sumerjohal · Aug 27, 2026 · Aug 27, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -3,6 +3,13 @@ name: AR2 CI
 on: [push, pull_request]
 
 jobs:
+  license:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: License posture (canonical EUPL-1.2 + SPDX headers)
+      run: bash scripts/license_check.sh
+
   lint:
     runs-on: ubuntu-latest
     steps:

diff --git a/.stomata/lessons.json b/.stomata/lessons.json
@@ -105,6 +105,20 @@
         {"date": "2026-08-14", "what": "The same document predicted that a check which becomes noise 'gets waived, then gets deleted'. Two checks became noise and were ignored for days by the author who wrote that sentence.", "where": "workplan/2026-08/rajat_ar2_closeout_20260814.md:418"}
       ]
     },
+    {
+      "recurrence_key": "license-posture-unchecked",
+      "trigger": "You are adding, editing or citing a LICENSE file, a license declaration in prose, or a per-file license header.",
+      "directive": "Pin the license file to the canonical text by hash and check every source file for its header in CI. A license is a control that binds outsiders, and it fails silently: a truncated file or a prose-only declaration looks licensed to everyone who does not read it end to end.",
+      "kind": "mechanized",
+      "enforced_by": [
+        "scripts/license_check.sh",
+        ".github/workflows/ci.yml"
+      ],
+      "occurrences": [
+        {"date": "2026-08-26", "what": "LICENSE in ar2 and ar2-hub was the first 134 lines of MPL-2.0, cut mid-sentence in section 2.4 -- the copyleft core and exhibits were absent, and GitHub reported NOASSERTION. Nothing had ever checked it.", "where": "workplan/2026-08/core_license_posture_20260826.md"},
+        {"date": "2026-08-26", "what": "pancake had no LICENSE file at all while GOVERNANCE.md line 5 declared Apache 2.0 in prose, a permissive license contradicting the copyleft intent.", "where": "workplan/2026-08/core_license_posture_20260826.md"}
+      ]
+    },
     {
       "recurrence_key": "run-record-not-at-the-reviewed-commit",
       "trigger": "You are reading a run record, CI result or packet to decide whether a branch is sound.",

diff --git a/LICENSE b/LICENSE
diff --git a/app/auth.py b/app/auth.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/database.py b/app/database.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/geoid_v2.py b/app/geoid_v2.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """GeoID v2: content-derived field identity, and area-exact comparison of covers.
 
 The regime, per doc/current/dpi_architecture_20260812.md S10:

diff --git a/app/grant_verifier.py b/app/grant_verifier.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/main.py b/app/main.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/meal_logger.py b/app/meal_logger.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 import os
 
 import httpx

diff --git a/app/merkle.py b/app/merkle.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 from __future__ import annotations
 
 import hashlib

diff --git a/app/models/__init__.py b/app/models/__init__.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/models/geo_id_model.py b/app/models/geo_id_model.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/routers/analytics_and_maintenance_apis.py b/app/routers/analytics_and_maintenance_apis.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/routers/fetch_field.py b/app/routers/fetch_field.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/routers/field_registration.py b/app/routers/field_registration.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/routers/point_registration.py b/app/routers/point_registration.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/routers/traceforward.py b/app/routers/traceforward.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 import hashlib
 import os
 

diff --git a/app/s2_services.py b/app/s2_services.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/schemas.py b/app/schemas.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/app/tests/conftest.py b/app/tests/conftest.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 import base64
 import json
 import time

diff --git a/app/tests/test_api.py b/app/tests/test_api.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 import os
 
 import pytest

diff --git a/app/tests/test_fsma204_traceability.py b/app/tests/test_fsma204_traceability.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """FSMA 204 end-to-end traceability scenario: romaine lettuce, field to retail.
 
 This file does two jobs. It is a regression harness for the trace-back and

diff --git a/app/tests/test_geoid_v2.py b/app/tests/test_geoid_v2.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 import json
 import os
 

diff --git a/app/tests/test_geoid_v2_iou.py b/app/tests/test_geoid_v2_iou.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 from shapely.wkt import loads
 
 from app.utils import Utils

diff --git a/app/tests/test_geoid_v2_live.py b/app/tests/test_geoid_v2_live.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """GeoID v2 in the live registration path, and the exact cover comparison.
 
