chore(license): relicense the SDK from Apache-2.0 to MIT, matching the other SDKs and plugins

[saurabhjain1592]

Why

Every other public interface repo is MIT (Go, Python, TypeScript and Rust SDKs; all seven plugins; litellm; the n8n node; verified on the forge 2026-09-03). This repo is Apache-2.0. Operator decision 2026-09-03: relicense to MIT before the 9.3.0 tag so the next published artefact carries the same licence as its siblings. Artefacts already on Maven Central (≤ 9.2.0) stay Apache-2.0 as published; Central is immutable.

Surface (measured at origin/main 2026-09-03)

• LICENSE (Apache-2.0 text)
• pom.xml:16-22 <licenses> block (what Maven Central publishes)
• 247 source files under src/, examples/, scripts/ with an Apache header (// SPDX-License-Identifier: Apache-2.0 one-liners and full "Licensed under the Apache License, Version 2.0" blocks)
• README.md:802 "licensed under the Apache License 2.0"
• NOT in scope: mvnw, mvnw.cmd, .mvn/** (third-party Apache-licensed Maven Wrapper, keeps its own licence)

Authorship (relicensing precondition)

git log --format='%ae' | sort | uniq -c: saurabhjain1592@gmail.com 199, gzak@getaxonflow.com 3, thegzak@gmail.com 2. The copyright holder relicenses its own work; a third party's Apache-2.0 contribution needs written consent. The operator confirms whether both gzak identities are company-side before the PR merges.

Tracking

v10.4.0 train: getaxonflow/axonflow-enterprise#3657 (release prep carries the 9.3.0 tag). Docs and landing mentions of the Java licence are reported on the PR and held to the tag by master (a docs merge publishes within two minutes).

[saurabhjain1592]

Session S8 complete. PR #222 Ready-for-review at head f47cea1e57e04366e8d47fad3c1fe3b3e9058b3b, awaiting master R3 + merge. Worker does not merge.

CI: 16 of 17 green, one deliberate red. Not "CI green" - Runtime E2E required for user-facing changes fails, and it is master's to resolve, not mine. Green: Build Summary, lint, Lint - no mocks in runtime-e2e/, build (17), Examples Compile, Contract Integration (WireMock, JDK 17), Validate Version Alignment, Validate Wire Shape, real-stack ubuntu-latest, CodeQL + three Analyze legs, DCO; Live Integration (Community Stack) SKIPPED; package was still running at my last poll. mergeState is BLOCKED solely on that gate. Per the brief the [skip-runtime-e2e] marker is master's to apply after reading the diff; the PR body carries the required ## Skip-runtime-e2e justification section already, explicitly inert until then. Note for whoever applies it: definition-of-done.yml:9-12 drops edited from its triggers, so editing the title does not re-run the gate and a re-run replays the original payload - only a new push does.

Authorship: HELD, question with the operator, nothing assumed. Three identities in the whole of main - saurabhjain1592@gmail.com (199), gzak@getaxonflow.com (3), thegzak@gmail.com (2) - and the merged-PR census (195 / 5) shows both gzak addresses resolve to one GitHub account. Supporting, not deciding: gh api orgs/getaxonflow/memberships/gzak returns {"role":"member","state":"active"}, his public GitHub email is the gmail one, three of the five commits are under the company domain, and the repo has no CLA and no NOTICE. The contributions are material (AxonFlowTry.java in #120, AuditToolCallRequest.callerName in #199, the LangGraph fix in #198), so they cannot be waived as de-minimis. The PR body records the status verbatim as AWAITING OPERATOR ANSWER and the merge is held on it.

Headers 247 → 0, with the same command before and after and a positive control (251 files now carry SPDX-License-Identifier: MIT). Two corrections to the brief's figures, both measured: the count is 247, not 248 - a git grep union counts LICENSE itself - and there were six distinct Apache header shapes, not two. One of the six carried non-licence prose inside the licence comment; five files in total did, and all five are preserved. Every remaining apache mention in the tree is justified in the PR body (Maven Wrapper, POM XSD namespaces, plugin groupIds, and one deliberate README sentence).

Scope addition - four Business Source License 1.1 declarations, one inside the published jar. Found by censusing every licence-naming line rather than only the Apache ones: telemetry/HeartbeatState.java:3 (in src/main, so it ships in the jar), plus HeartbeatStateTest, HeartbeatStateE2ETest and TelemetryLicenseTierTest. Relicensing to MIT while leaving a BUSL declaration inside the artifact would have made the PR's own headline claim false, so they are fixed here and the guard is built around the general class - "no non-MIT declaration anywhere" - rather than around Apache specifically.

Dependencies: no STOP. The distributed set (compile + runtime, 16 deps) is 14 Apache-2.0 + 2 MIT - zero copyleft, both compatible with MIT distribution. Stated precisely because the full 83-dep graph including test scope does contain EPL-2.0 (JUnit 5, junit-pioneer), EPL-1.0/LGPL (Logback) and EPL/ASL dual (Jetty via WireMock); none is distributed - absent from the published POM's runtime graph and from the jar - so no obligation is triggered.

