Restructure license per AI legal review findings (#2–#8)

[zackees]

Implements the fixes from the AI first-pass legal review (meta issue #8; children #2–#7). All applied judgment calls are recorded in LEGAL-REVIEW.md for attorney ratification and can be reversed there.

What changed

LICENSE — now a single self-contained instrument (#2 Q1/Q2, #4 Q5)

• Modified MPL 2.0 under its §10.3 rename path: FastLED is steward (§10.1), Mozilla references reduced to the permitted differs-from note; the §10.2 "subsequent version" upgrade now points at the FastLED steward, closing the future-MPL-3.0 escape.
• §1.8 defines "License" as the whole instrument including Section 11; §1.4 deems SPDX-tagged files noticed (fixes the Exhibit A / Covered Software gap); §9 integration clause covers Section 11; §3.1 pass-through carries Section 11 downstream.
• §2.7 makes Section 11.3 an express condition — of the copyright grant 2.1(a) only. Contributor patent grants are deliberately not conditioned (AI legal review — license architecture & MPL-2.0 interaction (Opus cluster) #2 Q6).
• Exhibit B attached; Secondary-License distribution closed (§1.5, §3.3, §11.6) — the one-GPL-file bypass of the disclosure condition is gone, at the recorded cost of GPL-incompatibility (AI legal review — license architecture & MPL-2.0 interaction (Opus cluster) #2 Q4).
• Additional Terms renumbered to §11, ending the §2.3-vs-§2.3 collision.

§11.3 trigger and timing — steward's zero-day model made operative (#3 Q1–Q3, steward direction 2026-08-24)

• "First Sale" replaced by "Triggering Transfer": per-version and recurring (no publish-once-then-fork-forever), bound to whoever created or commissioned the modification, with carve-outs for intra-group transfers, contract manufacturers, no-copy leases, and downstream resellers; free-firmware-with-paid-product limb closes the gratis-download evasion; SaaS addressed explicitly; time-zone rule added.
• 11.3(b) standing compliance: developing in a public fork the whole time is continuous compliance — the dev period is the grace period.
• 11.3(f): publication after a transfer never retroactively authorizes — units reproduced/shipped pre-publication remain unlicensed (the infringement is on units already released) — while §5.1 reinstates prospectively. This replaces the legally-inert "no post-sale grace period" sentence with the same intent, made enforceable.
• Duration (3 years / as long as distributed), third-party-interference safe harbor (30-day republication), separate-commercial-license valve, and explicit §3.2 relationship added. Trademark clause added (§11.5).

AI-agent guidance de-legalized (#3 Q5, #4 Q8, #7)

• §11.7: guidance is informational, not part of the license, excluded from §3.4 notice integrity — the "strip the AI lines = license breach" backdoor is closed.
• LICENSE-AI-AGENT-INSTRUCTIONS.md rewritten: authorization-first (never publish unauthorized code; prepare a report and surface it to the operator instead), provenance/injection guardrails, substantiality exclusion list, "behaviorally mandatory" contradiction removed.
• New ai-policy.toml machine-readable manifest.
• NOTICE-TEMPLATE.txt cut to 3 lines with the non-notice/removable disclaimer inline; NOTICE-TEMPLATE-MIT-LEGACY.txt added for files with surviving MIT-era third-party authorship (AI legal review — First Sale trigger, remedies, MIT relicensing & AI-agent instructions (Opus cluster) #3 Q4).

RC status + review gate made mechanical (#3 Q6, #4 Q4)

• SPDX id is now LicenseRef-FastLED-Reciprocal-1.0-rc1; the bare id is reserved for the reviewed text; the former LICENSE §4 self-review prose is removed from the instrument.
• tools/license_headers.py: new header format, legacy 4-line headers upgrade automatically via old_license_ids, and update/apply refuse a non--rc id until LEGAL-REVIEW.md records Status: APPROVED. Review status and ai-policy.toml are wired into the compliance fingerprint.

Docs

• LEGAL-REVIEW.md: applied-decisions record (incl. the zero-day rationale), attorney checklist, open items (venue, sunset clause, MPL-2.0-plain comparison).
• README.md: design rationale, adoption checklist (ownership audit before apply, DCO, copyright registration, SPDX/ScanCode/FOSSA/Black Duck submissions, announcement playbook).
• PROVENANCE.md: MPL-2.0.txt retained as unmodified base for diffing only.

Verification

• uv run pytest — 22 passed (4 new tests: legacy-header upgrade, review gate rc/missing/pending/approved)
• uv run ruff check . / uv run pyright — clean
• ARTIFACTS.sha256 regenerated

Closes #2, closes #3, closes #4, closes #5. (#6/#7 are research records; #8 stays open to track attorney review.)

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 5 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d750a1f9-c9d4-4406-8c30-1a89c39184b3

📥 Commits

Reviewing files that changed from the base of the PR and between bf6ddbe and 1858314.

📒 Files selected for processing (12)

• ARTIFACTS.sha256
• LEGAL-REVIEW.md
• LICENSE
• LICENSE-AI-AGENT-INSTRUCTIONS.md
• NOTICE-TEMPLATE-MIT-LEGACY.txt
• NOTICE-TEMPLATE.txt
• PROVENANCE.md
• README.md
• ai-policy.toml
• header-policy.toml
• tests/test_license_headers.py
• tools/license_headers.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}