chore: SPDX headers on all Go source files

.github/workflows/ci.yml

@@ -120,6 +120,16 @@ jobs:
             exit 1
           fi
           echo "PASS: no stale brand strings"
+      - name: SPDX header check
+        run: |
+          MISSING=$(find cmd/ internal/ -name '*.go' -exec sh -c \
+            'head -1 "$1" | grep -qF "SPDX-License-Identifier:" || echo "$1"' _ {} \;)
+          if [ -n "$MISSING" ]; then
+            echo "FAIL: Go files missing SPDX-License-Identifier header:"
+            echo "$MISSING"
+            exit 1
+          fi
+          echo "PASS: all Go files have SPDX headers"
 
   unit-tests:
     name: unit-tests

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added — SPDX headers on all Go source files (2026-04-13)
+
+- Every `.go` file in `cmd/` and `internal/` (77 files) now carries `// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0` as the first line.
+- CI `contamination` gate extended with an SPDX header check — new Go files without the header will fail the gate.
+
 ### Changed — License: AGPL-3.0 → PolyForm Internal Use 1.0.0 (2026-04-13)
 
 - **`LICENSE`** — replaced AGPL-3.0 text with PolyForm Internal Use License 1.0.0 (source-available, permanent, no sunset). SPDX identifier: `PolyForm-Internal-Use-1.0.0`. Dual-license header added for commercial-use contact path.

cmd/awrit/apps.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package main — awrit app subcommands for managing registered apps.
 //
 // Commands:

cmd/awrit/audit.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // audit.go implements the awrit audit command group.
 package main
 

cmd/awrit/client.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (

cmd/awrit/init_cmd.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (

cmd/awrit/init_cmd_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (

cmd/awrit/main.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Command awrit is the operator CLI for the AgentAuth broker.
 package main
 

cmd/awrit/output.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (

cmd/awrit/revoke.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Command awrit revoke subcommand — revokes tokens at various granularity levels.
 package main
 

cmd/awrit/root.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (

cmd/awrit/token.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Command awrit token subcommand — token operations including release.
 package main
 

cmd/broker/main.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Command broker starts the AgentAuth broker HTTP server.
 //
 // It wires all internal services together, registers routes on an

cmd/broker/serve.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (

cmd/broker/serve_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package main
 
 import (

docs/README.md

@@ -1,6 +1,6 @@
 # AgentWrit Documentation
 
-AgentWrit is an open-source credential broker for AI agents. It issues short-lived, scope-attenuated tokens so agents operate with only the permissions their task requires — nothing more, nothing longer.
+AgentWrit is a credential broker for AI agents. It issues short-lived, scope-attenuated tokens so agents operate with only the permissions their task requires — nothing more, nothing longer. Free for internal use.
 
 ---
 

docs/python-sdk.md

@@ -1,6 +1,6 @@
 # AgentWrit Python SDK
 
-> **Coming soon to public.** The Python SDK is complete and will be published as an open-source repo at [`devonartis/agentwrit-python`](https://github.com/devonartis/agentwrit-python) after final cleanup.
+> **Coming soon to public.** The Python SDK is complete and will be published at [`devonartis/agentwrit-python`](https://github.com/devonartis/agentwrit-python) after final cleanup.
 
 ## What it does
 

internal/admin/admin_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package admin
 
 import (

internal/admin/admin_hdl_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package admin
 
 import (

internal/admin/admin_svc.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package admin handles the operator side of the broker — authenticating
 // with the admin secret and managing launch tokens. The operator is the
 // human or automation that bootstraps the system: they register apps,

internal/admin/admin_svc_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package admin
 
 import (

internal/app/app_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package app — HTTP handlers for app CRUD (admin-operated) and app
 // authentication (self-service). The /v1/admin/apps/* routes are for the
 // operator managing apps; /v1/app/auth is how the app itself logs in.

internal/app/app_hdl_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package app
 
 import (

internal/app/app_svc.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package app manages the app credential lifecycle. Apps are software that
 // manage agents — an orchestrator, a CI pipeline, a SaaS backend. Admin
 // registers the app, giving it a scope ceiling (the maximum permissions it

internal/app/app_svc_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package app
 
 import (

internal/audit/audit_log.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package audit provides a tamper-evident, hash-chain audit trail with
 // automatic PII sanitization.
 //

internal/audit/audit_log_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package audit
 
 import (

internal/authz/rate_mw.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // rate_mw.go — per-key token-bucket rate limiter. Protects admin auth
 // (per-IP) and app auth (per-client_id) against brute force and credential
 // stuffing.

internal/authz/rate_mw_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package authz
 
 import (

internal/authz/scope.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package authz provides scope-based authorization and Bearer token
 // validation middleware for the AgentAuth broker.
 //

internal/authz/scope_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package authz
 
 import (

internal/authz/val_mw.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package authz
 
 import (

internal/authz/val_mw_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package authz
 
 import (

internal/cfg/cfg.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package cfg loads broker configuration from AA_* environment variables.
 //
 // All configuration keys are prefixed with AA_ to avoid collisions.

internal/cfg/cfg_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package cfg
 
 import (

internal/cfg/configfile.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package cfg
 
 import (

internal/cfg/configfile_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package cfg
 
 import (

internal/deleg/deleg_svc.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package deleg provides scope-attenuated token delegation with chain
 // verification and depth limiting.
 //

internal/deleg/deleg_svc_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package deleg
 
 import (

internal/handler/audit_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/challenge_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/deleg_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/doc.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package handler provides the HTTP layer for the broker. Handlers are thin —
 // they parse requests, call a domain service, and format responses. All
 // business logic lives in the service packages (token, admin, app, identity,

internal/handler/handler_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler_test
 
 import (

internal/handler/health_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/logging.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/logging_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/metrics_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/reg_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/release_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/release_hdl_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/renew_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/request_id_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/revoke_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/security_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import "net/http"

internal/handler/security_hdl_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/handler/val_hdl.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package handler
 
 import (

internal/identity/id_svc.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package identity implements the agent registration flow including
 // challenge-response verification, SPIFFE ID generation, Ed25519 key
 // management, and scope enforcement.

internal/identity/id_svc_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package identity
 
 import (

internal/identity/spiffe.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package identity
 
 import (

internal/keystore/keystore.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 // Package keystore loads or generates an Ed25519 signing key pair,
 // persisting it to disk in PEM-encoded PKCS8 format.
 package keystore

internal/keystore/keystore_test.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package keystore
 
 import (

internal/mutauth/discovery.go

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: PolyForm-Internal-Use-1.0.0
+
 package mutauth
 
 import (