From 933e4f5c6b41831f5799750927a5c07421e63491 Mon Sep 17 00:00:00 2001 From: RNT56 Date: Thu, 9 Jul 2026 09:35:21 +0200 Subject: [PATCH] chore: add Apache 2.0 license --- CHANGELOG.md | 2 + LICENSE | 202 +++++++++++++++++++++++++++++++++++++++++++++++++++ NOTICE | 6 ++ README.md | 7 ++ 4 files changed, 217 insertions(+) create mode 100644 LICENSE create mode 100644 NOTICE diff --git a/CHANGELOG.md b/CHANGELOG.md index 9a081c6..9535a3c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,8 @@ On a release, the maintainer moves the accumulated `[Unreleased]` entries into a ## [Unreleased] +- **chore(license-apache-2.0)** — Add the Apache License 2.0, an RNT56/NilCore NOTICE attribution, and README license badge/section. _Owns:_ `LICENSE`, `NOTICE`, `README.md`, `CHANGELOG.md`. _(docs)_ + - **chore(e2e-audit-remediation): full end-to-end audit → fix every finding, then adversarially review the assembled diff.** A 17-subsystem Opus audit (each MEDIUM+ finding re-verified by 1–2 refute-by-default skeptics; 7 refuted) surfaced **0 CRITICAL, 26 confirmed findings (2 HIGH)** against `main`; all are fixed here, each with a discriminating test. **HIGH:** (1) the OpenAI/OpenRouter SSE assembler silently swallowed an in-band `data:{"error":…}` frame (and an EOF-without-`[DONE]` carrying no content) as a nil-error empty/partial success, defeating retry/failover — it now surfaces a typed, retryable-vs-terminal-classified `*model.APIError` like the Anthropic path; (2) an unvalidated SKILL.md frontmatter `name` became the `skill_` API tool name, so one malformed installed skill 400'd EVERY model call of every run — the name is now sanitized/validated at load, the `Defs()` boundary skips+warns any tool violating `^[a-zA-Z0-9_-]{1,64}$` (legit builtins unaffected), and `registry.InstallSkill` validates at install. **Confirmed clusters fixed:** *silent-failure bugs* — `scheduler.Submit` deadlock on >1024 tasks submitted pre-Start (→ unbounded cond-queue, FIFO/bounded-concurrency preserved); a swallowed `wt.Commit` fault stranding a verified green shard as a false-green (→ surfaced not-done); `resilience.Stream` double-paint across a retry (→ concat(forwarded)==returned invariant preserved); the MCP `Manager` single-flight binding the shared connect to one caller's ctx and poisoning a concurrent peer (→ detached connect ctx). *Dead-as-advertised closed-loop features* — trusted-preset Deploy auto-approval unreachable; chat `/apply` trust recorded under the source branch but gated on the target (→ same scope); `exp_config_standing` never written; `experience -class` keyed under `class=""` (→ real class, warm==log); `selfimprove.Scope` advisory-only (→ execution-time fail-closed scope screen at the gate + the flywheel path); `super` MaxFanout counting cumulative-not-concurrent (→ outstanding decremented/folded); `-blast-radius` wall fence unenforced on the DEFAULT Linux namespace backend (→ wired via a build-tagged helper). *Invariant edges* — the read-path final-component symlink TOCTOU across read/edit/editchecked/format/patch (→ `worktreefs.ReadConfined` O_NOFOLLOW, false hardening comment corrected); `maint.RotateLog` overwriting a hash-chained generation (→ lossless multi-generation, I5); macOS keychain `Set` leaking the secret on argv (→ off-argv); MCP `Headers` promising host-side secret resolution no code performed (→ `{{secret:NAME}}`/`{{env:NAME}}` resolved via the SecretStore, unresolved = hard error; descriptors relocated out of the operator's checkout). *Perf* — `vcache` O(n²) full-log re-verify + append-on-hit (→ memoized, side-effect-free hits, still chain-sound); `graapprove` trust rebuild rescanning the whole log per gate (→ incremental). *Code-intel* — the graph bare-name node collision (Run/New/Close clobbering across files) → a full qualified-id migration (`NodeID`/`SplitID`/`DisplayName` + a