policy: add Rule 4 — AGPL-3.0 for network-deployed agent/service software

[hyperpolymath]

Records the category that hyperpolymath/007 now falls into, following the owner ruling of 2026-08-07 (hyperpolymath/007#76, hyperpolymath/007#82).

Why this is needed

007 moved to AGPL-3.0-or-later (code) / CC-BY-SA-4.0 (prose). Under the policy as written that is an undocumented exception: Rule 1 makes MPL-2.0 the default, and Rule 3 grants AGPL only to repositories shared with Joshua — IDApTIK, ASS, paint.type — which 007 is not. A live repository contradicting the estate policy is exactly the kind of drift this document exists to prevent, so rather than leave it unrecorded, this adds the category.

The rationale is about the category, not the repo

MPL-2.0 is file-level copyleft that triggers on distribution. Software operated behind a network boundary is never distributed, so neither MPL nor plain GPL copyleft is reached — a third party may modify it, run it as a service, and owe nothing back. AGPL §13 is the only clause in the family that closes that gap.

For a language whose programs are autonomous agents, service deployment is the normal case rather than the exception, so Rule 1 would leave its copyleft largely inoperative.

This is a distinct rationale from Rule 3, which is about co-authorship. A project may qualify under either; one is sufficient.

Deliberately narrow

Rule 4 carries a three-part scope test — all must hold:

1. The work is intended to be operated by third parties, not merely read or linked against.
2. The dominant delivery mode is a running service, agent or hosted endpoint — not a distributed artefact.
3. Reciprocity is actually wanted.

…plus an explicit instruction not to migrate libraries, tools or specifications here for symmetry. Those stay on Rule 1.

Rule 3a is unaffected and still applies: an owner-only MPL-2.0 component used inside a Rule 4 work keeps its MPL-2.0 header. MPL-2.0's default form (Exhibit A without Exhibit B) remains compatible with combination into an AGPL Larger Work.

Also in this PR

• Adds LICENSES/AGPL-3.0-or-later.txt. The estate has referenced AGPL via Rule 3 since at least 2026-06 but never carried its text — so the three Rule 3 repos had a policy pointing at a licence the canonical LICENSES/ directory did not contain.
• Updates Rule 1's cross-reference (unless Rule 2, Rule 3 or Rule 4 applies).
• Adds a Rule 4 row to the SPDX quick-reference table.
• Corrects the == Three Rules heading, now four.
• Lists paint.type alongside IDApTIK and ASS in the quick-reference table — the Rule 3 prose already named it, but the table omitted it.

Not included

I have not touched any repository's headers under this rule beyond 007, and I have not proposed moving any existing Rule 1 repo. If other repos meet the scope test, that is a separate decision per repo.

🤖 Generated with Claude Code

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review 👍 Approved with suggestions 2 resolved / 3 findings

Adds Rule 4 to establish AGPL-3.0 for network-deployed agent software, but changes are requested due to a direct contradiction with Addendum A1 on 007, an unupdated A1 override reference, and a non-verbatim SPDX line in the AGPL text file.

💡 Quality: A1's 'overrides Rules 1–3' not updated for new Rule 4

📄 LICENCE-POLICY.adoc:208-209

Addendum A1 says its 007 exclusion "overrides Rules 1–3 for 007" and A4 similarly references "Rule 3." With the addition of Rule 4, the range "Rules 1–3" is now stale and ambiguous about whether A1 also overrides Rule 4. Update the range to "Rules 1–4" (or clarify) so the override scope is unambiguous now that a fourth rule exists.

✅ 2 resolved

✅ Bug: Rule 4 directly contradicts Addendum A1 on 007

📄 LICENCE-POLICY.adoc:98-112 📄 LICENCE-POLICY.adoc:160-166 📄 LICENCE-POLICY.adoc:202-209
The new Rule 4 lists 007 as a member and adds a quick-reference row assigning it AGPL-3.0-or-later code / CC-BY-SA-4.0 prose SPDX headers. But Addendum A1 (lines 202-209) states 007 is "out of scope entirely," carries a dangerous-to-declare dual-use licence, and that agents must "Never touch, normalise, label, add SPDX to, scan, or include 007 in any report or sweep" — explicitly "This overrides Rules 1–3 for 007." A canonical policy doc whose stated purpose is preventing drift now asserts both that 007 is AGPL and that its licence must never be labelled. Resolve the conflict: either update A1 to carve out Rule 4 (and change "overrides Rules 1–3" to include Rule 4), or state which ruling governs given A1's 2026-05-18 date vs Rule 4's 2026-08-07 date.

✅ Quality: AGPL text file prepends non-verbatim SPDX line

📄 LICENSES/AGPL-3.0-or-later.txt:1-3
LICENSES/AGPL-3.0-or-later.txt begins with a SPDX-License-Identifier: AGPL-3.0-or-later line before the license body, but the sibling canonical FSF/CC texts (LICENSES/MPL-2.0.txt, LICENSES/CC-BY-SA-4.0.txt) start with the verbatim license title and carry no SPDX header. In a REUSE-style LICENSES/ directory these files are expected to be the exact license text. Consider removing the prepended SPDX line to match the existing standard-license files and keep the text verbatim.

🤖 Prompt for agents

Code Review: Adds Rule 4 to establish AGPL-3.0 for network-deployed agent software, but changes are requested due to a direct contradiction with Addendum A1 on 007, an unupdated A1 override reference, and a non-verbatim SPDX line in the AGPL text file.

1. 💡 Quality: A1's 'overrides Rules 1–3' not updated for new Rule 4
   Files: LICENCE-POLICY.adoc:208-209

   Addendum A1 says its 007 exclusion "overrides Rules 1–3 for 007" and A4 similarly references "Rule 3." With the addition of Rule 4, the range "Rules 1–3" is now stale and ambiguous about whether A1 also overrides Rule 4. Update the range to "Rules 1–4" (or clarify) so the override scope is unambiguous now that a fourth rule exists.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ This PR is blocked due to unresolved code review findings.

_{Configure merge blocking · Maintainers can dismiss this review.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud