From be15d1f9189b95d49f82f2bc8b6c17e2de76f8f8 Mon Sep 17 00:00:00 2001 From: Divine Date: Mon, 13 Apr 2026 13:59:59 -0400 Subject: [PATCH 1/3] chore: add SPDX-License-Identifier to all Go source files Every .go file in cmd/ and internal/ (77 files) now carries // SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 as its first line, per the PolyForm relicense (PR #21). CI contamination gate extended with an SPDX header check so new Go files without the header fail the gate. Mirrored in scripts/gates.sh for gate parity. --- .github/workflows/ci.yml | 10 ++++++++++ CHANGELOG.md | 5 +++++ cmd/awrit/apps.go | 2 ++ cmd/awrit/audit.go | 2 ++ cmd/awrit/client.go | 2 ++ cmd/awrit/init_cmd.go | 2 ++ cmd/awrit/init_cmd_test.go | 2 ++ cmd/awrit/main.go | 2 ++ cmd/awrit/output.go | 2 ++ cmd/awrit/revoke.go | 2 ++ cmd/awrit/root.go | 2 ++ cmd/awrit/token.go | 2 ++ cmd/broker/main.go | 2 ++ cmd/broker/serve.go | 2 ++ cmd/broker/serve_test.go | 2 ++ internal/admin/admin_hdl.go | 2 ++ internal/admin/admin_hdl_test.go | 2 ++ internal/admin/admin_svc.go | 2 ++ internal/admin/admin_svc_test.go | 2 ++ internal/app/app_hdl.go | 2 ++ internal/app/app_hdl_test.go | 2 ++ internal/app/app_svc.go | 2 ++ internal/app/app_svc_test.go | 2 ++ internal/audit/audit_log.go | 2 ++ internal/audit/audit_log_test.go | 2 ++ internal/authz/rate_mw.go | 2 ++ internal/authz/rate_mw_test.go | 2 ++ internal/authz/scope.go | 2 ++ internal/authz/scope_test.go | 2 ++ internal/authz/val_mw.go | 2 ++ internal/authz/val_mw_test.go | 2 ++ internal/cfg/cfg.go | 2 ++ internal/cfg/cfg_test.go | 2 ++ internal/cfg/configfile.go | 2 ++ internal/cfg/configfile_test.go | 2 ++ internal/deleg/deleg_svc.go | 2 ++ internal/deleg/deleg_svc_test.go | 2 ++ internal/handler/audit_hdl.go | 2 ++ internal/handler/challenge_hdl.go | 2 ++ internal/handler/deleg_hdl.go | 2 ++ internal/handler/doc.go | 2 ++ internal/handler/handler_test.go | 2 ++ internal/handler/health_hdl.go | 2 ++ internal/handler/logging.go | 2 ++ internal/handler/logging_test.go | 2 ++ internal/handler/metrics_hdl.go | 2 ++ internal/handler/reg_hdl.go | 2 ++ internal/handler/release_hdl.go | 2 ++ internal/handler/release_hdl_test.go | 2 ++ internal/handler/renew_hdl.go | 2 ++ internal/handler/request_id_test.go | 2 ++ internal/handler/revoke_hdl.go | 2 ++ internal/handler/security_hdl.go | 2 ++ internal/handler/security_hdl_test.go | 2 ++ internal/handler/val_hdl.go | 2 ++ internal/identity/id_svc.go | 2 ++ internal/identity/id_svc_test.go | 2 ++ internal/identity/spiffe.go | 2 ++ internal/keystore/keystore.go | 2 ++ internal/keystore/keystore_test.go | 2 ++ internal/mutauth/discovery.go | 2 ++ internal/mutauth/discovery_test.go | 2 ++ internal/mutauth/heartbeat.go | 2 ++ internal/mutauth/heartbeat_test.go | 2 ++ internal/mutauth/mut_auth_hdl.go | 2 ++ internal/mutauth/mut_auth_hdl_test.go | 2 ++ internal/obs/obs.go | 2 ++ internal/problemdetails/problemdetails.go | 2 ++ internal/revoke/rev_svc.go | 2 ++ internal/revoke/rev_svc_test.go | 2 ++ internal/store/jti_test.go | 2 ++ internal/store/sql_store.go | 2 ++ internal/store/sql_store_app_test.go | 2 ++ internal/store/sql_store_revoke_test.go | 2 ++ internal/store/sql_store_test.go | 2 ++ internal/token/revoker.go | 2 ++ internal/token/tkn_claims.go | 2 ++ internal/token/tkn_svc.go | 2 ++ internal/token/tkn_svc_test.go | 2 ++ scripts/gates.sh | 2 +- 80 files changed, 170 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e271f8d..4f6a2de 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -120,6 +120,16 @@ jobs: exit 1 fi echo "PASS: no stale brand strings" + - name: SPDX header check + run: | + MISSING=$(find cmd/ internal/ -name '*.go' -exec sh -c \ + 'head -1 "$1" | grep -qF "SPDX-License-Identifier:" || echo "$1"' _ {} \;) + if [ -n "$MISSING" ]; then + echo "FAIL: Go files missing SPDX-License-Identifier header:" + echo "$MISSING" + exit 1 + fi + echo "PASS: all Go files have SPDX headers" unit-tests: name: unit-tests diff --git a/CHANGELOG.md b/CHANGELOG.md index 856de05..46e9fd4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added — SPDX headers on all Go source files (2026-04-13) + +- Every `.go` file in `cmd/` and `internal/` (77 files) now carries `// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0` as the first line. +- CI `contamination` gate extended with an SPDX header check — new Go files without the header will fail the gate. + ### Changed — License: AGPL-3.0 → PolyForm Internal Use 1.0.0 (2026-04-13) - **`LICENSE`** — replaced AGPL-3.0 text with PolyForm Internal Use License 1.0.0 (source-available, permanent, no sunset). SPDX identifier: `PolyForm-Internal-Use-1.0.0`. Dual-license header added for commercial-use contact path. diff --git a/cmd/awrit/apps.go b/cmd/awrit/apps.go index ea79ca8..2791f95 100644 --- a/cmd/awrit/apps.go +++ b/cmd/awrit/apps.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package main — awrit app subcommands for managing registered apps. // // Commands: diff --git a/cmd/awrit/audit.go b/cmd/awrit/audit.go index 0687276..7a9b55d 100644 --- a/cmd/awrit/audit.go +++ b/cmd/awrit/audit.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // audit.go implements the awrit audit command group. package main diff --git a/cmd/awrit/client.go b/cmd/awrit/client.go index 16207e5..2c8725e 100644 --- a/cmd/awrit/client.go +++ b/cmd/awrit/client.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package main import ( diff --git a/cmd/awrit/init_cmd.go b/cmd/awrit/init_cmd.go index f001756..32466c3 100644 --- a/cmd/awrit/init_cmd.go +++ b/cmd/awrit/init_cmd.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package main import ( diff --git a/cmd/awrit/init_cmd_test.go b/cmd/awrit/init_cmd_test.go index bb4833f..cbbe5f7 100644 --- a/cmd/awrit/init_cmd_test.go +++ b/cmd/awrit/init_cmd_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package main import ( diff --git a/cmd/awrit/main.go b/cmd/awrit/main.go index b55c22d..7596964 100644 --- a/cmd/awrit/main.go +++ b/cmd/awrit/main.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Command awrit is the operator CLI for the AgentAuth broker. package main diff --git a/cmd/awrit/output.go b/cmd/awrit/output.go index be333d5..e1a857d 100644 --- a/cmd/awrit/output.go +++ b/cmd/awrit/output.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package main import ( diff --git a/cmd/awrit/revoke.go b/cmd/awrit/revoke.go index 617e0a9..f75998e 100644 --- a/cmd/awrit/revoke.go +++ b/cmd/awrit/revoke.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Command awrit revoke subcommand — revokes tokens at various granularity levels. package main diff --git a/cmd/awrit/root.go b/cmd/awrit/root.go index 2c07209..a93db10 100644 --- a/cmd/awrit/root.go +++ b/cmd/awrit/root.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package main import ( diff --git a/cmd/awrit/token.go b/cmd/awrit/token.go index 628807f..c498db3 100644 --- a/cmd/awrit/token.go +++ b/cmd/awrit/token.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Command awrit token subcommand — token operations including release. package main diff --git a/cmd/broker/main.go b/cmd/broker/main.go index d908d74..71d188c 100644 --- a/cmd/broker/main.go +++ b/cmd/broker/main.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Command broker starts the AgentAuth broker HTTP server. // // It wires all internal services together, registers routes on an diff --git a/cmd/broker/serve.go b/cmd/broker/serve.go index 98a7b20..b638ef3 100644 --- a/cmd/broker/serve.go +++ b/cmd/broker/serve.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package main import ( diff --git a/cmd/broker/serve_test.go b/cmd/broker/serve_test.go index 593aba3..06ed51b 100644 --- a/cmd/broker/serve_test.go +++ b/cmd/broker/serve_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package main import ( diff --git a/internal/admin/admin_hdl.go b/internal/admin/admin_hdl.go index 21131f6..d5bb57c 100644 --- a/internal/admin/admin_hdl.go +++ b/internal/admin/admin_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package admin import ( diff --git a/internal/admin/admin_hdl_test.go b/internal/admin/admin_hdl_test.go index 0c7a114..b816683 100644 --- a/internal/admin/admin_hdl_test.go +++ b/internal/admin/admin_hdl_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package admin import ( diff --git a/internal/admin/admin_svc.go b/internal/admin/admin_svc.go index ded3e52..2ee3379 100644 --- a/internal/admin/admin_svc.go +++ b/internal/admin/admin_svc.