chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

decnet/web/router/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from fastapi import APIRouter
 
 from .auth.api_login import router as login_router

decnet/web/router/attackers/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/attackers/_guards.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Shared helpers for the per-attacker routes.
 
 Currently houses the 404 guard used by the SSE events stream

decnet/web/router/attackers/api_events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE stream of per-attacker behavioural events — one connection per
 AttackerDetail page.
 

decnet/web/router/attackers/api_export_attacker_misp.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/attackers/{uuid}/export/misp — MISP event for one attacker.
 
 Converts the attacker's STIX 2.1 bundle to a MISP event JSON file via

decnet/web/router/attackers/api_export_attacker_stix.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/attackers/{uuid}/export/stix — STIX 2.1 bundle for one attacker.
 
 Returns a self-contained STIX 2.1 Bundle with the attacker's IP

decnet/web/router/attackers/api_export_attackers.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/attackers/export — bulk JSON export of all attacker + intel data."""
 import json
 from datetime import datetime, timezone

decnet/web/router/attackers/api_export_attackers_misp.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/attackers/export/misp — fleet-wide MISP collection.
 
 Returns a MISP collection JSON ({"response": [event, ...]}) with one event

decnet/web/router/attackers/api_export_attackers_stix.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/attackers/export/stix — fleet-wide STIX 2.1 bundle.
 
 Returns a self-contained STIX 2.1 Bundle covering every attacker the

decnet/web/router/attackers/api_get_attacker_artifacts.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException

decnet/web/router/attackers/api_get_attacker_attribution.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/attackers/{uuid}/attribution — per-primitive
 attribution state for one attacker.
 

decnet/web/router/attackers/api_get_attacker_commands.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from typing import Any, Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query

decnet/web/router/attackers/api_get_attacker_detail.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException

decnet/web/router/attackers/api_get_attacker_intel.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/attackers/{uuid}/intel — latest threat-intel row for an attacker."""
 from typing import Any
 

decnet/web/router/attackers/api_get_attacker_mail.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException

decnet/web/router/attackers/api_get_attacker_smtp_targets.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException

decnet/web/router/attackers/api_get_attacker_transcripts.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException

decnet/web/router/attackers/api_get_attackers.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/auth/api_change_pass.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from typing import Any, Optional
 
 from fastapi import APIRouter, Depends, HTTPException, status

decnet/web/router/auth/api_login.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from datetime import timedelta
 from typing import Any, Optional
 

decnet/web/router/bounty/api_get_bounties.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/campaigns/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/campaigns/api_events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE stream of campaign events — one connection per viewer.
 
 Subscribes to ``campaign.>`` on the bus for the duration of the

decnet/web/router/campaigns/api_get_campaign_detail.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/campaigns/{uuid} — single campaign row.
 
 Soft-merge handling: if the requested UUID has merged_into_uuid set,

decnet/web/router/campaigns/api_list_campaign_identities.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/campaigns/{uuid}/identities — identities for a campaign.
 
 Returns the ``AttackerIdentity`` rows whose ``campaign_id`` FK points

decnet/web/router/campaigns/api_list_campaigns.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/campaigns — paginated list of campaigns.
 
 Mirror of :mod:`decnet.web.router.identities.api_list_identities` for

decnet/web/router/canary/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Canary tokens — operator-facing CRUD.
 
 Mounted under ``/api/v1/canary``.  Covers:

decnet/web/router/canary/api_blobs.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Operator-uploaded canary blob CRUD.
 
 Three endpoints:

decnet/web/router/canary/api_tokens.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Operator-facing canary token CRUD.
 
 Every body-bearing route documents the 400 error per

decnet/web/router/config/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/config/api_get_config.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/config/api_manage_users.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import uuid as _uuid
 
 from fastapi import APIRouter, Depends, HTTPException

decnet/web/router/config/api_reinit.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from fastapi import APIRouter, Depends, HTTPException
 
 from decnet.env import DECNET_DEVELOPER

decnet/web/router/config/api_update_config.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from fastapi import APIRouter, Depends
 
 from decnet.telemetry import traced as _traced

decnet/web/router/credential_reuse/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/credential_reuse/api_get_credential_reuse.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from typing import Any, Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query

decnet/web/router/credentials/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/credentials/api_get_credentials.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/deckies/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Cross-cutting decky operation endpoints.
 
 These routes apply to both fleet and MazeNET (topology) deckies; the

decnet/web/router/deckies/api_file_drop.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST/DELETE /api/v1/deckies/files — generic file drops on deckies.
 
