License → AGPL-3.0 tri-license + version single-source-of-truth (0.9.0) (#62)

* chore(license,version): reconcile to AGPL-3.0 tri-license + version SSOT 0.9.0

Resolves the license conflict (source MPL-2.0 vs panels/META AGPL-3.0) per
maintainer decision, and unifies the software version behind one source.

License — tri-license by artifact class (docs/legal/LICENSE-POLICY.adoc):
- code (.zig/.idr/.eph/.js/.html/.sh/.affine) -> AGPL-3.0-or-later
  (79 files re-stamped; panels already AGPL)
- machine-readable + estate config (.a2ml/.contractile/.ncl/Containerfile/
  .just/.toml/.gitattributes/.well-known) -> MPL-2.0 (carve-out, 188 files kept)
- docs (.adoc/.md) -> CC-BY-SA-4.0
- LICENSE file body replaced with the canonical GNU AGPL-3.0 text
- run.js + META.a2ml license fields updated; META 'unsettled' note removed

Version SSOT -> 0.9.0:
- canonical = main.zig VERSION; reconciled BUILD_INFO, build.zig .version x2,
  run.js, panels/manifest.json + all panel.json
- scripts/check_version_drift.sh asserts every software-version string equals
  main.zig VERSION; wired into the abi-contract CI job
- version-string tests assert against main.VERSION (drift-proof)

Regenerated ABI expected-tables so their emitted SPDX headers match. 162 tests
green; drift check + ABI regen-diff pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

* fix(license): add SPDX header to LICENSE for governance consistency check

standards/check-licence-consistency.sh requires the LICENSE file to carry an
SPDX-License-Identifier header or match a known verbatim template; the canonical
gnu.org AGPL-3.0 text (with its 'How to Apply' appendix) isn't recognised as a
template, so prepend the SPDX line as the check's error message endorses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/abi-contract.yml

@@ -52,6 +52,9 @@ jobs:
         working-directory: src/interface/ffi
         run: zig build
 
+      - name: Version drift check (software version == main.zig VERSION)
+        run: bash scripts/check_version_drift.sh
+
   idris-typecheck:
     name: Idris2 model type-checks
     runs-on: ubuntu-latest

.machine_readable/6a2/META.a2ml

@@ -11,12 +11,10 @@ last-updated = "2026-03-22"
 [project-info]
 type = "library"  # libgsa.so is the primary artifact (+ the gsa CLI binary)
 languages = ["zig", "idris2", "ephapax"]
-# NOTE: license is unsettled and pending a maintainer decision. The LICENSE
-# file body and all Zig/Idris source SPDX headers are currently MPL-2.0, while
-# the panel descriptors declare AGPL-3.0-or-later and this field says AGPL —
-# a genuine conflict. See the human checklist / docs/legal (to be added once
-# the direction is chosen). Left as-is deliberately; do not mass-edit headers
-# without that decision.
+# Tri-license policy (see docs/legal/LICENSE-POLICY.adoc):
+#   code (.zig/.idr/.eph/.js) = AGPL-3.0-or-later
+#   machine-readable (.a2ml/.contractile/.ncl) = MPL-2.0 (carve-out)
+#   docs (.adoc/.md) = CC-BY-SA-4.0
 license = "AGPL-3.0-or-later"
 author = "Jonathan D.A. Jewell (hyperpolymath)"
 

.machine_readable/scripts/forge/forge-sync.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # forge-sync.sh — Multi-forge mirroring script
 #

.machine_readable/scripts/lifecycle/install-tools.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # install-tools.sh — Developer toolchain installer
 #

.machine_readable/scripts/maintenance/maint-assault.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # maint-assault.sh — High-rigor stress testing using panic-attacker
 #

LICENSE

@@ -1,5 +1,5 @@
 #!/bin/sh
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # CryoFall dedicated server entrypoint — managed by Game Server Admin (GSA)

container/cryofall/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # CryoFall world backup script

container/cryofall/scripts/backup.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # game-server-admin — Cerro Torre build, sign, and verify pipeline
 #

container/ct-build.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # game-server-admin container entrypoint
 #
 # Handles signal propagation, startup logging, and health check