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package admin handles the operator side of the broker — authenticating // with the admin secret and managing launch tokens. The operator is the // human or automation that bootstraps the system: they register apps, diff --git a/internal/admin/admin_svc_test.go b/internal/admin/admin_svc_test.go index 228c42b..f79c50b 100644 --- a/internal/admin/admin_svc_test.go +++ b/internal/admin/admin_svc_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package admin import ( diff --git a/internal/app/app_hdl.go b/internal/app/app_hdl.go index b8b341e..aff2433 100644 --- a/internal/app/app_hdl.go +++ b/internal/app/app_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package app — HTTP handlers for app CRUD (admin-operated) and app // authentication (self-service). The /v1/admin/apps/* routes are for the // operator managing apps; /v1/app/auth is how the app itself logs in. diff --git a/internal/app/app_hdl_test.go b/internal/app/app_hdl_test.go index 5bc2052..0f64efb 100644 --- a/internal/app/app_hdl_test.go +++ b/internal/app/app_hdl_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package app import ( diff --git a/internal/app/app_svc.go b/internal/app/app_svc.go index 654f0ac..e3c2333 100644 --- a/internal/app/app_svc.go +++ b/internal/app/app_svc.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package app manages the app credential lifecycle. Apps are software that // manage agents — an orchestrator, a CI pipeline, a SaaS backend. Admin // registers the app, giving it a scope ceiling (the maximum permissions it diff --git a/internal/app/app_svc_test.go b/internal/app/app_svc_test.go index 58eaa97..8e66b32 100644 --- a/internal/app/app_svc_test.go +++ b/internal/app/app_svc_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package app import ( diff --git a/internal/audit/audit_log.go b/internal/audit/audit_log.go index 21ea785..640a57e 100644 --- a/internal/audit/audit_log.go +++ b/internal/audit/audit_log.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package audit provides a tamper-evident, hash-chain audit trail with // automatic PII sanitization. // diff --git a/internal/audit/audit_log_test.go b/internal/audit/audit_log_test.go index 02e1b4f..3e7cccf 100644 --- a/internal/audit/audit_log_test.go +++ b/internal/audit/audit_log_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package audit import ( diff --git a/internal/authz/rate_mw.go b/internal/authz/rate_mw.go index 2c238c0..234a336 100644 --- a/internal/authz/rate_mw.go +++ b/internal/authz/rate_mw.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // rate_mw.go — per-key token-bucket rate limiter. Protects admin auth // (per-IP) and app auth (per-client_id) against brute force and credential // stuffing. diff --git a/internal/authz/rate_mw_test.go b/internal/authz/rate_mw_test.go index 83da4cb..0b3837a 100644 --- a/internal/authz/rate_mw_test.go +++ b/internal/authz/rate_mw_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package authz import ( diff --git a/internal/authz/scope.go b/internal/authz/scope.go index e35b02c..1c5471e 100644 --- a/internal/authz/scope.go +++ b/internal/authz/scope.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package authz provides scope-based authorization and Bearer token // validation middleware for the AgentAuth broker. // diff --git a/internal/authz/scope_test.go b/internal/authz/scope_test.go index a9d6882..485d286 100644 --- a/internal/authz/scope_test.go +++ b/internal/authz/scope_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package authz import ( diff --git a/internal/authz/val_mw.go b/internal/authz/val_mw.go index ed90d4c..76cebe3 100644 --- a/internal/authz/val_mw.go +++ b/internal/authz/val_mw.