masarray · masarray · Jul 14, 2026 · Jul 14, 2026
@@ -13,15 +13,27 @@ Describe the FAT/SAT, commissioning, interoperability, troubleshooting, or repos
 - [ ] `dotnet test .\ProcessBusSuite.sln -c Release --no-build`
 - [ ] `pwsh .\scripts\repository-health.ps1`
 - [ ] Runtime smoke test on Windows, when runtime behavior changed
-- [ ] Documentation/screenshots updated when user-visible behavior changed
+- [ ] Documentation/screenshots updated when user-visible behavior or claims changed
+- [ ] Portable package verification completed when packaging or legal content changed
 
-## Safety and evidence
+## Product, claim, and evidence boundary
 
 - [ ] Receive-only product boundary is preserved
 - [ ] Timing language matches timestamp-source confidence
-- [ ] No customer, site, device, MAC/IP, capture, SCL, or project-sensitive data is included
+- [ ] Expected configuration, observed traffic, software interpretation, and external-device behavior remain distinct
+- [ ] No claim implies formal conformance, calibration, deterministic timing, functional safety, cybersecurity approval, universal interoperability, switching authority, or IED acceptance proof
+- [ ] No customer, employer, station, device, credential, MAC/IP, capture, SCL, or project-sensitive data is included
+- [ ] Any fixture or screenshot is synthetic, contributor-owned, or documented as authorized and sanitized
+- [ ] No unrelated proprietary code, tests, wording, screenshot, report, asset, or UI design was copied or mechanically translated
 - [ ] No `bin`, `obj`, `artifacts`, logs, captures, or local settings are committed
 
+## Contribution licensing
+
+- [ ] I have read and affirmatively accept `CONTRIBUTOR-LICENSE-AGREEMENT.md`
+- [ ] I have the legal right and any required employer or organizational authorization to submit this contribution
+- [ ] Every commit includes `Signed-off-by: Name <email>` under the DCO
+- [ ] Any third-party material is identified with its license and provenance
+
 ## Compatibility / migration notes
 
-None, or describe them here.
+None, or describe them here.
@@ -5,6 +5,13 @@ on:
     branches: [main]
     paths:
       - "Directory.Build.props"
+      - "LICENSE"
+      - "NOTICE"
+      - "COMMERCIAL-LICENSE.md"
+      - "COPYRIGHT.md"
+      - "TRADEMARK.md"
+      - "THIRD_PARTY_NOTICES.md"
+      - "docs/LICENSING.md"
       - "src/**"
       - "tests/**"
       - "scripts/publish-windows-portable.ps1"
@@ -29,7 +36,7 @@ env:
 jobs:
   candidate:
     name: Build verified Windows x64 candidate
-    if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'stabilization/') || startsWith(github.head_ref, 'architecture/')
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'stabilization/') || startsWith(github.head_ref, 'architecture/') || startsWith(github.head_ref, 'legal/')
     runs-on: windows-latest
     timeout-minutes: 35
 
@@ -52,12 +59,10 @@ jobs:
           $prefixNode = $props.SelectSingleNode('/Project/PropertyGroup/VersionPrefix')
           $suffixNode = $props.SelectSingleNode('/Project/PropertyGroup/VersionSuffix')
           if ($null -eq $prefixNode) { throw 'VersionPrefix is missing.' }
-
           $prefix = $prefixNode.InnerText.Trim()
           $suffix = if ($null -eq $suffixNode) { '' } else { $suffixNode.InnerText.Trim() }
           $version = if ([string]::IsNullOrWhiteSpace($suffix)) { $prefix } else { "$prefix-$suffix" }
           if ([string]::IsNullOrWhiteSpace($version)) { throw 'Unable to resolve repository version.' }
-
           "value=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
           Write-Host "Candidate version: $version"
 
@@ -95,6 +100,8 @@ jobs:
             sourceRef = '${{ github.head_ref || github.ref_name }}'
             runtime = 'win-x64'
             framework = 'net8.0-windows'
+            communityLicense = 'GPL-3.0-or-later'
+            historicalBoundary = '85d43a0fe58a5888a9e8008c168ab76d2333ea87'
             timestampUtc = (Get-Date).ToUniversalTime().ToString('o')
           }
           $manifest | ConvertTo-Json | Set-Content .\artifacts\release\candidate-manifest.json -Encoding utf8

