[bpamiri]

Summary

• Replace cli/LICENSE (MIT, inherited from Tom King's standalone wheels-cli, 2016) with a byte-for-byte copy of the root Apache 2.0 license text.
• Add a root NOTICE file that preserves Tom King's 2016 copyright attribution per Apache 2.0 §4(c), satisfying the MIT notice-retention clause without preserving the conflicting MIT license grant.

Why

The repo presented as dual-licensed (Apache-2.0 + MIT) to SCA tools (Snyk, FOSSA, GitHub dependency graph) scanning subdirectories. Contributors to cli/ since the monorepo merge have been submitting under inbound-equals-outbound assuming Apache 2.0 (per CONTRIBUTING + repo metadata), not MIT. This pass aligns the licensing surface so downstream consumers and SCA tooling get a deterministic answer.

The Apache 2.0 §4(c) NOTICE mechanism is the canonical way to keep the original author's copyright assertion intact while shifting the license grant. This is Option 1 from the issue (recommended path).

Verification

Issue checklist:

• Replace cli/LICENSE with Apache 2.0 text — done, diff -q LICENSE cli/LICENSE is clean
• Capture Tom King's 2016 copyright in NOTICE — done at repo root
• Verify no cli/box.json or cli/package.json claims "license": "MIT" — neither file exists; cli/src/ModuleConfig.cfc has no license declaration; remaining MIT mentions in cli/ are unrelated (third-party sshj/slf4j JAR attribution in cli/lucli/lib/deploy/README.md and a user-facing plugin-scaffold default in cli/src/commands/wheels/plugins/init.cfc)

Composition with sibling issues

• chore: add NOTICE file at monorepo root for Apache 2.0 attribution #2573 (broader root NOTICE with full contributor list) — when that lands, it will absorb Tom King's attribution into the wider attribution block. Trivial conflict if any.
• chore: standardize license metadata across package.json files and add SPDX headers #2574 (license metadata in package.json files) — independent surface, no overlap.

Test plan

• diff -q LICENSE cli/LICENSE — confirms byte-identical copy
• grep for "license"\s*:\s*"MIT" in cli/ — no project-level claims
• No CI impact (docs/legal-only change, zero executable code touched)

Closes #2572

[wheels-bot]

Wheels Bot — Reviewer A

TL;DR: This is a well-scoped, legally sound change that resolves the dual-licensing ambiguity for SCA tooling and correctly uses the Apache 2.0 §4(c) NOTICE mechanism to preserve Tom King's 2016 copyright without keeping a conflicting MIT license grant. The two changed files (cli/LICENSE and NOTICE) do exactly what the PR claims — diff -q LICENSE cli/LICENSE is clean, the NOTICE text is accurate, and the commit message is clean. One follow-up observation worth noting before merge: tools/vscode-ext/LICENSE is still MIT (2025, "Wheels"), which puts the VSCode extension outside the stated uniform licensing surface. This PR's stated scope is cli/, so it is not a blocker, but it should be tracked as a follow-up (similar to the open sibling issues #2573 and #2574).

---

Correctness

The stated verification claims all check out:

• diff -q LICENSE cli/LICENSE — confirmed byte-identical ✓
• No cli/box.json or cli/package.json — confirmed neither exists; cli/lucli/module.json already declares "license": "Apache-2.0" ✓
• Remaining MIT mentions in cli/ are scoped to (a) third-party JAR attribution in cli/lucli/lib/deploy/README.md (sshj transitives + slf4j) and (b) the user-selectable default in the plugin-scaffold command (cli/src/commands/wheels/plugins/init.cfc line ~15) — neither is a project-level license claim ✓
• NOTICE file correctly invokes Apache 2.0 §4(c) to retain the copyright assertion without carrying forward the MIT license grant ✓

Minor observations (non-blocking)

tools/vscode-ext/LICENSE is still MIT
tools/vscode-ext/LICENSE contains MIT License / Copyright (c) 2025 Wheels. This is a separate sub-artifact from cli/, so it falls outside this PR's declared scope, but an SCA tool scanning the repo will still report mixed licensing. Tracking alongside #2573/#2574 would complete the unified licensing surface.

No DCO Signed-off-by: trailer on the commit
CONTRIBUTING.md requires a DCO Signed-off-by: trailer on every commit. The commit 407fd50c does not carry one. The DCO GitHub App status check does not appear to have fired yet on this PR, but if it runs as a required check it will block merge. Consider amending with git commit --amend -s or adding a follow-up commit with the sign-off before merge.

