chore: relicense from GPL-3.0 to dual MIT OR Apache-2.0

[jacderida]

Linear issue

V2-849 (rollout) / V2-850 (the licensing decision)

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Compatibility

• Wire: none
• Storage: none
• API: none

Semver impact

• breaking
• feature
• fix

Test evidence

cargo check passes and cargo fmt --all --check is clean. No source logic was changed — only licence-grant comment headers and package metadata.

New dependency

none

ADR

n/a

Mitigation / rollback

Revert the PR to restore the previous licence terms in the repository. Note that reverting does not retract a grant already made: anyone who took a copy while the permissive licence was published keeps those rights for that copy. This is inherent to relicensing, not to this change.

What changed

Implements the licensing decision on V2-850 — MIT OR Apache-2.0 across all WithAutonomi repositories, moving off copyleft so anyone can build on the code, including in proprietary work.

LICENSE-MIT and LICENSE-APACHE added at the repo root, copyright The Autonomi Foundation S/A.

Relicensed from GPL-3.0 with a linking exception. The GPL was declared in eight places plus a five-line grant in the header of 17 source files: LICENSE, Cargo.toml, nodejs/Cargo.toml, nodejs/package.json, pyproject.toml (licence key and the PyPI classifier advertising GPLv3), the README's License and Linking Exception sections, and the deny.toml allow list.

The Linking Exception section was removed rather than updated — it existed only to soften GPLv3, and a permissive licence already grants everything it carved out. "GPL-3.0" was dropped from deny.toml's dependency allow list; verified no dependency needs it (the only GPL-adjacent entry is r-efi, which is MIT OR Apache-2.0 OR LGPL-2.1-or-later and resolves permissively).

This repository has 58 contributors and no CLA or DCO in the tree. Relicensing requires the agreement of everyone holding copyright. If all contributors were MaidSafe employees this is work-for-hire and straightforward; the list spans a decade and should be confirmed by someone who can actually answer it.

---

The reason for using MIT/Apache-2.0 and moving away from GPL 3.0 is purely allowing anyone to build anything from our code, even proprietary etc. if we are GPL we insist their projects must be GPL as well.

Bottom line, builders want it.

Per-file copyright attributions were left as they are throughout — they record who held copyright when the code was written. Only the licence grant text changed.

[jacderida]

Merging this without waiting for an approving review.

The decision to move to dual MIT OR Apache-2.0 has already been confirmed and is recorded on V2-850, along with the reasoning — we want people to be able to build anything on our code, including proprietary work, which copyleft prevents. The copyright holder (The Autonomi Foundation S/A) was confirmed at the same time.

This PR is one of 17 applying that decision across the org. There is no code change to review: licence files, package metadata, and licence-grant comment headers only. The substantive question here was the licensing choice itself, and that has been settled off the PR rather than in it.

Flagging it explicitly so the merge without a review is on the record rather than looking like an oversight.