencies = ["rfc8785>=0.1.2,<0.2"]
 
-# Machine-readable licensing state (AC-039).
-#
-# This project has NO license grant. Default copyright applies and no usage,
-# redistribution, or derivative rights are conferred. The Trove classifier below
-# is the ecosystem-standard machine-readable way to say exactly that: it marks
-# the project as proprietary — i.e. NOT open source — without inventing rights
-# that the owner has not granted.
-#
-# Deliberately NOT declared: any SPDX identifier (MIT/Apache-2.0/BSD/etc.).
-# Using one would be false. A PEP 639 `license = "LicenseRef-..."` expression
-# would also require an accompanying license text file, which only the owner can
-# author. Selecting an actual license remains an open owner decision — see
-# docs/VERSIONING.md and README.md.
+license = "PolyForm-Noncommercial-1.0.0"
+license-files = ["LICENSE"]
 classifiers = [
-    "License :: Other/Proprietary License",
     "Development Status :: 2 - Pre-Alpha",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.12",
@@ -35,7 +23,7 @@ test = ["pytest>=7.0,<10"]
 include = ["authcontract*"]
 
 [build-system]
-requires = ["setuptools>=61"]
+requires = ["setuptools>=77.0.3"]
 build-backend = "setuptools.build_meta"
 
 [tool.pytest.ini_options]

tests/test_license_metadata.py

@@ -0,0 +1,21 @@
+from pathlib import Path
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # pragma: no cover - exercised by the Python 3.10 CI matrix
+    import tomli as tomllib
+
+
+ROOT = Path(__file__).parents[1]
+
+
+def test_polyform_noncommercial_metadata_is_exact() -> None:
+    pyproject = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
+    project = pyproject["project"]
+    assert project["license"] == "PolyForm-Noncommercial-1.0.0"
+    assert project["license-files"] == ["LICENSE"]
+    assert pyproject["build-system"]["requires"] == ["setuptools>=77.0.3"]
+
+    license_text = (ROOT / "LICENSE").read_text(encoding="utf-8")
+    assert license_text.startswith("# PolyForm Noncommercial License 1.0.0\n")
+    assert "https://polyformproject.org/licenses/noncommercial/1.0.0" in license_text