@@ -4,9 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Version label, for example 1.4.0-beta.1
+        description: Version label, for example 1.4.0-beta.2
         required: true
-        default: 1.4.0-beta.1
+        default: 1.4.0-beta.2
       publish_release:
         description: Create or update a GitHub Release
         required: true
@@ -18,14 +18,14 @@ on:
         default: true
         type: boolean
       draft:
-        description: Create GitHub Release as draft
+        description: Create a draft release
         required: true
         default: false
         type: boolean
       release_notes_file:
         description: Markdown file used as release body
         required: true
-        default: docs/RELEASE_NOTES_v1.4.0-beta.1.md
+        default: docs/RELEASE_NOTES_v1.4.0-beta.2.md
   push:
     tags:
       - "v*"
@@ -102,6 +102,8 @@ jobs:
             commit = '${{ github.sha }}'
             runtime = 'win-x64'
             framework = 'net8.0-windows'
+            communityLicense = 'GPL-3.0-or-later'
+            historicalBoundary = '85d43a0fe58a5888a9e8008c168ab76d2333ea87'
             timestampUtc = (Get-Date).ToUniversalTime().ToString('o')
           }
           $manifest | ConvertTo-Json | Set-Content .\artifacts\release\release-manifest.json -Encoding utf8
@@ -130,7 +132,7 @@ jobs:
           $sha = "artifacts/release/SHA256SUMS.txt"
           $manifest = "artifacts/release/release-manifest.json"
           $notesFile = '${{ github.event.inputs.release_notes_file }}'
-          if ([string]::IsNullOrWhiteSpace($notesFile)) { $notesFile = 'docs/RELEASE_NOTES_v1.4.0-beta.1.md' }
+          if ([string]::IsNullOrWhiteSpace($notesFile)) { $notesFile = 'docs/RELEASE_NOTES_v1.4.0-beta.2.md' }
           if (-not (Test-Path $notesFile)) { throw "Release notes file not found: $notesFile" }
 
           $releaseArgs = @('release', 'create', $tag, $zip, $sha, $manifest, '--title', "Process Bus Insight $tag", '--notes-file', $notesFile, '--target', '${{ github.sha }}')

@@ -33,9 +33,25 @@ This file defines permanent rules for human and AI contributors. Historical phas
 - Duplicate APPID alone is a design warning; hard conflict requires stronger identity collision evidence.
 - Preserve raw evidence when semantic mapping is uncertain.
 
-## Timing language
+## Timing and claim language
 
-Use wording such as `arrival timing`, `software timestamp`, `screening`, and `capture-path confidence`. Do not use `certified`, `measurement-grade`, or equivalent claims without validated hardware evidence.
+Use wording such as `arrival timing`, `software timestamp`, `screening`, and `capture-path confidence`. Do not use `certified`, `measurement-grade`, `conformant`, `deterministic`, `safe`, `secure`, or universal interoperability claims without the exact evidence and authority required.
+
+The software does not establish functional safety, cybersecurity approval, calibrated measurement, equipment isolation, switching authority, or proof that an IED accepted or acted on observed traffic.
+
+## External-material boundary
+
+External software may be used only as a lawfully licensed black-box interoperability or packet-observation endpoint. Do not use unrelated external source, generated bindings, API composition, internal structure, tests, wording, screenshots, icons, report layouts, UI composition, binaries, or extracted resources as implementation design material without documented rights.
+
+Use synthetic or contributor-owned fixtures. Real SCL, PCAP, screenshots, logs, and diagnostics require documented authorization and sanitization.
+
+## Licensing boundary
+
+- Current community revisions and current packages are `GPL-3.0-or-later` only.
+- Historical Apache-2.0 revisions end at `85d43a0fe58a5888a9e8008c168ab76d2333ea87` and remain on `archive/apache-2.0-final`.
+- Commercial rights require a separate negotiated and executed agreement.
+- The commercial notice grants no additional rights by itself.
+- Third-party components retain their own licenses and notices.
 
