chore: relicense to AGPL-3.0-or-later and add SPDX headers

Replaces LICENSE (GPLv3 -> AGPLv3) and prepends
`SPDX-License-Identifier: AGPL-3.0-or-later` to every source file
across decnet/, decnet_web/, tests/, scripts/, and tools/.

Rationale: closes the GPLv3 ASP loophole so any party operating a
modified DECNET as a network service must offer their modified
source. Personal copyright (Samuel Paschuan) + inbound=outbound
contributions make a future unilateral relicense infeasible.

- LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt)
- COPYRIGHT: project copyright notice
- tools/add_spdx_headers.py: idempotent header injector
  (shebang- and PEP 263-aware)

Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh).
No behavior change; comments only.

tests/api/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/attackers/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/attackers/test_attribution_endpoint.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 6 — GET /api/v1/attackers/{uuid}/attribution.
 
 Pins the contract: 401 unauth, 404 unknown attacker, 200 with empty

tests/api/attackers/test_events_stream.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE events stream — GET /attackers/{uuid}/events (Phase 5).
 
 Mirrors the topology events test pattern at

tests/api/auth/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/auth/test_change_pass.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import json
 import pytest
 from hypothesis import given, strategies as st, settings

tests/api/auth/test_login.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import json
 import pytest
 from hypothesis import given, strategies as st, settings

tests/api/bounty/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/bounty/test_get_bounties.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 import httpx
 from hypothesis import given, settings, strategies as st

tests/api/campaigns/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/campaigns/test_events_stream.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE events stream — GET /api/v1/campaigns/events.
 
 Mirror of :mod:`tests.api.identities.test_events_stream`. Drives the

tests/api/canary/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/canary/test_canary_tokens_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """End-to-end coverage for /api/v1/canary/* via the live FastAPI app.
 
 The planter's docker-exec call is patched so we don't need a real

tests/api/config/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/config/conftest.py

@@ -1 +1,2 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # viewer_token fixture is now in tests/api/conftest.py (shared across all API tests)

tests/api/config/test_deploy_limit.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 from unittest.mock import patch
 

tests/api/config/test_get_config.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 
 

tests/api/config/test_reinit.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 
 from decnet.web.dependencies import repo

tests/api/config/test_update_config.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 
 

tests/api/config/test_user_management.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 
 

tests/api/conftest.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import os
 import json
 import uuid as _uuid

tests/api/credential_reuse/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/credential_reuse/test_get_credential_reuse.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Read-only ``/credential-reuse`` API tests.
 
 Mirrors ``tests/api/credentials/test_get_credentials.py`` for the

tests/api/credentials/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/credentials/test_get_credentials.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 import httpx
 from hypothesis import given, settings, strategies as st

tests/api/deckies/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/deckies/test_file_drop_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """End-to-end coverage for /api/v1/deckies/files via the live FastAPI app.
 
 The docker subprocess is stubbed; everything else (DB, repo, auth)

tests/api/deckies/test_service_config_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """API coverage for /services/{name}/schema + per-decky config PUT/POST.
 
 Engine layer is patched so the tests don't touch docker; auth + routing

tests/api/deckies/test_services_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """End-to-end coverage for the live service add/remove endpoints.
 
 Covers both scopes:

tests/api/fleet/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/fleet/test_deploy_additive.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /deckies/deploy additive vs replace_fleet semantics.
 
 Default behaviour (replace_fleet=False) appends the INI to the existing

tests/api/fleet/test_deploy_automode.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /deckies/deploy auto-mode: master + swarm hosts → shard to workers."""
 from __future__ import annotations
 

tests/api/fleet/test_get_deckies.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 import httpx
 from hypothesis import given, settings, strategies as st

tests/api/fleet/test_lifecycle_endpoint.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /deckies/lifecycle?ids=… — poll endpoint for the wizard."""
 from __future__ import annotations
 

tests/api/fleet/test_mutate_decky.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Tests for the mutate decky API endpoint — now 202 fire-and-forget.
 

tests/api/fleet/test_mutate_interval.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Tests for the mutate interval API endpoint.
 """

tests/api/health/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/health/test_get_health.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import asyncio
 from unittest.mock import AsyncMock, MagicMock, patch
 

tests/api/identities/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/identities/test_events_stream.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE events stream — GET /api/v1/identities/events.
 
 Mirrors :mod:`tests.api.topology.test_events_stream` — the route is

tests/api/logs/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/logs/test_get_logs.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 import httpx
 from typing import Any, Optional

tests/api/logs/test_histogram.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Histogram bucketing tests using freezegun.
 

tests/api/orchestrator/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/orchestrator/test_event_stats.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/orchestrator/events/stats — failure-count badge endpoint (DEBT-042)."""
 from __future__ import annotations
 

tests/api/orchestrator/test_events_stream.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE events stream + list — /api/v1/orchestrator/events{,/stream}."""
 from __future__ import annotations
 

tests/api/realism/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/realism/test_config_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET/PUT /api/v1/realism/config — operator-tunable weights."""
 from __future__ import annotations
 

tests/api/realism/test_personas_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET/PUT /api/v1/realism/personas — global persona pool CRUD."""
 from __future__ import annotations
 

tests/api/realism/test_synthetic_files_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/realism/synthetic-files — paginated browser API."""
 from __future__ import annotations
 

tests/api/stats/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/stats/test_get_stats.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 import pytest
 import httpx
 from ..conftest import _FUZZ_SETTINGS

tests/api/stream/__init__.py

@@ -1 +1,2 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # Stream test package

tests/api/stream/test_stream_events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Tests for the SSE stream endpoint (decnet/web/router/stream/api_stream_events.py).
 """

tests/api/swarm_mgmt/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/swarm_mgmt/test_enroll_bundle.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Agent-enrollment bundle flow: POST → .sh → .tgz (one-shot, TTL, races)."""
 from __future__ import annotations
 

tests/api/swarm_mgmt/test_teardown_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /swarm/hosts/{uuid}/teardown — per-host and per-decky remote teardown."""
 from __future__ import annotations
 

tests/api/swarm_updates/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/swarm_updates/conftest.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Shared fixtures for /api/v1/swarm-updates tests.
 
