chore: add SPDX-License-Identifier to all Go source files

devonartis · devonartis · commit be15d1f9189b · 2026-04-13T13:59:59.000-04:00
Every .go file in cmd/ and internal/ (77 files) now carries // SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0 as its first line, per the PolyForm relicense (PR #21). CI contamination gate extended with an SPDX header check so new Go files without the header fail the gate. Mirrored in scripts/gates.sh for gate parity.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -120,6 +120,16 @@ jobs:
             exit 1
           fi
           echo "PASS: no stale brand strings"
+      - name: SPDX header check
+        run: |
+          MISSING=$(find cmd/ internal/ -name '*.go' -exec sh -c \
+            'head -1 "$1" | grep -qF "SPDX-License-Identifier:" || echo "$1"' _ {} \;)
+          if [ -n "$MISSING" ]; then
+            echo "FAIL: Go files missing SPDX-License-Identifier header:"
+            echo "$MISSING"
+            exit 1
+          fi
+          echo "PASS: all Go files have SPDX headers"
 
   unit-tests:
     name: unit-tests
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added — SPDX headers on all Go source files (2026-04-13)
+
+- Every `.go` file in `cmd/` and `internal/` (77 files) now carries `// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0` as the first line.
+- CI `contamination` gate extended with an SPDX header check — new Go files without the header will fail the gate.
+
 ### Changed — License: AGPL-3.0 → PolyForm Internal Use 1.0.0 (2026-04-13)
 
 - **`LICENSE`** — replaced AGPL-3.0 text with PolyForm Internal Use License 1.0.0 (source-available, permanent, no sunset). SPDX identifier: `PolyForm-Internal-Use-1.0.0`. Dual-license header added for commercial-use contact path.
diff --git a/cmd/awrit/apps.go b/cmd/awrit/apps.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package main — awrit app subcommands for managing registered apps.
 //
 // Commands:
diff --git a/cmd/awrit/audit.go b/cmd/awrit/audit.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // audit.go implements the awrit audit command group.
 package main
 
diff --git a/cmd/awrit/client.go b/cmd/awrit/client.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (
diff --git a/cmd/awrit/init_cmd.go b/cmd/awrit/init_cmd.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (
diff --git a/cmd/awrit/init_cmd_test.go b/cmd/awrit/init_cmd_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (
diff --git a/cmd/awrit/main.go b/cmd/awrit/main.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Command awrit is the operator CLI for the AgentAuth broker.
 package main
 
diff --git a/cmd/awrit/output.go b/cmd/awrit/output.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (
diff --git a/cmd/awrit/revoke.go b/cmd/awrit/revoke.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Command awrit revoke subcommand — revokes tokens at various granularity levels.
 package main
 
diff --git a/cmd/awrit/root.go b/cmd/awrit/root.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (
diff --git a/cmd/awrit/token.go b/cmd/awrit/token.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Command awrit token subcommand — token operations including release.
 package main
 
diff --git a/cmd/broker/main.go b/cmd/broker/main.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Command broker starts the AgentAuth broker HTTP server.
 //
 // It wires all internal services together, registers routes on an
diff --git a/cmd/broker/serve.go b/cmd/broker/serve.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (
diff --git a/cmd/broker/serve_test.go b/cmd/broker/serve_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (
diff --git a/internal/admin/admin_hdl.go b/internal/admin/admin_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package admin
 
 import (
diff --git a/internal/admin/admin_hdl_test.go b/internal/admin/admin_hdl_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package admin
 
 import (
diff --git a/internal/admin/admin_svc.go b/internal/admin/admin_svc.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package admin handles the operator side of the broker — authenticating
 // with the admin secret and managing launch tokens. The operator is the
 // human or automation that bootstraps the system: they register apps,
diff --git a/internal/admin/admin_svc_test.go b/internal/admin/admin_svc_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package admin
 
 import (
diff --git a/internal/app/app_hdl.go b/internal/app/app_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package app — HTTP handlers for app CRUD (admin-operated) and app
 // authentication (self-service). The /v1/admin/apps/* routes are for the
 // operator managing apps; /v1/app/auth is how the app itself logs in.
diff --git a/internal/app/app_hdl_test.go b/internal/app/app_hdl_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package app
 
 import (
diff --git a/internal/app/app_svc.go b/internal/app/app_svc.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package app manages the app credential lifecycle. Apps are software that
 // manage agents — an orchestrator, a CI pipeline, a SaaS backend. Admin
 // registers the app, giving it a scope ceiling (the maximum permissions it
diff --git a/internal/app/app_svc_test.go b/internal/app/app_svc_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package app
 
 import (
diff --git a/internal/audit/audit_log.go b/internal/audit/audit_log.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package audit provides a tamper-evident, hash-chain audit trail with
 // automatic PII sanitization.
 //
diff --git a/internal/audit/audit_log_test.go b/internal/audit/audit_log_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package audit
 
 import (
diff --git a/internal/authz/rate_mw.go b/internal/authz/rate_mw.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // rate_mw.go — per-key token-bucket rate limiter. Protects admin auth
 // (per-IP) and app auth (per-client_id) against brute force and credential
 // stuffing.
diff --git a/internal/authz/rate_mw_test.go b/internal/authz/rate_mw_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package authz
 
 import (
diff --git a/internal/authz/scope.go b/internal/authz/scope.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package authz provides scope-based authorization and Bearer token
 // validation middleware for the AgentAuth broker.
 //
diff --git a/internal/authz/scope_test.go b/internal/authz/scope_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package authz
 
 import (
diff --git a/internal/authz/val_mw.go b/internal/authz/val_mw.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package authz
 