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package authz import ( diff --git a/internal/authz/val_mw_test.go b/internal/authz/val_mw_test.go index f5f8627..2491cd7 100644 --- a/internal/authz/val_mw_test.go +++ b/internal/authz/val_mw_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package authz import ( diff --git a/internal/cfg/cfg.go b/internal/cfg/cfg.go index 0edd342..fb72db1 100644 --- a/internal/cfg/cfg.go +++ b/internal/cfg/cfg.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package cfg loads broker configuration from AA_* environment variables. // // All configuration keys are prefixed with AA_ to avoid collisions. diff --git a/internal/cfg/cfg_test.go b/internal/cfg/cfg_test.go index 604ee9d..d7ff168 100644 --- a/internal/cfg/cfg_test.go +++ b/internal/cfg/cfg_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package cfg import ( diff --git a/internal/cfg/configfile.go b/internal/cfg/configfile.go index 30316ce..792532a 100644 --- a/internal/cfg/configfile.go +++ b/internal/cfg/configfile.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package cfg import ( diff --git a/internal/cfg/configfile_test.go b/internal/cfg/configfile_test.go index e8dfe39..8902b97 100644 --- a/internal/cfg/configfile_test.go +++ b/internal/cfg/configfile_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package cfg import ( diff --git a/internal/deleg/deleg_svc.go b/internal/deleg/deleg_svc.go index 75b6762..bedde3f 100644 --- a/internal/deleg/deleg_svc.go +++ b/internal/deleg/deleg_svc.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package deleg provides scope-attenuated token delegation with chain // verification and depth limiting. // diff --git a/internal/deleg/deleg_svc_test.go b/internal/deleg/deleg_svc_test.go index 93248fa..b1dc2f9 100644 --- a/internal/deleg/deleg_svc_test.go +++ b/internal/deleg/deleg_svc_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package deleg import ( diff --git a/internal/handler/audit_hdl.go b/internal/handler/audit_hdl.go index 9fd34f3..1837c42 100644 --- a/internal/handler/audit_hdl.go +++ b/internal/handler/audit_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/challenge_hdl.go b/internal/handler/challenge_hdl.go index ad03689..55b4cf5 100644 --- a/internal/handler/challenge_hdl.go +++ b/internal/handler/challenge_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/deleg_hdl.go b/internal/handler/deleg_hdl.go index 176d0e2..d4a037b 100644 --- a/internal/handler/deleg_hdl.go +++ b/internal/handler/deleg_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/doc.go b/internal/handler/doc.go index 827804c..efe7c1f 100644 --- a/internal/handler/doc.go +++ b/internal/handler/doc.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package handler provides the HTTP layer for the broker. Handlers are thin — // they parse requests, call a domain service, and format responses. All // business logic lives in the service packages (token, admin, app, identity, diff --git a/internal/handler/handler_test.go b/internal/handler/handler_test.go index 0276195..6fd3166 100644 --- a/internal/handler/handler_test.go +++ b/internal/handler/handler_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler_test import ( diff --git a/internal/handler/health_hdl.go b/internal/handler/health_hdl.go index c10e2bf..122038c 100644 --- a/internal/handler/health_hdl.go +++ b/internal/handler/health_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/logging.go b/internal/handler/logging.go index 9464c14..529a65d 100644 --- a/internal/handler/logging.go +++ b/internal/handler/logging.