name→qualified resolution layer, every consumer — retrieve/impact/repomap/live/navutil/readsymbol — updated, with a same-name-no-clobber regression test); the embedder hardwired to api.openai.com (→ `NILCORE_EMBED_BASE_URL`); the semantic index mixing vectors across embedding models (→ model+dimension-keyed cache). **Contract/infra/docs:** `make verify` now runs golangci-lint (the dogfooded gate matches CLAUDE.md §4 + CI); the `-race` lane gained model/meter/mcp/trace/trust/graapprove (their `*Race*` tests stop being tautological); a new CI job runs the CONTAINER-sandbox I4 confinement+egress tests under `NILCORE_SANDBOX_MUST_RUN` (the primary sandbox boundary had zero regression protection); `tui-verify` now covers the swarm-board + trace tui code; releases publish per-binary SHA-256 + a SHA256SUMS and the installer verifies before installing (fail-closed); a hermetic model-free native-loop convergence smoke test proves the core loop in CI; doc drift fixed (the non-existent `nilcore run` in SELFACC/ARCHITECTURE/CLAUDE, the vestigial `nullclaw` `docs/.gitignore`). **Then a 12-slice adversarial review of the ASSEMBLED diff caught 8 confirmed second-order regressions the tests missed** — all fixed: a `mkdirAllNoFollow` boundary fallback that could still FOLLOW an attacker-swapped in-worktree symlink out of the tree (I4 escape — reproduced, then closed by canonicalizing root AND target in one symlink-space); the graded auto-approval `$` meter denying everything under the default `-blast-radius off` because it charged cumulative run spend as one action's cost (→ per-day metering against `MaxDollarsDay` seeded from the durable log, `min(clause, blast dayCeil)` when a budget is present, structural main/prod/release denials intact); repomap PageRank dropping ALL call edges post-migration (raw `Edges` vs resolved `CallEdges`); the macOS `ConfigDir` move orphaning an existing secrets vault on upgrade (→ reverted to the stable Application Support home, mint-a-fresh-key data loss averted); `route.Race` loser-cancel making the winner nondeterministic (→ index-aware: a passer cancels only strictly-higher indices, so the lowest-index passer always wins); a chat stdin close-on-ctx racing `os.ErrClosed` into `fatal()` on a clean Ctrl-C (→ mapped to a clean end). A ninth (lowering the high-entropy redaction floor to mask bare hex) was applied then REVERTED when it proved to also mask the audit log's own content/chain/cache-key hashes — breaking the verify cache (a cached-green test surfaced it); the belt's comment now documents why context-free hex is deliberately not masked (keyed hex secrets are still caught by the prefix rules). `make verify` (119 pkgs, lint-inclusive) + Linux cross-build + the expanded `-race` lane + a fully-uncached `go test ./...` all green. _Owns:_ repo-wide — `internal/*`, `cmd/nilcore/*`, `.github/workflows/*`, `Makefile`, `scripts/install.sh`, `docs/*`. _(audit remediation)_ - **feat(upgrade-program): execute the judge-ranked upgrade program — 17 items across 5 waves (dormant loops · context lifecycle · verification latency · swarm DAG completion · delivery loop + gate evidence + sandbox hardening).** A 9-lens, 3-judge analysis over the whole tree (58 scored proposals) found the recurring shape "the system records what it never consumes and builds what it never wires"; this executes the top-ranked program. **Wave 1 — wire the dormant loops:** the Anthropic adapter now emits the **3 prompt-cache breakpoints** (system block-array, last tool, moving last-message marker; Complete+Stream shared; ≤4-bound respected) whose 0.25x read pricing the meter always accounted for — and activating it exposed a REAL dormant bug: Anthropic reports *disjoint* usage tallies while the pricer assumes totals, so a live cache would have massively under-billed; `toModelUsage` now folds `input+cache_read+cache_creation` (test-pinned). The **lessons last mile** is closed — `memory.TaskContext` merges ScopeProject + ScopeGlobal (where the distiller writes) under one newest-first budget, so the agent finally sees its own scars; **race escalation** threads the failed attempt's fail-class + fenced verifier tail into each candidate's `Constraints` (the most expensive escalation no longer starts blind); **`final_verify` is class-tagged and folded into the trust ledger** alongside `race_outcome` (skip-not-panic guards; pre-upgrade logs replay byte-identical) so per-class routing warms on single-backend deployments; **`read` gains {offset,limit} paging + a 48KB cap** with a recovery-teaching notice and the mcp result is capped at the shared fence seam. **Wave 2/3 — context lifecycle + verification latency:** the native loop bounds shell/registry output (head 2KB + tail 6KB backstop; self-bounded tools exempt), records structured edits in the advisor trail, handles `max_tokens` (16384 default cap, `textBlocks()` salvage + harness re-emit turn + `json.Valid` belt — a truncated tool call no longer spins the nudge), injects a one-shot budget wrap-up signal, prepends a **fenced repo map** (new bounded `repoMap` walker behind the `RepoContext` seam) and **compacts in-run** (`CtxWindow` from the meter's window table; `msgs[0]` kept byte-identical to preserve the cache prefix; pairs never split; tool bodies excluded from summaries — I7; context-overflow 400 ⇒ compact-once-retry instead of losing the worktree; events `truncated_turn`/`budget_wrapup`/`loop_compact`). **`NILCORE_VCACHE` flips default-on** (kernel-cutover pattern, `=0` hatch) killing the pure-waste 2x verify on every success; a **FlakeProbe** decorator (test-class red + identical content hash ⇒ ONE real-verifier re-run; `verify_flaky` event) stops a coin-flip test from triggering an N-worktree race; a **TieredVerifier** (**opt-in**, `NILCORE_TIERED_VERIFY=1`) short-circuits in-loop RED via scoped `go vet`+`go test` of touched packages — armed ONLY for a full-module `go test ./...` command whose flags it replicates, short-circuiting ONLY a *provable* subset red (a package-load error falls through to Full); only the FULL verifier can PASS — I2 by construction; order `tiered(flakeprobe(vcache(base)))`. The `vcache→flake→tiered` chain is wired on every orchestrator path (run/serve/chat/resume), not just build/swarm, so a green run pays ONE full verify (not two) and a flaky final verify is re-probed once before any N-worktree race. **Wave 4 — swarm DAG completion (extends #94):** `Shard.BaseRef` + dependency-aware base resolution (single dep ⇒ its verified branch; multi ⇒ integrated TipSHA, `super.depTip` pattern) with a bounded fenced claim-status+summary handoff — DAG edges now buy the dep's CODE, not just ordering; **merged-set tracking** stops the every-pass re-merge spam and a **conflict requeue** rebuilds a conflicted-but-green shard on the integrated tip under the requeue Ledger; **termination honesty**: `Outcome.Unmerged` folds into `Remaining` so a silently-dropped green can never exit 0; **evidence-carrying focused requeue** (red keeps its branch; retry continues from it with red claim ids + verifier detail in the goal); fixed a latent blocker (attempt-branch name collisions made ANY shard retry fail at the worktree cut — now uniquely suffixed) and armed the always-zero requeue budget via `--retries` (default 2). **Wave 5 — delivery + gates + sandbox:** verified chat/run drives **keep their branch** (the front door no longer verifies work then deletes it) with `/diff` preview and `/apply` merging through the EXACT structured PromoteToBase gate (maint caps kept branches; WorkState survives restarts); **every attended gate shows evidence** — `policy.GateEvidence` (diffstat + bounded head-biased excerpt + verify tail with verdict line + spend, redacted at construction) rides `GateAction.Evidence` through the existing StructuredApprover seam, mirrored to `emit.GatePrompt`, rendered on console/plain-writer/styled-REPL/TUI/Slack/Telegram, with legacy flat approvers byte-identical (pinned) and the graapprove fall-through forwarding the FULL action (11 sites; previously every graded fall-through flattened to one line); the **namespace sandbox masks operator credentials** before Landlock — vault dir + `~/.ssh`/`.aws`/`.gnupg`/`.netrc`/`.config/gh`/`.docker/config.json`/`.codex`/`.claude*` (ro tmpfs over dirs, `/dev/null` over files, fail-closed 126, worktree-shadow exclusion) — closing the in-box vault-decryption I3 hole. New Native seams are all nil-safe (unset ⇒ byte-identical); ARCHITECTURE records the vcache default flip, the verify-decorator composition, and the masking rationale. An adversarial pre-PR review (7 risk-targeted lenses × refute-by-default verification, 36 agents) then found and fixed **25 confirmed defects (4 HIGH)** — a mid-tool_use stream EOF that poisoned the request history and killed the run (now sanitized before the turn is recorded); `finish_reason:"length"` never mapping to the max_tokens salvage on OpenAI-family providers; the tiered scoped-red shipping false reds as the verdict (⇒ made opt-in + provable-subset-only, above); a no-op green shard (nothing to commit) misclassified as a merge conflict and burning the run to a false exit-1 (⇒ integrate treats an already-contained branch as an idempotent merge); an **I7 break** where model-authored claim ids/fields rode UNFENCED into a dependent shard's goal (⇒ sanitized + fenced); a skipped DAG dependent silently dropped while the run reported Done=true (⇒ skipped dependents are tracked, re-run when their dep greens, and a termination-honesty backstop forbids a false green); `/apply`'s graded gate scoping the source branch so the never-auto-approve-main floor never saw `main` (⇒ scope is the merge target); `/diff`+`/apply` silently dead on the TUI/serve front doors (⇒ real handlers / explicit replies); an EACCES stat on a root-owned `~/.docker` bricking the whole namespace sandbox (⇒ skip-not-fail, since the command shares the uid); and `~/.git-credentials` missing from the credential mask. Each fix carries a discriminating test; `make verify` + `tui` + `golangci-lint` + `-race` re-green after remediation. `make verify` (119 pkgs) + `tui` build + `golangci-lint` + `-race` green. _Owns:_ `internal/{provider,memory,agent,trust,tools,verify,sandbox,swarm,backend,policy,emit,session,channel,termui,graapprove,maint,worktree}`, `cmd/nilcore/*`, `docs/ARCHITECTURE.md`. _(upgrade program)_ diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..7eced8d --- /dev/null +++ b/NOTICE @@ -0,0 +1,6 @@ +NilCore +Copyright 2026 RNT56 and NilCore contributors. + +This product includes software developed by RNT56 and NilCore contributors. + +Licensed under the Apache License, Version 2.0. diff --git a/README.md b/README.md index 1776f7c..068a3e0 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,7 @@ NilCore borrows intelligence instead of re‑encoding it — so the whole agent [![Dependencies](https://img.shields.io/badge/dependencies-SQLite%20%2B%20x%2Fsys-2ea44f)](go.mod) [![Agent size](https://img.shields.io/badge/agent-~87k%20LOC-1f6feb)](#the-receipts) [![Sandboxed](https://img.shields.io/badge/model%20execution-sandboxed-2ea44f)](#the-seven-invariants-non-negotiable) +[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE) @@ -390,6 +391,12 @@ eval/ measure-first eval harness --- +## License + +NilCore is licensed under the [Apache License 2.0](LICENSE). Copyright 2026 RNT56 and NilCore contributors; attribution notices are recorded in [NOTICE](NOTICE). + +--- +
**No ambient authority. One loop, fully observable. You can always read the trace and pull the plug.**