fix(license): reconcile every SDK manifest to Apache-2.0 and ship the license text by yakimoto · Pull Request #39 · wave-av/dispatch-edge

yakimoto · 2026-07-30T20:52:52Z

Reconciles the public repo's licensing to a single answer. Refs wave-av/wave-dispatch#451 (private).

The correction that set the direction

I originally read this as "the LICENSE file is the outlier — three sources say MIT, one says Apache-2.0, so fix the file." That was vote-counting artifacts of different ages. git log on LICENSE says otherwise:

e3b3fb8  2026-06-04  WAVE Bot <jake@wave.online>
         chore: adopt Apache-2.0 license + add NOTICE

         Standardize the open WAVE protocol/SDK surface on Apache-2.0 (patent grant for
         adoption). Replaces any prior license; adds NOTICE reserving the WAVE marks.

That is the newest decision, it explicitly names the SDK surface, it explicitly supersedes prior licenses, and it gives a reason MIT can't provide (a patent grant). Every MIT claim in the repo predates it — they were simply never updated. So the manifests are reconciled to the newest decision, not to the majority.

Swapping LICENSE to MIT would have been the wrong fix twice over: it reverts a deliberate decision, strips the patent grant from a public repo, and breaks NOTICE, whose trademark carve-out is written against the Apache License.

What was actually inconsistent

Wider than first catalogued — a grep for \bMIT\b found two more than the audit did, including a Rust SDK missed because an earlier listing was truncated.

surface	was	now
`sdk/python/pyproject.toml`	`license = { text = "MIT" }`	`license = "Apache-2.0"` + `license-files`
`sdk/js/package.json`	`"license": "MIT"`	`"Apache-2.0"`
`sdk/js/package-lock.json`	`"license": "MIT"`	`"Apache-2.0"`
`sdk/rust/Cargo.toml`	`license = "MIT"`	`"Apache-2.0"`
`sdk/ruby/wave_dispatch.gemspec`	`s.license = "MIT"`	`"Apache-2.0"` + `LICENSE` in `s.files`
`README.md` badge	`License: MIT` → linked to the Apache file	`License: Apache 2.0`
`README.md` footer	`MIT © 2026`	`Apache-2.0 © 2026`
`sdk/go`	no license field	unchanged
`.github/workflows/public-repo-guard.yml`	"MIT-licensed" (a third-party tool)	unchanged — not ours

Second defect: a license CLAIM is not license TEXT

The published wheel for 0.7.0 contains 8 files, none of them a license, while its METADATA asserts License: MIT. A manifest field sets a metadata string and packages nothing. Every publishable subtree now carries the license text, and all four copies are byte-identical to the repo root (sha256 14e3130932d1a242…).

Python also migrates off the deprecated license = { text = ... } table to PEP 639, which is what made the claim-without-text possible and which stops building on 2027-02-18. That needs setuptools>=77 at build time only; the wheel still declares requires-python >=3.8.

Verified by building, not by reading

wheel   9 files (was 8) — adds wave_dispatch-0.7.0.dist-info/licenses/LICENSE
        METADATA:  License-Expression: Apache-2.0
                   License-File: LICENSE          (was: License: MIT, no license file)
npm     pack --dry-run → LICENSE 11.3kB present in the tarball
gem     Gem::Specification.load → license=Apache-2.0  files=["LICENSE", "lib/wave_dispatch.rb"]
code    __init__.py e6cc4fc0ee32d027 · cli.py c718f81fe89744c4 · proxy.py f5755eb8b59d2389
        — identical to the published 0.7.0. This change ships no code.

Not verified: crates.io packaging — no cargo on the machine I built this on. Cargo includes LICENSE* by default, but I'd rather flag that than assert it.

What this does not fix

Published 0.7.0 metadata stays wrong on PyPI and npm until the next release. It cannot be amended in place. The version here is still 0.7.0, which is already on PyPI, so a tag today fails on a duplicate filename rather than publishing — a version bump is a separate release decision.
sdk/js/package-lock.json still says "version": "0.6.0" while package.json says 0.7.0. Pre-existing drift, untouched here — regenerating the lockfile is a different change with a different blast radius.
The publish workflow living in the private repo (#451 defect 2) is unaddressed and still the reason PyPI's Repository link points somewhere that doesn't build the package.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Note

Low Risk
Metadata, documentation, and packaging-only changes with no runtime behavior; main follow-up is releasing new package versions so registries reflect the fix.

Overview
Aligns all publishable SDK surfaces with the repo root Apache-2.0 decision instead of stale MIT metadata in manifests and README.

README updates the license badge and footer from MIT to Apache-2.0. JS, Python, Rust, and Ruby manifests now declare Apache-2.0; new LICENSE files in each SDK subtree match the root license text. Python moves to PEP 639 (license = "Apache-2.0" plus license-files) and bumps the build requirement to setuptools>=77 so wheels can ship license text, not only a metadata claim. Ruby adds LICENSE to the gem file list. package-lock.json mirrors the JS license field change.

