v0.3.0: outbound Apache-2.0, remove agentic gate workflows - #542
Merged
Merged
Conversation
Delete the four agentic CI gate workflows: claude-review.yml Claude PR review (claude-code-action) gpu-gates.yml Tier-3 GPU gate (claude-code-action + self-hosted) gate-merge.yml /merge agent auto-merge, gated on gpu-gate green gate-sweep.yml backlog sweep via autoresearch.ar + codex + GPU box These never executed on the release line: every beta CI run since 2026-07-17 died at startup_failure, and both PR-triggered gates are draft-guarded while #534 is a draft. gate-merge is orphaned once gpu-gates is gone (it required a green gpu-gate check that can no longer be produced). The replacement is a cheaper, provider-agnostic reviewer rather than a repair of this stack. GPU validation is unchanged and remains manual from a checkout, per docs/VALIDATION.md and scripts/gates.sh. Also allow two permissive licenses that cargo-deny rejects on the current dependency graph, both first observed once CI could actually start: BSD-3-Clause subtle 2.6.1 <- rustls 0.23 CDLA-Permissive-2.0 webpki-roots 1.0.7 <- ureq 3.3 <- hipfire-cli Both are Apache-2.0-compatible and notice-retention only. The second arrived with the Rust control-plane rewrite; the blocking `cargo-deny (bans licenses sources)` job had no way to report it while the workflow was failing at startup. Claude-Session: https://claude.ai/code/session_01H5JjVKznrxNzyJNq7rTNRp
v0.3.0 is the first Apache-only release. The license offered for the
work as a whole moves from "MIT OR Apache-2.0, at the recipient's
option" to Apache-2.0.
This is deliberately NOT a repeat of 79167568, the unilateral
whole-codebase relicense that the 2026-05-19 course correction
reverted. No contributor's work is relicensed in absentia:
* No per-file SPDX-License-Identifier is rewritten. The tree keeps
its authorship-derived tags: 1073 Apache-2.0, 69 MIT OR
Apache-2.0, 48 MIT.
* LICENSE-MIT is retained and remains the operative grant for every
MIT-tagged file.
* Issue #305 stays the only mechanism for changing those tags.
* v0.2.1 and earlier remain dual-licensed; that grant is
irrevocable.
The legal basis is unchanged from the original decision record: MIT's
conditions are a strict subset of Apache-2.0 § 4, and the ASF lists
MIT/X11 as Category A, freely combinable into an Apache-2.0 work.
Offering the aggregate under Apache-2.0 grants no rights contributors
did not already grant. What recipients lose is the option to take the
whole work under MIT — a downstream-consumer change, not a
contributor-rights change.
Also corrects two pre-existing manifest bugs found on the way:
* workspace Cargo.toml declared license = "MIT", under-declaring
even the then-current dual posture.
* redline-dispatch and redline-rocr pinned "MIT OR Apache-2.0"
while every source file in both carries SPDX Apache-2.0 and both
crates are 100% Kaden-authored. Now inherit from the workspace.
All 29 workspace crates now report Apache-2.0 via cargo metadata.
Claude-Session: https://claude.ai/code/session_01H5JjVKznrxNzyJNq7rTNRp
Kaden-Schutt
changed the title
The repo moved Kaden-Schutt/hipfire -> warpfront/hipfire. GitHub still
redirects, so nothing is broken today — but that redirect only holds
while no repo named `hipfire` is recreated under the old user
namespace, and shipping `curl | bash` installers aimed at a namespace
the project no longer canonically owns is not a posture to release on.
Load-bearing sites corrected (these make real network calls):
crates/hipfire-registry/src/lib.rs registry v1.json fetch URL
scripts/install.sh, install.ps1 GITHUB_REPO / release assets
scripts/force-update.ps1 self-update fetch
scripts/uninstall.sh documented curl usage
nix/module.nix github.owner fetch default
Plus user-facing docs, skills, and CHANGELOG/README/CITATION links.
Two deliberate non-changes:
* scripts/uninstall.sh `source_is_managed()` now matches BOTH
namespaces. Installs predating the transfer still carry the old
origin, and a blind rewrite would make `uninstall` silently
refuse to clean up every one of them. Covered by a new regression
test in scripts/test_uninstall.py that fails (2 subtests) when the
legacy entries are removed.
* `Kaden-Schutt` as a GitHub *username* is left alone: the
autoresearch maintainer/auto-merge lists, the governance decision
record, and scripts/refresh-credits.sh `OWNER_LOGIN`, which uses it
as `select(.author.login != $owner)` to exclude Kaden's own PRs
from the contributors block. Rewriting that one would list the
maintainer as a third-party contributor.
Historical devlogs, plans, and perf checkpoints keep their original
references.