 The tests never talk to a real worker — ``UpdaterClient`` is monkeypatched

tests/api/swarm_updates/test_list_host_releases.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/swarm-updates/hosts — per-host updater health fan-out."""
 from __future__ import annotations
 

tests/api/swarm_updates/test_push_update.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /api/v1/swarm-updates/push — happy paths, rollback, validation."""
 from __future__ import annotations
 

tests/api/swarm_updates/test_push_update_self.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /api/v1/swarm-updates/push-self — updater-only upgrade path."""
 from __future__ import annotations
 

tests/api/swarm_updates/test_rollback_host.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """POST /api/v1/swarm-updates/rollback — single-host manual rollback."""
 from __future__ import annotations
 

tests/api/test_error_handler.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for the generic Exception handler at decnet/web/api.py.
 
 Mitigation target: threat model F1/I — "Production error handler suppresses

tests/api/test_rbac.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """RBAC matrix tests — verify role enforcement on every API endpoint."""
 import pytest
 

tests/api/test_rbac_contract.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 RBAC contract test — every route is classified by server-side dependency
 introspection and exercised with a viewer JWT.

tests/api/test_repository.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Direct async tests for the configured Repository implementation.
 These exercise the DB layer without going through the HTTP stack.

tests/api/test_schemathesis.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Schemathesis contract tests — full compliance, all checks enabled.
 

tests/api/test_schemathesis_agent.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Schemathesis contract tests for the worker-side agent API
 (``decnet.agent.app``).
 

tests/api/test_schemathesis_swarm.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Schemathesis contract tests for the swarm-controller API
 (``decnet.web.swarm_api``).
 

tests/api/test_schemathesis_ttp.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Schemathesis contract tests scoped to the TTP Tagging API surface.
 
 E.3.17 of ``development/TTP_TAGGING.md``. The full ``test_schemathesis``

tests/api/test_sse_limits.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Per-user SSE connection cap — F6/D mitigation."""
 import pytest
 from fastapi import HTTPException

tests/api/topology/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/topology/test_child_crud.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 3 Step 4 — child CRUD: LAN / decky / edge."""
 from __future__ import annotations
 

tests/api/topology/test_events_stream.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """SSE events stream — GET /topologies/{id}/events (DEBT-030)."""
 from __future__ import annotations
 

tests/api/topology/test_models.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 3 Step 1 — parity between repo dict output and Pydantic DTOs.
 
 These tests pin the contract that repo-hydrated dicts deserialize

tests/api/topology/test_mutations.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 3 Step 5 — live mutation queue endpoints."""
 from __future__ import annotations
 

tests/api/topology/test_personas_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Per-topology persona endpoints — GET/PUT /topologies/{id}/personas."""
 from __future__ import annotations
 

tests/api/topology/test_reads.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 3 Step 2 — read endpoints: list / get / status-events / catalog."""
 from __future__ import annotations
 

tests/api/topology/test_writes.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Phase 3 Step 3 — write endpoints: create / delete / deploy."""
 from __future__ import annotations
 

tests/api/transcripts/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/transcripts/test_get_transcript.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """
 Tests for GET /api/v1/transcripts/{decky}/{sid}.
 

tests/api/ttp/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/ttp/conftest.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Shared helpers for TTP API contract tests (E.2.8).
 
 The base ``tests/api/conftest.py`` already provides ``client``,

tests/api/ttp/test_get_endpoints.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """E.2.8 — GET endpoint shape + auth contract for /api/v1/ttp/*.
 
 The TTP router landed at E.1.9 (contract phase) returning typed

tests/api/ttp/test_response_schemas.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """E.2.8 — Response-schema stability via golden fixtures.
 
 The OpenAPI schema for each TTP endpoint is captured under

tests/api/ttp/test_rules_catalogue.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/ttp/rules returns the live rule catalogue.
 
 Pins the runtime fix that replaced the contract-phase ``return []``

tests/api/ttp/test_rules_state.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """E.2.8 — Admin-only mutation endpoints for /api/v1/ttp/rules/{id}/state.
 
 The two mutation endpoints (POST / DELETE) carry the rule

tests/api/ttp/test_tag_details.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """GET /api/v1/ttp/tags/by-{scope}/{uuid}/{technique_id}.
 
 Pins the operator inspector endpoint that surfaces the rule engine's

tests/api/webhooks/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/webhooks/test_crud.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """CRUD tests for /api/v1/webhooks — admin-gated subscription management."""
 from __future__ import annotations
 

tests/api/workers/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

tests/api/workers/test_start_workers.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for ``POST /api/v1/workers/{name}/start`` + ``start-all``.
 
 Uses the shared ``client`` / ``auth_token`` / ``viewer_token`` fixtures

tests/api/workers/test_workers_api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 """Tests for the Workers panel API endpoints.
 
 Covers ``GET /api/v1/workers`` (viewer-readable, always surfaces every