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/logging_test.go b/internal/handler/logging_test.go index d82f0e9..014441a 100644 --- a/internal/handler/logging_test.go +++ b/internal/handler/logging_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/metrics_hdl.go b/internal/handler/metrics_hdl.go index b51aa73..4e8716c 100644 --- a/internal/handler/metrics_hdl.go +++ b/internal/handler/metrics_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/reg_hdl.go b/internal/handler/reg_hdl.go index ddb9cc7..58be817 100644 --- a/internal/handler/reg_hdl.go +++ b/internal/handler/reg_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/release_hdl.go b/internal/handler/release_hdl.go index 902a323..d80fd7a 100644 --- a/internal/handler/release_hdl.go +++ b/internal/handler/release_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/release_hdl_test.go b/internal/handler/release_hdl_test.go index c9dac7c..5ead3b0 100644 --- a/internal/handler/release_hdl_test.go +++ b/internal/handler/release_hdl_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/renew_hdl.go b/internal/handler/renew_hdl.go index 1d52aea..8367cdb 100644 --- a/internal/handler/renew_hdl.go +++ b/internal/handler/renew_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/request_id_test.go b/internal/handler/request_id_test.go index d96e412..c140a62 100644 --- a/internal/handler/request_id_test.go +++ b/internal/handler/request_id_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/revoke_hdl.go b/internal/handler/revoke_hdl.go index 48ab0e5..6d5268c 100644 --- a/internal/handler/revoke_hdl.go +++ b/internal/handler/revoke_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/security_hdl.go b/internal/handler/security_hdl.go index e40c257..e208b45 100644 --- a/internal/handler/security_hdl.go +++ b/internal/handler/security_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import "net/http" diff --git a/internal/handler/security_hdl_test.go b/internal/handler/security_hdl_test.go index c47dc54..6bde821 100644 --- a/internal/handler/security_hdl_test.go +++ b/internal/handler/security_hdl_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/handler/val_hdl.go b/internal/handler/val_hdl.go index 2a558d6..16ee881 100644 --- a/internal/handler/val_hdl.go +++ b/internal/handler/val_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package handler import ( diff --git a/internal/identity/id_svc.go b/internal/identity/id_svc.go index e86e41d..b5fd9d0 100644 --- a/internal/identity/id_svc.go +++ b/internal/identity/id_svc.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package identity implements the agent registration flow including // challenge-response verification, SPIFFE ID generation, Ed25519 key // management, and scope enforcement. diff --git a/internal/identity/id_svc_test.go b/internal/identity/id_svc_test.go index bcab9cb..ae193dd 100644 --- a/internal/identity/id_svc_test.go +++ b/internal/identity/id_svc_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package identity import ( diff --git a/internal/identity/spiffe.go b/internal/identity/spiffe.go index 9982279..ef1ba2e 100644 --- a/internal/identity/spiffe.go +++ b/internal/identity/spiffe.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package identity import ( diff --git a/internal/keystore/keystore.go b/internal/keystore/keystore.go index 59f97d4..22df91e 100644 --- a/internal/keystore/keystore.go +++ b/internal/keystore/keystore.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package keystore loads or generates an Ed25519 signing key pair, // persisting it to disk in PEM-encoded PKCS8 format. package keystore diff --git a/internal/keystore/keystore_test.go b/internal/keystore/keystore_test.go index 7253134..dc0fa57 100644 --- a/internal/keystore/keystore_test.go +++ b/internal/keystore/keystore_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package keystore import ( diff --git a/internal/mutauth/discovery.go b/internal/mutauth/discovery.go index 5345afa..c528616 100644 --- a/internal/mutauth/discovery.go +++ b/internal/mutauth/discovery.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package mutauth import ( diff --git a/internal/mutauth/discovery_test.go b/internal/mutauth/discovery_test.go index 7dd0024..21ebc54 100644 --- a/internal/mutauth/discovery_test.go +++ b/internal/mutauth/discovery_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package mutauth import ( diff --git a/internal/mutauth/heartbeat.go b/internal/mutauth/heartbeat.go index 8c5775d..14b0719 100644 --- a/internal/mutauth/heartbeat.go +++ b/internal/mutauth/heartbeat.