chore: relicense repo from MIT to Apache-2.0, matching lean-ctx

[getappz]

Summary

• Root LICENSE and every crate's Cargo.toml license field move from MIT to Apache-2.0, plus aur/agentflare/PKGBUILD.
• Adds NOTICE attribution for vendored code: lean-ctx's embedding pipeline (Apache-2.0, crates/agentflare-store/src/embed.rs + embedding_pipeline/), and the caveman/ponytail-derived flare-output/flare-code crates (MIT).
• Executes item refactor(errors): unified AgentflareError for MCP dispatch helpers #176, which implements the licensing decision approved in the 2026-07-17-agentflare-store-v1 spec's Licensing section but explicitly scoped out of that crate's own implementation plan as a separate action item.

Why

• Apache-2.0 has an explicit patent grant MIT lacks.
• Removes cross-license attribution complexity for the lean-ctx embedding pipeline vendored into agentflare-store (both projects now share one license).
• Matches the sibling lean-ctx project, which is already Apache-2.0.
• Copyright is held by getappz and a CLA is already in place, so this is unilaterally possible with no per-contributor consent hunt.
• The paid multi-machine collaboration service stays in a separate, closed-source repo outside this project — this change has no bearing on that plan (FSL/BSL was considered and dropped earlier in the same discussion).

Test plan

• cargo metadata --no-deps confirms all 11 crates report license=Apache-2.0
• cargo deny check licenses passes (Apache-2.0 already allow-listed in deny.toml, confirmed no CI risk)
• Verified NOTICE attribution URLs against each reference repo's actual git remote (JuliusBrussee/caveman, DietrichGebert/ponytail, yvgude/lean-ctx)
• Not run: full cargo test --workspace/clippy — no .rs files touched, change is license metadata + text files only

Summary by CodeRabbit

• Documentation
  • Updated the project and component licensing from MIT to Apache 2.0.
  • Replaced the license text with the Apache License, Version 2.0.
  • Expanded third-party attribution notices for included code and data.
  • Updated package metadata to consistently reflect the Apache 2.0 license.

[coderabbitai]

📝 Walkthrough

Walkthrough

The project-wide license changed from MIT to Apache-2.0. The root license text, third-party notices, Cargo manifests, and Arch package metadata were updated accordingly.

Changes

Licensing update

Layer / File(s)	Summary
License and attribution documents LICENSE, NOTICE	LICENSE now contains Apache License 2.0, while NOTICE adds attribution and license text for claude-view, lean-ctx, caveman, and ponytail content.
Package license metadata Cargo.toml, crates/*/Cargo.toml, aur/agentflare/PKGBUILD	Root, crate, and Arch package metadata now declare Apache-2.0 instead of MIT.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: tech-debt

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: relicensing the repo from MIT to Apache-2.0.
Description check	✅ Passed	The description covers the required summary and test plan well, but the reviewer-notes section from the template is missing.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch task/176

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@aur/agentflare/PKGBUILD`:
- Line 8: Update the PKGBUILD package() function to install the tracked NOTICE
file alongside LICENSE, ensuring both upstream attribution files are included in
the Arch package.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3c34c6c6-73be-4293-ba16-f4a069521285

📥 Commits

Reviewing files that changed from the base of the PR and between c200649 and b4d8f0a.

📒 Files selected for processing (14)

• Cargo.toml
• LICENSE
• NOTICE
• aur/agentflare/PKGBUILD
• crates/agent-registry/Cargo.toml
• crates/agentflare-artifacts/Cargo.toml
• crates/agentflare-backend/Cargo.toml
• crates/agentflare-db-kit/Cargo.toml
• crates/agentflare-store/Cargo.toml
• crates/flare-code/Cargo.toml
• crates/flare-output/Cargo.toml
• crates/flare-search-kit/Cargo.toml
• crates/gateway-registry/Cargo.toml
• crates/skill-registry/Cargo.toml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== PKGBUILD ==\n'
nl -ba aur/agentflare/PKGBUILD | sed -n '1,120p'

printf '\n== FILES ==\n'
git ls-files aur/agentflare | sed 's#^`#-` #'

printf '\n== PPA workflow snippet ==\n'
nl -ba .github/workflows/ppa-publish.yml | sed -n '1,220p'

Repository: getappz/agentflare

Length of output: 212

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== PKGBUILD ==\n'
cat -n aur/agentflare/PKGBUILD | sed -n '1,140p'

printf '\n== agentflare tracked files ==\n'
git ls-files aur/agentflare | sed 's#^`#-` #'

printf '\n== NOTICE references in aur/agentflare ==\n'
grep -RIn --exclude-dir=.git --exclude='*.png' --exclude='*.jpg' --exclude='*.jpeg' --exclude='*.gif' --exclude='*.svg' 'NOTICE\|notice' aur/agentflare || true

printf '\n== PPA workflow snippet ==\n'
cat -n .github/workflows/ppa-publish.yml | sed -n '1,260p'

Repository: getappz/agentflare

Length of output: 11095

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== tracked NOTICE-like files in repo ==\n'
git ls-files | grep -E '(^|/)(NOTICE|NOTICE\.txt|NOTICE\.md|notice)(\..*)?$' || true

printf '\n== all NOTICE references in repo ==\n'
grep -RIn --exclude-dir=.git 'NOTICE' . || true

printf '\n== root files ==\n'
git ls-files | sed -n '1,220p'

Repository: getappz/agentflare

Length of output: 8030

---

Install NOTICE in the Arch package.

package() installs LICENSE but omits the tracked NOTICE file, so the Arch artifact drops the upstream attribution notices. Add:

Proposed fix

   install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 NOTICE "$pkgdir/usr/share/licenses/$pkgname/NOTICE"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@aur/agentflare/PKGBUILD` at line 8, Update the PKGBUILD package() function to
install the tracked NOTICE file alongside LICENSE, ensuring both upstream
attribution files are included in the Arch package.