Every Module Package v1 now declares the module's license and carries its
text. packageFormat stays 1; pre-ADR-0051 metadata fails closed.
- Contracts: ekklesia.package.json requires an SPDX `license` expression,
validated with spdx-expression-parse, with UNLICENSED and non-expressions
refused. The `files` list must hold exactly one non-empty root LICENSE.
The package contracts move to the @ekklesia/contracts/module-package
subpath, so the SPDX parser and its data (spdx-exceptions and
spdx-license-ids ship no licence files) never reach a module bundle
through the SDK's re-export of the contracts root.
- Packager: reads the source package.json's string SPDX declaration and
never invents one. It requires an explicit --license-file (a non-empty
regular file, no symlink, no parent search, no download) and copies its
bytes unchanged to LICENSE, listed with size and SHA-256 and covered by
the archive digest. THIRD_PARTY_NOTICES stays third-party only, and
bundled Ekklesia code stays in `incorporates`.
- Verifier: rejects missing or invalid license metadata, and a missing,
unlisted, duplicated, or corrupted LICENSE, through the schema and the
existing strict inventory.
- Template: packaged as AGPL-3.0-or-later with the repository's canonical
LICENSE, passed explicitly (Dockerfile, smoke, docs). Packing it twice
gives byte-identical archives.
Started by Codex; reviewed and completed in Claude Code (empty license-text
refusal, schema non-empty LICENSE, symlink and empty-file tests).
ADR 0051 is Accepted.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