 Three changes are pinned here.

diff --git a/app/tests/test_geoid_v2_properties.py b/app/tests/test_geoid_v2_properties.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 from app.utils import Utils
 
 

diff --git a/app/tests/test_traceforward.py b/app/tests/test_traceforward.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 import json
 import os
 import uuid

diff --git a/app/tests/testkit/mint_test_authority_credentials.py b/app/tests/testkit/mint_test_authority_credentials.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """Mint test Authority credentials (vct: agstack.org/credentials/traceforward-authority/v1).
 
 Usage:

diff --git a/app/utils.py b/app/utils.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.

diff --git a/migration/__init__.py b/migration/__init__.py
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
diff --git a/migration/db_repo.py b/migration/db_repo.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 SQLAlchemy-backed TargetRepo.
 

diff --git a/migration/geoid_v2.py b/migration/geoid_v2.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 GeoID v2 — content-derived field identity.
 

diff --git a/migration/models.py b/migration/models.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 SQLAlchemy models for the import's target tables.
 

diff --git a/migration/pipeline.py b/migration/pipeline.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 The import: AR 1.0 polygons -> AR2, TerraPipe profiles -> Hub + Pancake.
 

diff --git a/migration/repo.py b/migration/repo.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 Target-side repository: AR2 registry, Hub accounts, Pancake profiles.
 

diff --git a/migration/resolve.py b/migration/resolve.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 Area-exact IoU and containment over S2 token covers.
 

diff --git a/migration/run.py b/migration/run.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 Import rehearsal runner.
 

diff --git a/migration/sample.py b/migration/sample.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 Adversarial stratified sampling (M2).
 

diff --git a/migration/sources.py b/migration/sources.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 Legacy source adapters — AR 1.0 (polygons) and TerraPipe (profiles).
 

diff --git a/migration/tests/__init__.py b/migration/tests/__init__.py
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
diff --git a/migration/tests/test_db_repo.py b/migration/tests/test_db_repo.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 Tests for the SQLAlchemy repository against real databases (SQLite here,
 Postgres in the rehearsal).

diff --git a/migration/tests/test_limit_invalidates_joins.py b/migration/tests/test_limit_invalidates_joins.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """--limit truncates fields only, so every join figure it produces is an artifact.
 
 `run.py` passes `--limit` to `import_fields` but not to `import_profiles`. Every

diff --git a/migration/tests/test_pipeline.py b/migration/tests/test_pipeline.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """End-to-end import rehearsal on synthetic AR1 + TerraPipe fixtures.
 
 Run: python -m pytest migration/tests/test_pipeline.py -v

diff --git a/migration/tests/test_points_are_importable.py b/migration/tests/test_points_are_importable.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """Pins must import, not quarantine.
 
 The first full run against the live AR 1.0 registry quarantined 14,594 of 28,282

diff --git a/migration/tests/test_primitive.py b/migration/tests/test_primitive.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """Verification of the v2 primitive and the resolution arithmetic.
 
 Run: python -m pytest migration/tests/test_primitive.py -v

diff --git a/migration/tests/test_report_arithmetic.py b/migration/tests/test_report_arithmetic.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """The report's categories must add up, and must not overlap.
 
 THE INCIDENT. On 2026-08-19 an import run reported 268 fields quarantined and 268

diff --git a/migration/tests/test_sample.py b/migration/tests/test_sample.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 Tests for adversarial sampling (M2).
 

diff --git a/migration/tests/test_schema_drift.py b/migration/tests/test_schema_drift.py
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: EUPL-1.2
+# Copyright (c) 2026 AgStack project contributors.
+# Licensed under the EUPL, Version 1.2; see the LICENSE file for the full text.
+
 """
 Drift guard: models.py mirrors the shipped schemas rather than importing them,
 so something has to notice when the real ones change.