Claude-Session: https://claude.ai/code/session_01H5JjVKznrxNzyJNq7rTNRp
CI checks rustfmt on CHANGED files only, so touching these three pulled their pre-existing format debt into the gate. Formatted with scripts/fmt-changed.sh (BASE_REF=origin/beta), not bare `cargo fmt`. No semantic change; cargo check clean. Claude-Session: https://claude.ai/code/session_01H5JjVKznrxNzyJNq7rTNRp
Kaden-Schutt
marked this pull request as ready for review
July 26, 2026 08:52
fivetide
pushed a commit
to fivetide/hipfire
that referenced
this pull request
Aug 29, 2026
…#542) Apache-2.0 becomes the license offered for the work as a whole. No contributor file is relicensed in absentia: every per-file SPDX tag is unchanged (1073 Apache-2.0 / 69 dual / 48 MIT), LICENSE-MIT is retained as the operative grant for MIT-tagged files, and warpfront#305 remains the only mechanism for changing them. v0.2.1 and earlier stay dual-licensed. Recorded in docs/governance/relicense-2026-05.md. Fixes two manifest bugs: the workspace declared license = "MIT" (under-declaring even the dual posture), and redline-dispatch / redline-rocr pinned "MIT OR Apache-2.0" despite every source file in both carrying SPDX Apache-2.0. All 29 crates now report Apache-2.0. Removes the four agentic gate workflows (claude-review, gpu-gates, gate-merge, gate-sweep). None reached the release line: every beta CI run since 2026-07-17 died at startup_failure, and both PR-triggered gates are draft-guarded. GPU validation is unchanged and remains manual per docs/VALIDATION.md. Allows BSD-3-Clause (subtle <- rustls) and CDLA-Permissive-2.0 (webpki-roots <- ureq <- hipfire-cli), which cargo-deny rejected once CI could actually start. Both Apache-2.0-compatible, notice-retention only. This unblocks the blocking supply-chain job on warpfront#534. Points canonical URLs at warpfront/hipfire after the org transfer, including the registry fetch URL and all installers. uninstall.sh deliberately still recognizes the old Kaden-Schutt origin so pre-transfer installs remain cleanable; covered by a new regression test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three changes against
beta, all prerequisites for the v0.3.0 promotion.1. Apache-2.0 becomes the outbound license
v0.3.0 is the first Apache-only release. The license offered for the work as a whole moves from "MIT OR Apache-2.0, at the recipient's option" to Apache-2.0.
This is deliberately not a repeat of
79167568, the unilateral whole-codebase relicense that the 2026-05-19 course correction reverted. No contributor's work is relicensed in absentia:SPDX-License-Identifieris rewritten. The tree keeps its authorship-derived tags: 1073Apache-2.0, 69MIT OR Apache-2.0, 48MIT.LICENSE-MITis retained and remains the operative grant for every MIT-tagged file.Legal basis is unchanged from the existing decision record: MIT's conditions are a strict subset of Apache-2.0 § 4, and the ASF lists MIT/X11 as Category A, freely combinable into an Apache-2.0 work. Offering the aggregate under Apache-2.0 grants no rights contributors did not already grant. What recipients lose is the option to take the whole work under MIT — a downstream-consumer change, not a contributor-rights change.
Recorded in
docs/governance/relicense-2026-05.mdunder "Outbound Apache-2.0 for v0.3.0".Two pre-existing manifest bugs fixed on the way:
Cargo.tomllicense = "MIT"— under-declared even the dual postureApache-2.0redline-dispatch,redline-rocr"MIT OR Apache-2.0"despite every source file carrying SPDXApache-2.0, and both being 100% Kaden-authoredlicense.workspace = trueAll 29 workspace crates now report
Apache-2.0viacargo metadata.2. Remove the four agentic gate workflows
claude-review.ymlclaude-code-actiongpu-gates.ymlclaude-code-action+ self-hosted GPU runnersgate-merge.yml/mergeagent auto-merge, gated on a green gpu-gategate-sweep.ymlautoresearch.ar gate --sweep+ codex + GPU boxNone reached the release line: every
betaCI run since 2026-07-17 ended instartup_failure, and both PR-triggered gates are draft-guarded (if: !draft) while #534 is a draft.gate-mergeis orphaned oncegpu-gatesis gone — it required a greengpu-gatecheck that can no longer be produced.GPU validation is unchanged: still manual per
docs/VALIDATION.mdandscripts/gates.sh. Remaining workflows:ci.yml,no-gpu-ci.yml,registry.yml.3. Allow two permissive dependency licenses
Surfaced only once the workflow could start — the Actions allowlist was missing
EmbarkStudios/cargo-deny-action@*, so the file was rejected before any job ran:subtle2.6.1BSD-3-Clauserustls0.23webpki-roots1.0.7CDLA-Permissive-2.0ureq3.3 →hipfire-cliBoth Apache-2.0-compatible, notice-retention only.
cargo-deny (bans licenses sources)is blocking (onlyadvisoriesiscontinue-on-error), so this was red-on-arrival for #534.Follow-up
A pure Apache-2.0 tree needs #305 strengthened — it currently asks for MIT to
MIT OR Apache-2.0, which is not sufficient. Affected copyright holders across the 119 MIT/dual files: @fivetide, alpineq, Robin Van Cauter, nickfinease, mad-lab-kbando, Grégory D, Daniil Markevich.Test plan
cargo metadata --lockedclean, lockfile unchangedcargo check --workspace --lockedcleanCITATION.cffparses;license: Apache-2.0,version: 0.3.0cargo-deny (bans licenses sources)green