Repository navigation
chore: change license from MIT to Apache 2.0 - #356
Conversation
Update LICENSE file to Apache License 2.0 and update npm/package.json license field to match.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 89ee01c4f6
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "url": "git+https://github.com/veryfront/veryfront.git" | ||
| }, | ||
| "license": "MIT", | ||
| "license": "Apache-2.0", |
There was a problem hiding this comment.
Changing only npm/package.json to Apache-2.0 leaves the npm distribution in a contradictory state: npm/LICENSE is still MIT, and the build source still hardcodes MIT in scripts/build/build-npm-dnt.ts (package.license and generateMitLicense()), so the next deno task npm build will revert the generated metadata. This can break downstream compliance checks because published tarballs will not consistently declare Apache-2.0.
Useful? React with 👍 / 👎.
…, align the docs Addresses three P1 review findings on this PR. 1. The grant never reached the execution surfaces. resolveHostProjectExecutionPosture set the capability, but isHostProjectCodeExecutionAllowedForTopology discarded it for any shared runtime, so the SSR guard and API handler returned the same 503 this PR was meant to fix. The resolver change alone was a no-op. Honour the grant in the topology predicate and update the test that pinned the denial. The topology parameter is now unused, so it is removed; requiresIsolatedProjectRuntime still samples the topology once for its own decision, and the single-sample invariant test now exercises the ungranted path where topology actually decides. 2. No startup warning when the grant is active. production-server warned only when the setting was ignored, so switching same-process tenant execution on -- including a formerly stale setting becoming effective on upgrade -- was silent. Warn distinctly on an active grant, and keep the ignored-setting warning for dedicated runtimes. 3. Documented posture contradicted the effective one. security/README.md said a shared runtime never executes tenant source and the setting was ignored; the module header and worker-pool posture repeated it. Replace the "deprecated override" section with one that states plainly that granting reduces isolation, why this deployment needs it, and that it is retired by routing execution to a dedicated runtime (#356). Verified red before green on the predicate: the shared-runtime-with-grant case fails against the previous behaviour and passes with this change.
Summary
npm/package.jsonlicense field fromMITtoApache-2.0Test plan
licensefield isApache-2.0