Licence: userspace under PolyForm Noncommercial 1.0.0

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
 name: Bug report
 description: Something does not work as described
 labels: [bug]

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
 blank_issues_enabled: false
 contact_links:
   - name: Security vulnerability

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
 name: Feature request
 description: Suggest a capability or a change in behaviour
 labels: [enhancement]

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
 # Third-party actions are pinned to a commit SHA, not a tag.
 #
 # A tag is mutable: whoever controls the action repository can move v4 to new
@@ -51,7 +51,7 @@ jobs:
       # its own `desktop viewer` job, which installs that stack. Excluding it here
       # keeps the daemon build free of GUI system deps — "a GUI build failure must
       # never block the daemon."
-      - name: Build the userspace (Apache-2.0 side)
+      - name: Build the userspace (PolyForm side)
         run: cargo build --workspace --exclude ringzero-app
 
       - name: Test
@@ -118,8 +118,8 @@ jobs:
                   head = '\n'.join(open(p, encoding='utf-8', errors='ignore').read().splitlines()[:5])
                   if 'SPDX-License-Identifier' not in head:
                       bad.append(p); continue
-                  # GPL/ must be GPL-2.0; everything else must be Apache-2.0
-                  want = 'GPL-2.0' if p.startswith('./GPL/') else 'Apache-2.0'
+                  # GPL/ must be GPL-2.0; everything else must be PolyForm-Noncommercial-1.0.0
+                  want = 'GPL-2.0' if p.startswith('./GPL/') else 'PolyForm-Noncommercial-1.0.0'
                   if want not in head:
                       bad.append(f'{p} (expected {want})')
           if bad:
@@ -133,7 +133,7 @@ jobs:
         run: |
           stray=$(find . -name '*.bpf.c' -not -path './GPL/*' -not -path './target/*')
           if [ -n "$stray" ]; then
-            echo "BPF source outside GPL/ would put GPL code in the Apache tree:"
+            echo "BPF source outside GPL/ would put GPL code in the PolyForm tree:"
             echo "$stray"
             exit 1
           fi
@@ -145,7 +145,7 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
-      - name: Fail on copyleft or non-OSS licences in the Apache userspace
+      - name: Fail on copyleft licences in the userspace dependencies
         run: |
           cargo metadata --format-version 1 --all-features > /tmp/meta.json
           python3 - <<'PY'

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
 # Third-party actions are pinned to a commit SHA, not a tag.
 #
 # A tag is mutable: whoever controls the action repository can move v4 to new

CHANGELOG.md

@@ -7,13 +7,20 @@ project, so the minor version moves for breaking changes.
 
 First public release. Linux only.
 
+### Licensing
+
+- The userspace (daemon, CLI, desktop app, checks, packaging) moves from
+  Apache-2.0 to the PolyForm Noncommercial License 1.0.0: free for individuals
+  and noncommercial organisations, with a commercial license for business use
+  (see COMMERCIAL.md). The kernel-side code in `GPL/` stays GPL-2.0.
+
 ### Two layers
 
 - **Kernel enforcement** (`GPL/bpf`, GPL-2.0) — eBPF LSM programs that refuse
   open, create, delete and rename of protected files for an agent's whole
   process tree. Files are pinned by basename **and** by `(device, inode)`, so
   renames, hardlinks and symlinks reach the same decision.
-- **Checks** (`checks/`, Apache-2.0) — deterministic scorers for tool-call
+- **Checks** (`checks/`, PolyForm Noncommercial 1.0.0) — deterministic scorers for tool-call
   argument risk and sensitive-data exposure. They run off the syscall path on
   harness hook events, return one option from a fixed set with a probability
   and a confidence, and never allow or deny anything. Off by default.

COMMERCIAL.md

@@ -0,0 +1,20 @@
+# Commercial licensing
+
+Ring Zero Security is free for individuals. The userspace (daemon, CLI,
+desktop app and packaging) is licensed under the
+[PolyForm Noncommercial License 1.0.0](LICENSE), which allows:
+
+- personal use, including hobby projects, research and study, and
+- use by noncommercial organisations such as charities, schools and public
+  research bodies.
+
+**Any use by or for a business needs a commercial license.** That includes
+running Ring Zero Security on company machines, on employees' work machines,
+or as part of a service you sell.
+
+A commercial license includes support and help with rollout for your security
+team. To get one, email abhijit@ringzerosecurity.com or book a call at
+https://cal.com/ringzerosecurity/30min.
+
+The kernel-side code in `GPL/` is GPL-2.0, as Linux requires for BPF LSM
+programs, and its terms are unchanged.

CONTRIBUTING.md

@@ -22,7 +22,7 @@ We do not require a CLA for userspace code.
 # Kernel side (GPL-2.0) — needs clang, bpftool, libbpf-dev, and BTF
 make -C GPL/bpf all
 
-# Userspace (Apache-2.0)
+# Userspace (PolyForm Noncommercial 1.0.0)
 cargo build --release
 cargo test --workspace
 cargo fmt --all -- --check
@@ -54,8 +54,8 @@ allow something it should.
 
 The licence split is load-bearing. Do not move BPF source out of `GPL/`, and do
 not embed BPF source into the userspace crates: the kernel will refuse to load
-a BPF LSM program that is not GPL-declared, and the Apache side must stay free
-of GPL source.
+a BPF LSM program that is not GPL-declared, and the PolyForm side must stay
+free of GPL source.
 
 ## Unsafe code
 
@@ -70,3 +70,10 @@ Do not open an issue. Email **security@ringzerosecurity.com** — see
 ## Code of conduct
 
 Participating here means following the [code of conduct](CODE_OF_CONDUCT.md).
+
+## Licensing of contributions
+
+Ring Zero Security licenses the userspace under PolyForm Noncommercial 1.0.0
+and sells commercial licenses to businesses. By submitting a contribution
+outside `GPL/`, you agree that Ring Zero Security may distribute it under both
+of those terms. Contributions to `GPL/` are GPL-2.0.

Cargo.toml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
 [workspace]
 resolver = "2"
 members = [
@@ -12,7 +12,7 @@ members = [
 version    = "0.1.0"
 edition    = "2021"
 authors    = ["Ring Zero Security"]
-license    = "Apache-2.0"
+license    = "PolyForm-Noncommercial-1.0.0"
 repository = "https://github.com/ringzerosec/jev-runtime-security"
 
 [workspace.dependencies]

GPL/README.md

@@ -1,15 +1,15 @@
 # GPL/ — the kernel-side code
 
 Everything in this directory is **GPL-2.0** (see `GPL/LICENSE`). The rest of
-the repository is Apache-2.0.
+the repository is under PolyForm Noncommercial 1.0.0.
 
 This split is not a preference. Linux refuses to load a BPF LSM program unless
 it declares a GPL-compatible license, because these programs call GPL-only
 kernel helpers. So `ringzero.bpf.c` declares `char LICENSE[] SEC("license") =
 "GPL";` and carries an SPDX GPL-2.0 header, and it lives in its own directory
 so the boundary is a directory boundary rather than a comment somebody has to
 notice. The userspace loader links **compiled objects** only; no BPF source is
-compiled into the Apache side.
+compiled into the PolyForm side.
 
 ## What the programs do