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package mutauth import ( diff --git a/internal/mutauth/heartbeat_test.go b/internal/mutauth/heartbeat_test.go index db208d5..7d64043 100644 --- a/internal/mutauth/heartbeat_test.go +++ b/internal/mutauth/heartbeat_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package mutauth import ( diff --git a/internal/mutauth/mut_auth_hdl.go b/internal/mutauth/mut_auth_hdl.go index a0329da..ef331c6 100644 --- a/internal/mutauth/mut_auth_hdl.go +++ b/internal/mutauth/mut_auth_hdl.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package mutauth provides agent-to-agent mutual authentication using a // three-step cryptographic handshake protocol. // diff --git a/internal/mutauth/mut_auth_hdl_test.go b/internal/mutauth/mut_auth_hdl_test.go index ec37557..308c9f9 100644 --- a/internal/mutauth/mut_auth_hdl_test.go +++ b/internal/mutauth/mut_auth_hdl_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package mutauth import ( diff --git a/internal/obs/obs.go b/internal/obs/obs.go index 7b24836..a71619c 100644 --- a/internal/obs/obs.go +++ b/internal/obs/obs.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package obs provides structured logging and Prometheus metrics for the // AgentAuth broker. // diff --git a/internal/problemdetails/problemdetails.go b/internal/problemdetails/problemdetails.go index bcb865e..8184041 100644 --- a/internal/problemdetails/problemdetails.go +++ b/internal/problemdetails/problemdetails.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package problemdetails implements RFC 7807 "application/problem+json" // error responses and HTTP request infrastructure for the AgentWrit broker. // diff --git a/internal/revoke/rev_svc.go b/internal/revoke/rev_svc.go index d3ea796..33fa287 100644 --- a/internal/revoke/rev_svc.go +++ b/internal/revoke/rev_svc.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package revoke provides four-level token revocation for the AgentAuth // broker. // diff --git a/internal/revoke/rev_svc_test.go b/internal/revoke/rev_svc_test.go index 7f3ab5c..0b7ee6c 100644 --- a/internal/revoke/rev_svc_test.go +++ b/internal/revoke/rev_svc_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package revoke import ( diff --git a/internal/store/jti_test.go b/internal/store/jti_test.go index 1611e54..aad4d08 100644 --- a/internal/store/jti_test.go +++ b/internal/store/jti_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package store import ( diff --git a/internal/store/sql_store.go b/internal/store/sql_store.go index f3eac8c..1977ce3 100644 --- a/internal/store/sql_store.go +++ b/internal/store/sql_store.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package store is the single persistence layer for the broker. It holds // everything: nonces (challenge-response), launch tokens (agent bootstrapping), // agent records, app records, audit events, and revocations. diff --git a/internal/store/sql_store_app_test.go b/internal/store/sql_store_app_test.go index 884a958..726d44a 100644 --- a/internal/store/sql_store_app_test.go +++ b/internal/store/sql_store_app_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package store import ( diff --git a/internal/store/sql_store_revoke_test.go b/internal/store/sql_store_revoke_test.go index b9acab6..6fa8ce6 100644 --- a/internal/store/sql_store_revoke_test.go +++ b/internal/store/sql_store_revoke_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package store import ( diff --git a/internal/store/sql_store_test.go b/internal/store/sql_store_test.go index 2fcc8ab..74f7cae 100644 --- a/internal/store/sql_store_test.go +++ b/internal/store/sql_store_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package store import ( diff --git a/internal/token/revoker.go b/internal/token/revoker.go index c03f74a..3880707 100644 --- a/internal/token/revoker.go +++ b/internal/token/revoker.