legal: SRSL-1.1 stronger non-commercial boundaries and enforceable commercial terms

[SWORDIntel]

Scope

Publish SRSL-1.1 for KEYSTONE as a prospective, versioned source-available licence, preserving the unmodified SRSL-1.0 text for previously distributed copies.

Changes

• Exhaustive permitted non-commercial uses; for-profit internal operation, evaluation, research and cost savings expressly out of scope.
• Licence notice and acceptance-by-conduct clarification without an account system, DRM, or first-run execution gate.
• Reserved ML training / fine-tuning / model evaluation rights with mandatory statutory exceptions and no overclaim to model outputs.
• Conditional technical protection clause, without representing that a TPM currently exists.
• Clarified termination, foreign IP jurisdiction, and statutory remedies.
• Explicit rejection of automatic 50% royalties on unauthorised users. The 50% remains an opening proposal for separately executed commercial agreements.
• Update existing SRSL notices in first-party source, documentation, tests and Python metadata. Correct one inconsistent v3.0/1.0 notice and one duplicate Python setup.py licence entry.
• Provide LICENSES/LicenseRef-SRSL-1.1.txt to resolve SPDX LicenseRef declarations, and archive original 1.0 at LICENSES/SRSL-1.0.txt.

Validation

• Verified updated root LICENSE contains all new clauses.
• Verified archived SRSL-1.0 begins with the original v1.0 text.
• Verified SPDX LicenseRef-SRSL-1.1 content byte-equals root LICENSE.
• Verified Python setup.py contains one SRSL licence field and v3.0 contradictory source header was corrected.
• Compared PR branch against main: only text, comments and packaging licence metadata changed; no runtime/build logic altered.
• Existing PR CI workflow should run on this PR; CI not claimed as passed until it completes.

Legal review required before merging

• Confirm copyright holder chain of title and all third-party licences.
• Confirm intended eligibility of funded academic, charitable and bounty-research cases.
• UK counsel: contractual formation, §29A exceptions, enforcement/remedies and penalty rule.
• For US filings: verify work-specific publication dates, eligibility and 17 USC §§411–412 timing. Do not promise US statutory damages or DMCA coverage automatically.
• Future TPM/entitlement functionality requires a separate implementation and effective-control analysis.

No retroactive revocation and no changes to application execution.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T01:48:39.532946Z	2530198	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.