 ## Repository quality gate
 
@@ -48,11 +64,11 @@ dotnet build .\ProcessBusSuite.sln -c Release --no-restore
 dotnet test .\ProcessBusSuite.sln -c Release --no-build
 ```
 
-Update tests and documentation whenever runtime behavior, user-visible wording, screenshots, versioning, or release packaging changes.
+Update tests and documentation whenever runtime behavior, user-visible wording, screenshots, versioning, licensing, or release packaging changes.
 
 ## Version and release
 
 - `Directory.Build.props` is the repository version source.
 - README package examples, landing-page structured data, release workflow defaults, and release notes must match it.
-- Release artifacts must include checksum and release manifest.
-- Do not tag a stable release while selected-stream updates, timebase behavior, or waveform/phasor/RMS coherence remain nondeterministic.
+- Release artifacts must include checksum, release manifest, current GPL text, commercial notice, copyright, trademark, third-party notices, and licensing summary.
+- Do not tag a stable release while selected-stream updates, timebase behavior, or waveform/phasor/RMS coherence remain nondeterministic.
@@ -6,18 +6,42 @@ All notable changes are documented here. The project follows Semantic Versioning
 
 ### Planned
 
-- Sanitized golden PCAP/PCAPNG replay corpus with broader multi-vendor scenarios
+- Sanitized golden PCAP/PCAPNG replay corpus with broader interoperability scenarios
 - Further decomposition of the analyzer runtime and WPF workspace
-- Expanded SCL multi-vendor validation
+- Expanded SCL validation
 - Evidence export for FAT/SAT reports
 
+## [1.4.0-beta.2] - 2026-07-15
+
+### Added
+
+- GPL-3.0-or-later current community licensing model
+- Separate negotiated commercial licensing path
+- Historical Apache-2.0 preservation branch at `archive/apache-2.0-final`
+- Copyright, trademark, CLA, DCO, transition, provenance, and public-claim records
+- GPL and package legal-content verification in the repository-health gate
+- Candidate-package validation for `legal/*` branches
+
+### Changed
+
+- Version advanced to `1.4.0-beta.2` so post-transition packages are not confused with historical Apache-licensed v1.4.0-beta.1 artifacts
+- README, landing-page structured data, FAQ, manifest, contribution guidance, package scripts, release workflow, and release documentation now reflect GPL and commercial boundaries
+- Current portable packages include GPL, commercial, copyright, trademark, third-party, and licensing-summary documents
+- Release manifests record the community license and historical boundary
+
+### Security and provenance
+
+- External implementation material is limited to lawful black-box interoperability use unless documented incorporation rights exist
+- Real captures, SCL, screenshots, and diagnostics require documented authorization and sanitization
+- Public wording separates configured expectations, observed traffic, software interpretation, and external-device behavior
+
 ## [1.4.0-beta.1] - 2026-07-11
 
 ### Added
 
 - Immutable selected-stream runtime generations with copied waveform, analog, identity, and diagnostic evidence
 - Atomic runtime snapshot publisher for coherent consumer reads
-- Classic Ethernet PCAP replay through the same raw decoder/analyzer path used by live Npcap capture
+- Classic PCAP replay through the same raw decoder/analyzer path used by live Npcap capture
 - Microsecond and nanosecond PCAP timestamp variants in little-endian and big-endian formats
 - Bounded rejection for unsupported link types, invalid headers, oversized records, and truncated captures
 - Deterministic runtime-architecture tests covering replay timing, snapshot immutability, and three-stream isolation
@@ -27,8 +51,8 @@ All notable changes are documented here. The project follows Semantic Versioning
 ### Changed
 
 - Release and documentation versioning use `1.4.0-beta.1`
-- Runtime architecture now exposes a coherent publication boundary instead of requiring consumers to retain mutable analyzer display models
-- Offline replay is explicitly treated as a reproducibility path, not a separate decoder or a traffic publisher
+- Runtime architecture exposes a coherent publication boundary instead of requiring consumers to retain mutable analyzer display models
+- Offline replay is treated as a reproducibility path, not a separate decoder or traffic publisher
 
 ### Limitations
 
@@ -51,8 +75,7 @@ All notable changes are documented here. The project follows Semantic Versioning
 ### Changed
 
 - Release and documentation versioning use `1.3.0-beta.2`
-- Runtime validation now separates deterministic automated stress evidence from maintained 30–60 minute live/replay soak evidence
-- Public documentation exposes a dedicated Runtime Stability workflow and test filter
+- Runtime validation separates deterministic automated stress evidence from maintained live/replay soak evidence
 
 ## [1.3.0-beta.1] - 2026-07-10
 
@@ -67,12 +90,9 @@ All notable changes are documented here. The project follows Semantic Versioning
 
 ### Changed
 
-- SCL candidates with a valid primary identity anchor remain eligible when transport or configuration fields mismatch, preserving a precise `MISMATCH` result instead of splitting evidence into `MISSING` and `UNEXPECTED` rows
-- Dependency Review uses the current Node 24 action generation and retries while dependency snapshots are still being submitted
+- SCL candidates with a valid primary identity anchor remain eligible when transport or configuration fields mismatch
 - SV explorer prioritizes live streams and sorts by SV name
-- Live streams use `LIVE` state with health color rather than ambiguous warning-only labels
-- Metering and waveform layouts reduce repeated status/noise text