Docs/landing hits: none. Both repos swept at origin/main with a positive control (7 apache-mentioning files in axonflow-docs, 1 in axonflow-landing); every one read and none states the Java SDK's licence - axonflow-docs/LICENSE:41 (that repo's own BSL Change-License clause), docs/mcp/connectors/cassandra.md:10 and docs/orchestration/wcp/external-orchestrators.md:4,5,10,76 (the products Apache Cassandra / Airflow), docs/releases/v7-8-0.md:132 (a Go CVE), docs/releases/v9-14-1.md:28 (a historical platform-header note), package-lock.json (npm metadata), and static/llms.txt:206 / :238 (the Community-Edition BSL→Apache conversion clause). Checked by the other spelling too: of the five docs/sdk/*-getting-started.md pages only rust-getting-started.md:233 states a licence at all, so no page is made wrong by this change. Nothing for master to hold to the tag.

Verification. mvn -B package BUILD SUCCESS, 1509 tests, 0 failures; LicenseMetadataTest 9/9; AuthZENGeneratedTypesAreCurrentTest 5/5 (the codegen emits no licence header, so regeneration cannot reintroduce Apache - 20 generated files in Emitter.OUTPUT_DIR, 0 apache-bearing); 5/5 examples compile via CI's own sync-example-sdk-versions.py procedure; LICENSE md5-identical to the Go SDK's; MIT confirmed in the effective POM, not just the source. No behaviour change: for all 251 modified .java, the file with its leading comment removed is byte-identical to origin/main - 0 differ, established by three independent methods.

R3: two hostile rounds, and round 2 is why it was worth doing. Round 1 found three real defects in my own guard. My fix to one of them - an SPDX reader that false-positived on /* …: MIT */ - traded a false positive for a false negative, the worse direction: indexOf finds only the first tag, so <!-- …: MIT --> <!-- …: Apache-2.0 --> reported as plain MIT and let the Apache declaration beside it pass in silence. Round 2 proved it end-to-end and also killed two surviving mutants (nothing pinned isThirdParty; two of four comment terminators were asserted by nothing) plus a CRLF break whose message read expected "MIT License" but was "MIT License". All fixed and pinned; nine mutants across both rounds, each with a Tests run control so no row can pass because nothing executed.

Resolved-vs-filed: 1 resolved, 4 routed (0 filed by me). Resolved: this issue. Routed and confirmed open at the time of writing - sdk-java#220 (the lint required context is fail-open: ci.yml breaks out of its retry loop on the first failure, so a real formatting violation prints "skipped" and the job exits 0; 42 pre-existing violations on main are the accumulated result, and the set on this branch is byte-identical to the origin/main baseline, so this PR adds zero), and the same drift class in three sibling repos - sdk-go#219 (four BUSL-1.1 headers inside an MIT repo), sdk-typescript#268 and sdk-python#238 (two Apache-2.0 each). Those three plus #220 are queued behind this merge.

One thing recorded rather than fixed, because the brief forbids a version bump: pom.xml:9 is still stamped 9.2.0 per this repo's version-trailing convention, so a local mvn install at this HEAD writes a 9.2.0 GAV with MIT while Central's immutable 9.2.0 says Apache-2.0. Pre-existing and true of every post-tag change on main, but this is the first time the trailing field is a licence. The MIT POM first reaches Central at 9.3.0.

After merge: gh repo view getaxonflow/axonflow-sdk-java --json licenseInfo should read MIT License.

[saurabhjain1592]

Lane closeout: the five SDKs are MIT, and the guard is in each of them

All five merges, verified on origin/main in each repository rather than reported from memory (git merge-base --is-ancestor <sha> origin/main):

repo	PR	merge commit	what it did
axonflow-sdk-java	#222	94ea005	relicence Apache-2.0 → MIT: LICENSE, POM <licenses>, 251 headers
axonflow-sdk-go	#222	1e057fb	17 headers (4 BUSL tags + 13 Apache prose blocks)
axonflow-sdk-typescript	#272	d9dcf85	2 Apache-2.0 headers
axonflow-sdk-python	#241	df9511f	2 Apache-2.0 headers + the LICENSE holder name
axonflow-sdk-java	#227	9b20a17	run the formatting-gate guard that nothing invoked (#220)

End state, measured now, each with a control so a zero is an artifact rather than an empty line:

repo	non-MIT declarations	control (files with a copyright)	forge licenseInfo
sdk-go	0	19	MIT License
sdk-typescript	0	4	MIT License
sdk-java	0	261	MIT License
sdk-python	0	4	MIT License
sdk-rust	0	1	MIT License

sdk-rust was never touched and is listed because a claim about "all five SDKs" has to be measured across five, not four.