 Wraps :func:`decnet.decky_io.write_file_to_container` /

decnet/web/router/deckies/api_services.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST/DELETE …/{decky}/services — live service add/remove.
 
 Two scopes mounted here:

decnet/web/router/deckies/api_tarpit.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST/GET/DELETE /api/v1/deckies/{decky_name}/tarpit — per-decky tc netem tarpit.
 
 Applies port-selective traffic delay on the host veth paired to the target

decnet/web/router/fleet/api_deploy_deckies.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import os
 

decnet/web/router/fleet/api_get_deckies.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/fleet/api_lifecycle.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /deckies/lifecycle?ids=… — poll lifecycle rows by id.
 
 The wizard polls this endpoint every ~2 s after POSTing /deckies/deploy

decnet/web/router/fleet/api_mutate_decky.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /deckies/{name}/mutate — operator-triggered single-decky mutate.
 
 Returns 202 Accepted with one ``lifecycle_id`` per mutated decky.  The

decnet/web/router/fleet/api_mutate_interval.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from fastapi import APIRouter, Depends, HTTPException
 
 from decnet.telemetry import traced as _traced

decnet/web/router/health/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/health/api_get_health.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/identities/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/identities/api_events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE stream of identity-resolution events — one connection per viewer.
 
 Subscribes to ``identity.>`` on the :class:`~decnet.bus.base.BaseBus` for

decnet/web/router/identities/api_get_identity_detail.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/identities/{uuid} — single identity row.
 
 Soft-merge handling: if the requested UUID has merged_into_uuid set,

decnet/web/router/identities/api_list_identities.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/identities — paginated list of resolved identities.
 
 Returns an empty list while the clusterer hasn't run yet (the

decnet/web/router/identities/api_list_identity_observations.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/identities/{uuid}/observations — observations for an identity.
 
 Returns the per-IP ``Attacker`` rows whose ``identity_id`` FK points at

decnet/web/router/logs/api_get_histogram.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/logs/api_get_logs.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/orchestrator/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/orchestrator/api_event_stats.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/orchestrator/events/stats — authoritative failure count.
 
 The dashboard's failure-count badge previously derived its number from

decnet/web/router/orchestrator/api_events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE stream of orchestrator events.
 
 Subscribes to ``orchestrator.>`` for the duration of the request and

decnet/web/router/orchestrator/api_list_events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/orchestrator/events — paginated orchestrator activity.
 
 Two underlying tables back this endpoint:

decnet/web/router/realism/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

decnet/web/router/realism/api_config.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET/PUT ``/api/v1/realism/config`` — operator-tunable realism knobs.
 
 Today only the planner's content-class weights + canary probability

decnet/web/router/realism/api_llm.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET/PUT ``/api/v1/realism/llm`` — LLM provider configuration.
 
 Reads accept viewer; writes are admin (same trust level as the existing

decnet/web/router/realism/api_personas.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET/PUT ``/api/v1/realism/personas`` — global persona pool CRUD.
 
 The "global pool" is a JSON file consumed by the realism content

decnet/web/router/realism/api_synthetic_files.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET ``/api/v1/realism/synthetic-files`` — browse planted realism files.
 
 The orchestrator's realism worker grows synthetic files on each decky

decnet/web/router/stats/api_get_stats.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 import time
 from typing import Any, Optional

decnet/web/router/stream/api_stream_events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 
 import orjson

decnet/web/router/swarm/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Swarm controller routers.
 
 One file per endpoint, aggregated under the ``/swarm`` prefix. Mounted

decnet/web/router/swarm/api_check_hosts.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm/check — active mTLS probe of every enrolled worker.
 
 Updates ``SwarmHost.status`` and ``last_heartbeat`` for each host based

decnet/web/router/swarm/api_decommission_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """DELETE /swarm/hosts/{uuid} — decommission a worker.
 
 Removes the DeckyShard rows bound to the host (portable cascade — MySQL

decnet/web/router/swarm/api_deploy_swarm.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm/deploy — shard a DecnetConfig across enrolled workers.
 
 Per worker we build a filtered copy containing only the deckies assigned

decnet/web/router/swarm/api_enroll_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm/enroll — issue a worker cert bundle and register the host.
 
 Enrollment is master-driven: the controller holds the CA private key,

decnet/web/router/swarm/api_get_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /swarm/hosts/{uuid} — fetch a single worker by UUID."""
 from __future__ import annotations
 

decnet/web/router/swarm/api_get_swarm_health.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /swarm/health — controller liveness (no I/O)."""
 from __future__ import annotations
 

decnet/web/router/swarm/api_heartbeat.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm/heartbeat — agent→master liveness + decky snapshot refresh.
 