Sections with nothing to flag

• Wheels conventions: N/A (no CFML code changed)
• Cross-engine compatibility: N/A
• Test coverage: N/A (docs/legal-only change, no executable code)
• Security: N/A
• Commit message: chore: relicense cli/LICENSE to Apache 2.0 and add NOTICE attribution — valid type, well under 100 chars, passes commitlint ✓

[wheels-bot]

Wheels Bot — Reviewer B (round 1)

A's review is thorough and well-evidenced for a docs/legal-only PR. No sycophancy, and the factual claims all verify. One legal nuance A missed is worth addressing before this merges, and A's verdict state is slightly soft given the DCO finding.

Sycophancy

None detected. A's positive assessment is backed by specific verification steps (byte-identical diff confirmed, module.json license field checked, remaining MIT mentions identified and explained).

False positives

None detected. All factual claims I could independently verify are accurate:

• diff LICENSE cli/LICENSE — confirmed no output (files are identical)
• cli/lucli/module.json — confirmed it declares "license": "Apache-2.0"
• tools/vscode-ext/LICENSE — confirmed MIT, 2025, as A states
• No DCO Signed-off-by: trailer on commit 407fd50c — confirmed (authored by Peter Amiri, no trailer)

Missed issues

MIT notice-retention clause covers both copyright notice and permission notice

The MIT license says: "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software."

"Permission notice" is typically interpreted as the full license grant text, not just the Copyright (c) YYYY Name line. The NOTICE file retains only the copyright assertion:

    Copyright (c) 2016 Tom King

The full MIT permission notice (the grant paragraph and warranty disclaimer) does not appear anywhere in the repo after this change. Whether retaining only the copyright line satisfies the MIT notice-retention clause — or whether the Apache 2.0 §4(c) NOTICE mechanism fully displaces that obligation — is a legal question A did not address. The PR asserts it is sufficient but does not examine that claim. Given the PR's entire purpose is licensing compliance, this deserves explicit acknowledgment or a pointer to where Tom King's consent to relicensing is documented. If there was explicit permission from Tom King, stating that would close the question entirely.

Verdict alignment

A's verdict is COMMENTED (not request-changes), but A identifies the DCO issue as something that "will block merge" if the DCO App runs as a required check. If a finding is merge-blocking, the verdict should be request-changes. A should have either (a) confirmed DCO is not a required check on this PR and explained why, or (b) requested changes.

Convergence

Not aligned. A should address the missed issue: either explain why retaining only the copyright line (and not the full MIT permission notice) is legally sufficient, or confirm that Tom King explicitly consented to the relicensing (which would supersede the notice-retention question). The DCO verdict-alignment issue is minor and can be addressed in the same response.

[wheels-bot]

Wheels Bot — Reviewer A response (round 1)

B's critique is correct on both counts. After re-reading the diff and the MIT license text, I concede the missed issue about the permission notice, and B is right that identifying a merge-blocking finding while issuing a COMMENT verdict is inconsistent. My updated position is request-changes for two items: (1) the MIT permission notice gap in the NOTICE file or documentation of Tom King's explicit relicensing consent, and (2) the missing DCO trailer.

Conceded points

• MIT permission notice not retained. Re-reading the diff: the NOTICE file retains only Copyright (c) 2016 Tom King. The MIT license requires both "the above copyright notice and this permission notice" be included in copies. "This permission notice" is the full grant-and-disclaimer block (Permission is hereby granted... through ...DEALINGS IN THE SOFTWARE.), which does not appear anywhere in the repo after cli/LICENSE is replaced with Apache 2.0. Apache 2.0 §4(c) covers "copyright, patent, trademark, and attribution notices" — it does not discharge the obligation imposed by MIT's own permission-notice clause. The PR text asserts the NOTICE mechanism satisfies the obligation but does not explain why omitting the grant text is permissible. Either the full MIT permission notice should appear in NOTICE (or a file referenced from it), or the PR description should document that Tom King explicitly consented to the relicensing, which would supersede the notice-retention requirement entirely.

• DCO verdict alignment. My initial review described the missing Signed-off-by: trailer as something that "will block merge" if the DCO App runs as a required check, but I submitted COMMENT rather than request-changes. That is internally inconsistent. If a finding is merge-blocking, the verdict must be request-changes. B is right.

Defended points

• None. B identified no false positives and I have no new defenses to add.

Updated verdict

Request-changes. Two items need resolution before merge: (a) either include the full MIT permission notice text in the NOTICE file or document Tom King's explicit consent to relicensing, and (b) add the DCO Signed-off-by: trailer to the commit.