-- Release and documentation versioning use `1.3.0-beta.1`
+- Metering and waveform layouts reduce repeated status text
 
 ### Security
 
@@ -82,7 +102,8 @@ All notable changes are documented here. The project follows Semantic Versioning
 
 - Hardened BER parsing, Npcap lifecycle, release version propagation, and public-repository packaging.
 
-[Unreleased]: https://github.com/masarray/DigSubAnalyzer/compare/v1.4.0-beta.1...HEAD
+[Unreleased]: https://github.com/masarray/DigSubAnalyzer/compare/v1.4.0-beta.2...HEAD
+[1.4.0-beta.2]: https://github.com/masarray/DigSubAnalyzer/compare/v1.4.0-beta.1...v1.4.0-beta.2
 [1.4.0-beta.1]: https://github.com/masarray/DigSubAnalyzer/compare/v1.3.0-beta.2...v1.4.0-beta.1
 [1.3.0-beta.2]: https://github.com/masarray/DigSubAnalyzer/compare/v1.3.0-beta.1...v1.3.0-beta.2
 [1.3.0-beta.1]: https://github.com/masarray/DigSubAnalyzer/releases/tag/v1.3.0-beta.1
@@ -0,0 +1,26 @@
+# Commercial Licensing
+
+Process Bus Insight / DigSubAnalyzer is available as a community edition under `GPL-3.0-or-later`.
+
+Organizations that cannot use or redistribute the software under the GNU GPL may contact the project owner to discuss a separate commercial agreement for rights controlled by that owner, including:
+
+- proprietary or closed-source integration;
+- OEM or white-label distribution;
+- redistribution without the GPL source-distribution model;
+- private product branches and organization-specific features;
+- contractual maintenance, priority support, training, warranty, or engineering services.
+
+## Important legal boundary
+
+This document is an invitation to negotiate. It is **not itself a commercial license**, does not create a contract, and **grants no additional rights** beyond the licenses that already apply.
+
+Commercial terms become effective only through a separately negotiated and executed agreement. Such an agreement can cover only copyrights and other rights controlled by the granting party. It does not replace or remove:
+
+- third-party license obligations;
+- contributor-owned rights not covered by an applicable agreement;
+- historical open-source grants;
+- standards-access restrictions;
+- trademark rules; or
+- operational authorization, validation, safety, or regulatory requirements.
+
+For a confidential commercial discussion, contact the project owner through the `masarray` GitHub profile.
@@ -2,9 +2,28 @@
 
 Thank you for helping improve a receive-only IEC 61850 Process Bus engineering tool.
 
+## Licensing and acceptance
+
+The current community edition is `GPL-3.0-or-later` and the project maintains a separate commercial licensing path.
+
+Before merge, contributors must:
+
+1. read and affirmatively accept `CONTRIBUTOR-LICENSE-AGREEMENT.md`;
+2. add a Developer Certificate of Origin sign-off to every commit;
+3. have the legal right and any required employer or organizational authorization to submit the contribution; and
+4. identify any third-party material together with its provenance and license.
+
+Sign commits with:
+
+```text
+Signed-off-by: Full Name <email@example.com>
+```
+
+The CLA grants rights needed for GPL-compatible publication and a separate commercial path. It does not transfer ownership of the contributor's work.
+
 ## Start here
 
-1. Read [`AGENTS.md`](AGENTS.md) for permanent engineering invariants.
+1. Read `AGENTS.md` for permanent engineering invariants.
 2. Search existing issues and pull requests.
 3. Use a focused branch and keep changes reviewable.
 4. Remove customer, site, device, capture, SCL, MAC/IP, and project-sensitive information from all evidence.
@@ -28,18 +47,22 @@ dotnet test .\ProcessBusSuite.sln -c Release
 - UI clarity that reduces visual noise without hiding evidence
 - Release automation, documentation, and field-validation scenarios
 
-## Product boundaries
+## Independent-development and data boundary
+
+External software may be used only as a lawfully licensed black-box interoperability or packet-observation endpoint. Do not copy or mechanically translate unrelated source, API composition, tests, documentation wording, screenshots, icons, reports, UI layouts, binaries, or extracted resources unless the project has documented incorporation and relicensing rights.
+
+Use synthetic or contributor-owned fixtures whenever practical. Real SCL, PCAP, screenshots, logs, and diagnostics require documented sharing rights and sanitization.
 
-Do not add:
+Do not submit:
 
-- IEC 61850 operate/control workflows
-- protection-action or publisher behavior
-- timing claims beyond the validated timestamp source
-- restricted third-party binaries
-- unsanitized customer/project evidence
+- IEC 61850 operate/control, publisher, or protection-action workflows;
+- timing or measurement claims beyond the validated evidence source;
+- restricted third-party binaries or proprietary material;
+- confidential customer, employer, station, credential, or network data; or
+- production captures and project files without explicit redistribution authority.
 
 ## Pull-request expectations
 
-A pull request should explain the engineering problem, source of truth, validation method, compatibility impact, and any remaining uncertainty. Runtime changes should include automated regression coverage where practical and a Windows smoke test.
+A pull request should explain the engineering problem, source of truth, validation method, compatibility impact, operational and data-handling impact, public wording changes, and remaining uncertainty. Runtime changes should include automated regression coverage where practical and a Windows smoke test.
 
-The pull-request template is the minimum checklist, not a substitute for engineering evidence.
+The pull-request template is the minimum checklist, not a substitute for engineering evidence.