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package token // Revoker allows TknSvc to revoke and check revocation without importing the revoke package. diff --git a/internal/token/tkn_claims.go b/internal/token/tkn_claims.go index 377137b..f5c1191 100644 --- a/internal/token/tkn_claims.go +++ b/internal/token/tkn_claims.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + // Package token implements EdDSA (Ed25519) JWT token issuance, verification, // and renewal for the AgentAuth broker. // diff --git a/internal/token/tkn_svc.go b/internal/token/tkn_svc.go index 0436c8e..8416f78 100644 --- a/internal/token/tkn_svc.go +++ b/internal/token/tkn_svc.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package token import ( diff --git a/internal/token/tkn_svc_test.go b/internal/token/tkn_svc_test.go index d003627..c9365d3 100644 --- a/internal/token/tkn_svc_test.go +++ b/internal/token/tkn_svc_test.go @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 + package token import ( diff --git a/scripts/gates.sh b/scripts/gates.sh index e36de79..1189951 100755 --- a/scripts/gates.sh +++ b/scripts/gates.sh @@ -115,7 +115,7 @@ run_gate "format" bash -c 'test -z "$(gofmt -l .)"' # Brand alignment portion catches the gap that let obs.go metric names and # problemdetails.go URN namespace survive the first rebrand pass # (TD-RUNTIME-001 / TD-OBS-001). -run_gate "contamination" bash -c "! grep -ri 'hitl\|approval\|oidc\|federation\|cloud\|sidecar' internal/ cmd/ 2>/dev/null && ! grep -rn 'urn:agentauth\|agentauth_\|github\.com/devonartis/agentauth[^-]' internal/ cmd/ --include='*.go' 2>/dev/null" +run_gate "contamination" bash -c "! grep -ri 'hitl\|approval\|oidc\|federation\|cloud\|sidecar' internal/ cmd/ 2>/dev/null && ! grep -rn 'urn:agentauth\|agentauth_\|github\.com/devonartis/agentauth[^-]' internal/ cmd/ --include='*.go' 2>/dev/null && ! find cmd/ internal/ -name '*.go' -exec sh -c 'head -1 \"\$1\" | grep -qF SPDX-License-Identifier: || echo \"\$1\"' _ {} \; | grep ." run_gate "unit-tests" go test -short -count=1 ./... From 6b158c921c360a68ff61480d41649dc6072fbfb3 Mon Sep 17 00:00:00 2001 From: Divine Date: Mon, 13 Apr 2026 14:02:38 -0400 Subject: [PATCH 2/3] docs: drop 'open-source' label, add 'free for internal use' PolyForm Internal Use is source-available, not OSI-approved open-source. Updated docs/README.md and docs/python-sdk.md to match the new repo description. --- docs/README.md | 2 +- docs/python-sdk.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/README.md b/docs/README.md index 6e69371..f016651 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,6 +1,6 @@ # AgentWrit Documentation -AgentWrit is an open-source credential broker for AI agents. It issues short-lived, scope-attenuated tokens so agents operate with only the permissions their task requires — nothing more, nothing longer. +AgentWrit is a credential broker for AI agents. It issues short-lived, scope-attenuated tokens so agents operate with only the permissions their task requires — nothing more, nothing longer. Free for internal use. --- diff --git a/docs/python-sdk.md b/docs/python-sdk.md index 45989a6..d0533be 100644 --- a/docs/python-sdk.md +++ b/docs/python-sdk.md @@ -1,6 +1,6 @@ # AgentWrit Python SDK -> **Coming soon to public.** The Python SDK is complete and will be published as an open-source repo at [`devonartis/agentwrit-python`](https://github.com/devonartis/agentwrit-python) after final cleanup. +> **Coming soon to public.** The Python SDK is complete and will be published at [`devonartis/agentwrit-python`](https://github.com/devonartis/agentwrit-python) after final cleanup. ## What it does From e027de66a2d37f5995092fe1cb223006007d6099 Mon Sep 17 00:00:00 2001 From: Divine Date: Mon, 13 Apr 2026 14:08:01 -0400 Subject: [PATCH 3/3] =?UTF-8?q?ci:=20trigger=20CI=20after=20base=20branch?= =?UTF-8?q?=20fix=20(main=20=E2=86=92=20develop)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit