RFC 86 Phase 4: Technical Execution (Switch Commit)

[jjgao]

Phase 4: Technical Execution

Part of: #8
Blocked by: Pre-Switch Sign-off Gate (#5) — the signed relicensing record must be complete before the switch — which is in turn blocked by Phase 3 (#4).

Target window: Sep 23–30, 2026. This is the project's hard deadline (see epic #8), so this window must be mechanical, not exploratory: header-update scripts and the SPDX rollout should already be dry-run tested against the full file inventory during the Phase 1 window (Jul 10–28, see #2), not written from scratch here.

Goal

Execute the actual license change in the codebase cleanly and completely, tied to a specific release version, across all in-scope components (per the Phase 0 manifest #1). This issue is mechanical execution only; eligibility/consent/sign-off live in the gate (#5).

Tasks

• Define the Switch Commit: Pick a target release version (e.g. v6.0) as the boundary. At this boundary, all in-scope, project-owned code selected for relicensing switches to Apache 2.0; pre-boundary versions remain AGPL. Third-party, vendored, generated, excluded, externally-provided, and historical-only artifacts retain their separate treatment per the Phase 0 manifest (RFC 86 Phase 0: Release & Component Scope #1).
• License headers: Prefer SPDX identifiers (SPDX-License-Identifier: Apache-2.0) or a standard header policy rather than blindly adding long headers everywhere.
• Header/update scripts must exclude third-party, vendored, generated, lock, minified, and binary assets unless confirmed project-owned; preserve existing third-party notices.
• Update LICENSE file: Replace AGPL text with Apache 2.0 text.
• NOTICE file (only if needed): Apache 2.0 does not require a NOTICE file in every project by itself. If one is created, keep it to required legal notices only; put general credits in AUTHORS / CONTRIBUTORS if desired.
• Update license metadata everywhere, not just LICENSE/README.md: Maven POMs, package metadata, Docker/Helm/deployment metadata, docs site, release notes, badges, and generated docs.
• Confirm DCO is live (pulled forward from Phase 5 RFC 86 Phase 5: Future Governance (DCO + License Scanning) #7) so no post-switch Apache-licensed commit lands without inbound sign-off.
• Tag the Switch Commit clearly in git with a signed release tag that points at the sign-off record (RFC 86 Pre-Switch Sign-off Gate (blocks Phase 4) #5).
• Verify: Check no AGPL headers remain in post-switch code. Verification must distinguish stale current-license references from valid historical statements (e.g. "pre-switch versions were AGPL" is correct, not a defect).

Definition of Done

The Switch Commit is merged to main, tagged, and released by Sep 30, 2026. All in-scope, project-owned files carry Apache 2.0 SPDX headers; third-party notices are preserved. LICENSE, license metadata, docs site, badges, and (if created) NOTICE are updated. No stale AGPL references remain in post-switch code, while valid historical statements are retained.

[jjgao]

Process review note: A few execution details are worth making explicit before the switch PR:

• prefer SPDX identifiers, e.g. SPDX-License-Identifier: Apache-2.0, or a standard header policy rather than blindly adding long headers everywhere
• header/update scripts should exclude third-party, vendored, generated, lock, minified, and binary assets unless confirmed project-owned; preserve existing third-party notices
• Apache-2.0 does not require a NOTICE file in every project by itself; if a NOTICE file is created, keep it to required legal notices. Put general credits in AUTHORS/CONTRIBUTORS if desired
• update license metadata beyond LICENSE/README.md: Maven POMs, package metadata, Docker/Helm/deployment metadata, docs site, release notes, badges, and generated docs
• verification should distinguish stale current-license references from valid historical statements such as “pre-switch versions were AGPL”