Add open-source compliance files and copyright headers

Need to add standard open-source compliance artifacts: license file, copyright headers, contribution guidelines with DCO, and third-party notices.

Requirements

1. LICENSE file

Add LICENSE file to repo root containing the full Apache License 2.0 text
Reference: https://www.apache.org/licenses/LICENSE-2.0

2. SPDX copyright headers on all source files

Every source file (.rs, .py, .proto, .rego, .yaml/.yml where applicable, .sh, .toml) must include an SPDX header:

// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

Use appropriate comment syntax per language (//, #, etc.)
Generated files (protobuf outputs, lockfiles) can be excluded

3. CONTRIBUTING.md with DCO

Add CONTRIBUTING.md to repo root
Must include Developer Certificate of Origin (DCO) sign-off requirement for all contributions
Reference DCO text: https://developercertificate.org/
Example: https://github.com/NVIDIA/TensorRT/blob/main/CONTRIBUTING.md

4. Third-party notices

Add a THIRD-PARTY-NOTICES (or NOTICE) file listing all third-party dependencies and their licenses
Should cover all direct Rust crate dependencies and Python package dependencies
Format: component name, version, license identifier, upstream URL

5. CI enforcement (stretch goal)

Add a CI check that validates:
- All new/modified source files include the SPDX header
- No new copyleft-licensed (GPL/LGPL) dependencies are introduced
Some NVIDIA projects (e.g., NeMo Data Designer) have automated this in their CI pipelines — worth referencing for implementation patterns

Acceptance Criteria

LICENSE file present at repo root (Apache 2.0)
All existing source files have SPDX copyright headers
CONTRIBUTING.md present with DCO requirement
THIRD-PARTY-NOTICES file present with current dependency list
(Optional) CI check blocks PRs missing headers or adding copyleft deps

🏗️ build-plan

Implementation Plan

Issue type: chore
Complexity: Medium — high file count but mechanical changes; the header script is the only non-trivial code
Confidence: High — clear path, well-established patterns from DataDesigner

Summary

Add Apache 2.0 licensing, SPDX copyright headers on all ~186 source files, DCO enforcement, and a third-party notices file. A Python script (scripts/update_license_headers.py) is the centerpiece: it adds/checks headers across all file types and integrates into pre-commit and CI. Follows patterns from NVIDIA NeMo DataDesigner.

Scope

LICENSE (new): Full Apache 2.0 license text
DCO (new): Developer Certificate of Origin 1.1 full text
Cargo.toml: Change license to Apache-2.0, update repository URL to GitHub
pyproject.toml: Add license = "Apache-2.0" field
scripts/update_license_headers.py (new, ~250 lines): Header management script with --check mode, supports // and # comment styles, preserves shebangs and # syntax= directives
scripts/generate_third_party_notices.py (new): Generates THIRD-PARTY-NOTICES from cargo metadata and Python deps
THIRD-PARTY-NOTICES (new): Generated dependency listing
build/license.toml (new): license:check and license:update mise tasks
build/ci.toml: Wire license:check into pre-commit and lint task dependencies
.github/workflows/checks.yml: Add license-headers CI job
.github/workflows/dco.yml (new): DCO sign-off enforcement on PRs
CONTRIBUTING.md: Add DCO section with sign-off requirement
All ~186 source files (.rs, .py, .proto, .rego, .sh, .toml, .yaml/.yml, Dockerfiles): SPDX headers added

Implementation Steps

Add LICENSE file — Apache 2.0 full text at repo root
Update Cargo.toml — license to Apache-2.0, repository URL to https://github.com/NVIDIA/NemoClaw
Update pyproject.toml — add license = "Apache-2.0"
Write scripts/update_license_headers.py — centerpiece script handling all file types with --check mode for CI
Apply headers — run script to stamp all 186 files, verify with --check
Add mise tasks — build/license.toml with license:check and license:update, wire into pre-commit and lint
Add CI job — license-headers job in checks.yml (lightweight, no Rust build)
Update CONTRIBUTING.md + add DCO file — DCO section with sign-off requirement
Add DCO workflow — .github/workflows/dco.yml using gsactions/dco-check
Generate THIRD-PARTY-NOTICES — script + generated file listing all Rust and Python deps

Test Plan

Header script apply mode: All files get headers, no file corruption
Header script check mode: Exit code 0 after apply
Idempotency: Running apply twice produces no diff
Special cases: Shebangs stay on line 1, Dockerfile syntax directives preserved, Rust //! doc comments stay below header
Exclusions: Proto stubs, lockfiles, Helm templates have no headers
Integration: mise run pre-commit catches missing headers; CI license-headers job passes
Build verification: mise run build and mise run test:python still pass with headers
DCO: PR without Signed-off-by fails DCO check

Risks & Open Questions

Large diff (186 files) — merge when PR queue is short
Merge conflicts in in-flight PRs are mechanical to resolve (accept headers from main)
Should .github/workflows/*.yml get headers? (Plan says no — low value)
Should .gitlab-ci.yml be removed in a separate issue?
THIRD-PARTY-NOTICES CI freshness check — deferred to follow-up

Documentation Impact

CONTRIBUTING.md updated with DCO section
Architecture docs: None expected (this is infrastructure, not behavioral change)

Revision 1 — initial plan

chore: add open-source compliance files and SPDX headers

🏗️ build-from-issue-agent

Implementation Complete

PR: #71

What was built

Full open-source compliance: Apache 2.0 license, SPDX headers on all 176 source files, DCO enforcement, third-party notices, and CI enforcement following DataDesigner patterns.

Artifacts added

LICENSE (Apache 2.0), DCO (DCO 1.1)
scripts/update_license_headers.py — header management with --check mode
scripts/generate_third_party_notices.py — dependency license aggregation
THIRD-PARTY-NOTICES — 563 Rust + 3 Python dependencies listed
build/license.toml — license:check and license:update mise tasks
.github/workflows/dco.yml — DCO sign-off enforcement
CI license-headers job in checks.yml

Docs updated

CONTRIBUTING.md — DCO sign-off requirement and license header instructions

The issue will auto-close when the PR is merged.

chore: add open-source compliance files and SPDX headers (#71)

Navigation Menu

Repository navigation

Add open-source compliance files and copyright headers #58