 Workers call this every ~30 s with the output of ``executor.status()``.

decnet/web/router/swarm/api_list_deckies.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /swarm/deckies — list decky shards with their worker host's identity.
 
 The DeckyShard table maps decky_name → host_uuid; users want to see which

decnet/web/router/swarm/api_list_hosts.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /swarm/hosts — list enrolled workers, optionally filtered by status."""
 from __future__ import annotations
 

decnet/web/router/swarm/api_teardown_swarm.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm/teardown — tear down one or all enrolled workers."""
 from __future__ import annotations
 

decnet/web/router/swarm_mgmt/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Swarm management endpoints for the React dashboard.
 
 These are *not* the unauthenticated /swarm routes mounted on the separate

decnet/web/router/swarm_mgmt/api_decommission_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """DELETE /swarm/hosts/{uuid} — decommission a worker from the dashboard.
 
 Also instructs the worker agent to stop all DECNET services and delete

decnet/web/router/swarm_mgmt/api_enroll_bundle.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Agent-enrollment bundles — the Wazuh-style one-liner flow.
 
 Three endpoints:

decnet/web/router/swarm_mgmt/api_list_deckies.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /swarm/deckies — admin-gated list of decky shards across the fleet."""
 from __future__ import annotations
 

decnet/web/router/swarm_mgmt/api_list_hosts.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /swarm/hosts — admin-gated list of enrolled workers for the dashboard.
 
 Fans out an ``AgentClient.health()`` probe to each host on every call and

decnet/web/router/swarm_mgmt/api_teardown_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm/hosts/{uuid}/teardown — remote teardown on a swarm worker.
 
 Body: ``{"decky_id": "..."}`` (optional). When ``decky_id`` is null/omitted

decnet/web/router/swarm_updates/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Remote Updates — master dashboard's surface for pushing code to workers.
 
 These are *not* the swarm-controller's /swarm routes (those run on a

decnet/web/router/swarm_updates/api_list_host_releases.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /swarm-updates/hosts — per-host updater health + release slots.
 
 Fans out an ``UpdaterClient.health()`` probe to every enrolled host that

decnet/web/router/swarm_updates/api_push_update.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm-updates/push — fan a tarball of the master's tree to workers.
 
 Mirrors the ``decnet swarm update`` CLI flow: build the tarball once,

decnet/web/router/swarm_updates/api_push_update_self.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm-updates/push-self — push only to workers' /update-self.
 
 Use case: the agent is fine but the updater itself needs an upgrade (e.g.

decnet/web/router/swarm_updates/api_rollback_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm-updates/rollback — manual rollback on a single host.
 
 Calls the worker updater's ``/rollback`` which swaps the ``current``

decnet/web/router/system/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 from fastapi import APIRouter
 
 from .api_deployment_mode import router as deployment_mode_router

decnet/web/router/system/api_deployment_mode.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /system/deployment-mode — tells the UI whether a deploy will shard
 across SWARM workers or land on the master itself.
 

decnet/web/router/topology/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """MazeNET topology REST endpoints (phase 3).
 
 Thin FastAPI layer over the phase-2 topology machinery:

decnet/web/router/topology/_guards.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Shared helpers for the Phase-3 child-CRUD routes."""
 from __future__ import annotations
 

decnet/web/router/topology/_target_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Shared validation for the ``mode`` / ``target_host_uuid`` pair.
 
 Called by the two topology-create endpoints

decnet/web/router/topology/api_catalog.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Read-only catalog endpoints — services, next-subnet, next-ip.
 
 These wrap fleet/allocator helpers so the phase-4 canvas UI can lean

decnet/web/router/topology/api_create_blank_topology.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /topologies/blank — create an empty editable topology.
 
 Produces a minimal ``pending`` topology seeded with exactly one DMZ LAN

decnet/web/router/topology/api_create_topology.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /topologies — generate and persist a new MazeNET topology."""
 from __future__ import annotations
 

decnet/web/router/topology/api_decky_crud.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Decky CRUD endpoints — pending-only child mutations.
 
     POST   /topologies/{id}/deckies

decnet/web/router/topology/api_delete_topology.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """DELETE /topologies/{id} — cascade-delete a pending or torn-down topology."""
 from __future__ import annotations
 

decnet/web/router/topology/api_deploy_topology.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /topologies/{id}/deploy — transition pending → deploying and fire
 the background deploy.