 import (
diff --git a/internal/authz/val_mw_test.go b/internal/authz/val_mw_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package authz
 
 import (
diff --git a/internal/cfg/cfg.go b/internal/cfg/cfg.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package cfg loads broker configuration from AA_* environment variables.
 //
 // All configuration keys are prefixed with AA_ to avoid collisions.
diff --git a/internal/cfg/cfg_test.go b/internal/cfg/cfg_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package cfg
 
 import (
diff --git a/internal/cfg/configfile.go b/internal/cfg/configfile.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package cfg
 
 import (
diff --git a/internal/cfg/configfile_test.go b/internal/cfg/configfile_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package cfg
 
 import (
diff --git a/internal/deleg/deleg_svc.go b/internal/deleg/deleg_svc.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package deleg provides scope-attenuated token delegation with chain
 // verification and depth limiting.
 //
diff --git a/internal/deleg/deleg_svc_test.go b/internal/deleg/deleg_svc_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package deleg
 
 import (
diff --git a/internal/handler/audit_hdl.go b/internal/handler/audit_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/challenge_hdl.go b/internal/handler/challenge_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/deleg_hdl.go b/internal/handler/deleg_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/doc.go b/internal/handler/doc.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package handler provides the HTTP layer for the broker. Handlers are thin —
 // they parse requests, call a domain service, and format responses. All
 // business logic lives in the service packages (token, admin, app, identity,
diff --git a/internal/handler/handler_test.go b/internal/handler/handler_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler_test
 
 import (
diff --git a/internal/handler/health_hdl.go b/internal/handler/health_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/logging.go b/internal/handler/logging.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/logging_test.go b/internal/handler/logging_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/metrics_hdl.go b/internal/handler/metrics_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/reg_hdl.go b/internal/handler/reg_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/release_hdl.go b/internal/handler/release_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/release_hdl_test.go b/internal/handler/release_hdl_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/renew_hdl.go b/internal/handler/renew_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/request_id_test.go b/internal/handler/request_id_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/revoke_hdl.go b/internal/handler/revoke_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/security_hdl.go b/internal/handler/security_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import "net/http"
diff --git a/internal/handler/security_hdl_test.go b/internal/handler/security_hdl_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/handler/val_hdl.go b/internal/handler/val_hdl.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (
diff --git a/internal/identity/id_svc.go b/internal/identity/id_svc.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package identity implements the agent registration flow including
 // challenge-response verification, SPIFFE ID generation, Ed25519 key
 // management, and scope enforcement.
diff --git a/internal/identity/id_svc_test.go b/internal/identity/id_svc_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package identity
 
 import (
diff --git a/internal/identity/spiffe.go b/internal/identity/spiffe.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package identity
 
 import (
diff --git a/internal/keystore/keystore.go b/internal/keystore/keystore.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package keystore loads or generates an Ed25519 signing key pair,
 // persisting it to disk in PEM-encoded PKCS8 format.
 package keystore
diff --git a/internal/keystore/keystore_test.go b/internal/keystore/keystore_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package keystore
 
 import (
diff --git a/internal/mutauth/discovery.go b/internal/mutauth/discovery.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package mutauth
 
 import (
diff --git a/internal/mutauth/discovery_test.go b/internal/mutauth/discovery_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package mutauth
 
 import (
diff --git a/internal/mutauth/heartbeat.go b/internal/mutauth/heartbeat.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package mutauth
 
 import (
diff --git a/internal/mutauth/heartbeat_test.go b/internal/mutauth/heartbeat_test.go
diff --git a/internal/mutauth/mut_auth_hdl.go b/internal/mutauth/mut_auth_hdl.go
diff --git a/internal/mutauth/mut_auth_hdl_test.go b/internal/mutauth/mut_auth_hdl_test.go
diff --git a/internal/obs/obs.go b/internal/obs/obs.go
diff --git a/internal/problemdetails/problemdetails.go b/internal/problemdetails/problemdetails.go
diff --git a/internal/revoke/rev_svc.go b/internal/revoke/rev_svc.go
diff --git a/internal/revoke/rev_svc_test.go b/internal/revoke/rev_svc_test.go
diff --git a/internal/store/jti_test.go b/internal/store/jti_test.go
diff --git a/internal/store/sql_store.go b/internal/store/sql_store.go
diff --git a/internal/store/sql_store_app_test.go b/internal/store/sql_store_app_test.go
diff --git a/internal/store/sql_store_revoke_test.go b/internal/store/sql_store_revoke_test.go
diff --git a/internal/store/sql_store_test.go b/internal/store/sql_store_test.go
diff --git a/internal/token/revoker.go b/internal/token/revoker.go
diff --git a/internal/token/tkn_claims.go b/internal/token/tkn_claims.go
diff --git a/internal/token/tkn_svc.go b/internal/token/tkn_svc.go
diff --git a/internal/token/tkn_svc_test.go b/internal/token/tkn_svc_test.go
diff --git a/scripts/gates.sh b/scripts/gates.sh

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0`
	`2`	`+`
`1`	`3`	`// Package main — awrit app subcommands for managing registered apps.`
`2`	`4`	`//`
`3`	`5`	`// Commands:`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0`
	`2`	`+`
`1`	`3`	`// audit.go implements the awrit audit command group.`
`2`	`4`	`package main`
`3`	`5`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0`
	`2`	`+`
`1`	`3`	`// Command awrit is the operator CLI for the AgentAuth broker.`
`2`	`4`	`package main`
`3`	`5`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0`
	`2`	`+`
`1`	`3`	`// Command awrit revoke subcommand — revokes tokens at various granularity levels.`
`2`	`4`	`package main`
`3`	`5`