The holder line now reads AxonFlow in every SDK, each keeping its own first year - Rust's 2026 is correct for Rust.

What the brief asked for, and what was actually there

The brief scoped this to 247 Apache headers in one repository. Four of the five findings that mattered were outside that scope, and every one was found by censusing every licence-naming line rather than the licence the brief named:

• Four Business Source License 1.1 declarations in sdk-java, one in src/main and therefore inside the published jar. A BSL declaration inside an MIT artifact is the contradiction the relicence existed to remove, and it would have shipped under a PR whose headline said the SDK is now MIT.
• sdk-go was 17 files, not the 4 its issue named. The issue came from my own cross-repo report, which searched for SPDX-License-Identifier - a search that sees tags and not prose - and missed 13 Apache prose blocks, all byte-identical. A census bounded by the shape it searched for, in the report that generated the issue.
• The leak is active, not historical. It went 4 → 7 in sdk-java while chore(license): relicense the SDK from Apache-2.0 to MIT [skip-runtime-e2e] #222 was waiting, and git log --diff-filter=A shows every one arrived in a feat(telemetry): PR - feat(telemetry): 7-day delivered-heartbeat with stamp-on-success #155, feat(telemetry): report the platform licence tier on the SDK heartbeat #215, feat(telemetry): declare framework adapters and relay platform identity #223, across four months, one lane, no other lane producing any. That is chore(license): every telemetry PR reseeds a BUSL-1.1 header; the guard catches it, only the source prevents it #226, filed on the root cause: the guard catches the next one, only fixing whatever the telemetry work starts from prevents it.
• lint was fail-open (ci: the lint required context is fail-open (fmt check 'skipped' on the first failure) #220): the retry loop broke out of both arms on attempt 1, so a violation printed "skipped" under a green tick. Fixed upstream by fix(ci): make the formatting check able to fail [skip-runtime-e2e] #225 - which then wrote a guard script that nothing ran. ci: run the formatting-gate guard that nothing invoked [skip-runtime-e2e] #227 wires it and asserts the wiring, because a property pinned on paper and unpinned in practice is the same failure one level up.

The guard, and what it deliberately does not claim

Each repo now carries a licence guard with two rules, because each is blind to what the other catches: an identifier rule (closed under the syntax, case-insensitive, reads every tag on a line) and a prose rule (enumerated, therefore incomplete, and documented as such). sdk-go had 13 of the prose form and 4 of the tag form, so shipping one rule would have been the difference between catching and missing that class. Both directions are demonstrated by mutants that pass rather than only by mutants that fail.

Three things are stated as limits rather than implied as coverage: dependency trees are a categorical exemption (scanning a real go mod vendor tree - 17 files, 7 Apache-prose, 15 third-party notices - would fail the guard on correct code, which is how a guard gets deleted); the shebang rules check position and spelling, not the executable bit (asserting the bit would fail on correct code in every repo - sdk-typescript has 16 shebang-bearing files and 8 are executable); and an unenumerated third licence in prose passes, which the identifier rule is the one that closes.

Corrections made against my own reports

Recorded because each was quoted onward before it was corrected:

• I reported a four-case shebang matrix as covering both languages having measured it only on Python. TypeScript had the position rule and not the re-spaced rule, so two cases passed - including the one I had described as the case nothing else can see.
• The ruff version gap was quoted twice from readings taken on different trees. Measured one tree at a time it is 15 files on either; the one-file difference between trees was the PR's own added guard.
• The first GuardsAreWiredTest grepped raw bytes while its comment claimed it parsed run: lines. A TODO mentioning the script satisfied it.
• Its list was the two scripts that prompted the issue; scripts/mutation-gate.sh describes itself as a gate, had zero workflow references, and was not in it. The list is now derived, with an opt-out marker that requires a reason.

The finding worth carrying furthest

A mutation gate that restores its file with mv from a backup leaves the mutant compiled. mv preserves the backup's mtime, so the restored source is older than the mutated .class, Maven's incremental compiler skips it, and the mutant survives into the next mvn test on that working tree. The source is clean, git status is clean, and two unrelated-looking tests fail until a clean makes them vanish. CI never sees it, because every job is a fresh checkout - so it can only ever appear on a developer's machine, as a failure with no visible cause. Found by wiring the gate into CI and running the suite immediately afterwards; fixed with a touch after restore, proven by running gate-then-suite with no clean (exit 1 before, exit 0 after).

Every guard in this lane caught its own author at least once: a Java anchor path copied into the Go guard, a directive regex that flagged two correct files because //go:build and // +build have opposite spacing rules, a license_tier_telemetry directory name tripping a licence-word rail, a venv named .rvenv escaping a name-based exclusion, and - three times - the guard failing against its own documentation for spelling the tag it scans for.

Resolved: #219, #220. Open and routed: #226 (root cause; the same prevention question applies to sdk-go, whose four BUSL headers were the same habit in that repo's idiom).