No application or SDK runtime code changes—packaging and legal metadata only. Already-published 0.7.0 registry metadata stays wrong until a new release.

^{Reviewed by Cursor Bugbot for commit b1c0bf0. Configure here.}

Summary by cubic

Standardizes all SDKs on Apache-2.0 and includes the license text in every publishable package. Also updates Python packaging to PEP 639 and fixes the README license badge; addresses license consistency required by Linear issue 451.

Bug Fixes
- Set license to Apache-2.0 in sdk/python/pyproject.toml, sdk/js/package.json (and lock root), sdk/rust/Cargo.toml, sdk/ruby/wave_dispatch.gemspec, and updated the README badge/footer.
- Added LICENSE to sdk/js, sdk/python, sdk/ruby, and sdk/rust; Ruby gem now includes LICENSE in s.files.
- Python adopts PEP 639 (license as SPDX + license-files) to ensure wheels include the license text.
Migration
- Build-time only: Python now requires setuptools>=77 to build; no runtime changes for users.
- PyPI/npm metadata will update on the next release; package versions are unchanged here.

^{Written for commit b1c0bf0. Summary will update on new commits.}

… license text e3b3fb8 standardized the open protocol/SDK surface on Apache-2.0 ("replaces any prior license", patent grant for adoption) and added NOTICE. the five SDK manifests were never updated, so this public repo has been serving four MIT claims against an Apache-2.0 LICENSE file — including a README badge reading "License: MIT" that links to the Apache text. reconciled to the newest decision rather than to the majority: the MIT claims all predate e3b3fb8 and it explicitly supersedes them. python pyproject.toml MIT -> Apache-2.0 js package.json MIT -> Apache-2.0 (+ package-lock root entry) rust Cargo.toml MIT -> Apache-2.0 ruby gemspec MIT -> Apache-2.0 (+ LICENSE added to s.files) README badge + footer MIT -> Apache-2.0 go no license field — unchanged every publishable subtree now ships the license TEXT, not just a claim. the python wheel carried a bare `License: MIT` string and zero license files; a manifest field sets metadata and packages nothing. python also migrates off the deprecated `license = { text = ... }` table to PEP 639 (`license` as an SPDX expression + `license-files`), which stops building 2027-02-18. that needs setuptools>=77 at BUILD time only — the wheel still declares requires-python >=3.8. verified by building/packing, not by reading the manifests: wheel 9 files (was 8), adds dist-info/licenses/LICENSE; METADATA now License-Expression: Apache-2.0 + License-File: LICENSE npm pack --dry-run lists LICENSE (11.3kB) in the tarball gem Gem::Specification.load -> license=Apache-2.0 files=[LICENSE, lib/...] code __init__/cli/proxy hashes byte-identical to the published 0.7.0 — this change ships no code all four LICENSE copies are byte-identical to the root (sha256 14e3130932d1a242). crates.io packaging is unverified locally (no cargo on this machine). refs #451

changeset-bot · 2026-07-30T20:52:56Z

⚠️ No Changeset found

Latest commit: b1c0bf0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

cursor · 2026-07-30T20:53:03Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_92a986a0-bfea-485b-82a3-bf1233ad6a1b)

coderabbitai · 2026-07-30T20:53:27Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 26 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 19946ff4-b2e4-4618-bf3e-1a6724c7ffe7

📥 Commits

Reviewing files that changed from the base of the PR and between e8228c4 and b1c0bf0.

⛔ Files ignored due to path filters (1)

sdk/js/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (9)

README.md
sdk/js/LICENSE
sdk/js/package.json
sdk/python/LICENSE
sdk/python/pyproject.toml
sdk/ruby/LICENSE
sdk/ruby/wave_dispatch.gemspec
sdk/rust/Cargo.toml
sdk/rust/LICENSE

_{Comment @coderabbitai help to get the list of available commands.}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(license): reconcile every SDK manifest to Apache-2.0 and ship the license text - #39

fix(license): reconcile every SDK manifest to Apache-2.0 and ship the license text#39
yakimoto wants to merge 1 commit into
mainfrom
fix/451-license-consistency

yakimoto commented Jul 30, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

changeset-bot Bot commented Jul 30, 2026

Uh oh!

cursor Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026

Review limit reached

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

yakimoto commented Jul 30, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The correction that set the direction

What was actually inconsistent

Second defect: a license CLAIM is not license TEXT

Verified by building, not by reading

What this does not fix

Summary by cubic

Uh oh!

changeset-bot Bot commented Jul 30, 2026

⚠️ No Changeset found

Uh oh!

cursor Bot commented Jul 30, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

coderabbitai Bot commented Jul 30, 2026

Review limit reached

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

yakimoto commented Jul 30, 2026 •

edited by cubic-dev-ai Bot

Loading