chore(license): relicense from PolyForm-Noncommercial-1.0.0 to MIT

[claude]

Closes #40. Part of bounded-systems/.github-private#669 (supersedes #659) — the org collapsing its licence tiering to a single licence: every published @bounded-systems package declares MIT, the runtime included. door-kit was one of only two packages still declaring PolyForm; guest-room is the other.

The licence change

PolyForm-Noncommercial-1.0.0 → MIT, in both manifests (jsr.json and package.json — this repo has no deno.json/deno.jsonc).

The split held noncommercial protection on the door/room runtime for its option value: charging for it later. That option is not going to be exercised — profit, if pursued, comes from new software rather than from monetising this codebase. Meanwhile PolyForm is not OSI-approved and not in GitHub's recognised licence set, so this repo reported no spdxIdentifier at all ("license": null on GET /repos/bounded-systems/door-kit, no badge), and was excluded from pkg.go.dev's redistributable allowlist and from clean crates.io metadata.

LICENSE was missing entirely

Worth calling out separately, because it is not what the sweep expected to find here: door-kit carried no LICENSE file at all — nothing to replace. jsr.json's publish.include has listed LICENSE all along, so every published tarball has been shipping without the licence it claimed to include. Same class of defect as the two other repos caught in this sweep, but worse: those shipped a stale licence, this one shipped none.

The new LICENSE is byte-identical to bounded-systems/mint's (sha256 77b8ef3ca0165fc861dc7567f97d242f6eec582e316304862741fb17f5f1e49e), so the copyright line matches the other relicensed repos exactly:

Copyright (c) 2026 Robert DeLanghe

Copyright vests in the individual author because the org is not a legal entity. publish.include already lists LICENSE, so no manifest change was needed there — the file now exists to satisfy it.

Version bump — via a mint intent, not a hand edit

0.11.0 → 0.12.0 (minor), recorded as .release/license-mit.md rather than typed into the manifests.

This is a deliberate deviation from the hand-off, which asked for the manifests to be edited directly. mint owns manifest versions in this repo (.release/README.md, cut-release.yml): mint version bumps every manifest present and consumes the intents. Hand-editing the version would have been bumped on top of at release time — a double bump — and the version CI job runs mint plan on every PR, so an intent is also what makes the bump visible in CI.

The intent produces exactly the requested bump. Verified locally against mint@v0.5.0, the ref this repo pins:

mint plan — 0.11.0 → 0.12.0  (minor, 1 intent)

It also fixes a discrepancy nobody asked about: jsr.json declared 0.11.0 while package.json declared 0.6.0. mint reads the current version from the first manifest with one (deno.json, jsr.json, package.json — so jsr.json) and writes the next version to all of them, so package.json converges onto 0.12.0 at release time. Nothing here relies on that; it just stops drifting further.

One-way door

Per published version. Every version from here is MIT forever; already-published versions (through 0.11.0) stay under PolyForm. MIT cannot be walked back for a version once it is out. Understood and intended — not a question this PR is reopening.

What I verified

• bun install --frozen-lockfile && bun test — the exact test-command standard.yml passes to repo-standard.yml. 6 pass, 0 fail, across 3 files.
• bunx jsr publish --dry-run on the committed tree — succeeds, and LICENSE now appears in the published file list (it could not have before; the file did not exist).
• The same dry-run at the post-bump version, by applying mint version to a throwaway copy of this branch: Simulating publish of @bounded-systems/door-kit@0.12.0, MIT in both manifests, LICENSE in the file list, Success. That copy was discarded — this branch still declares 0.11.0, as it should, since the bump is CI's to apply.
• GET /repos/bounded-systems/door-kit → license: null, confirming the missing-SPDX symptom first-hand rather than taking it on faith.

What I could not run: nothing repo-local. Outside the repo, two things did not work from this session and are described below rather than glossed over.

The claim window was down

claim-ticket.yml in bounded-systems/.github could not be dispatched. Every bounded-systems/.github API endpoint — contents, actions, workflow dispatches — returns 403 GitHub access to this repository is not enabled for this session, and the session tooling structurally refuses to attach the repo: a repository whose name begins with . cannot be added to a session. The window was unreachable, not red.

So #40 was claimed by hand, per the fallback the org CLAUDE.md names for exactly this case, in the shape claim-ticket.yml defines a claim to be: the claimed label plus a marker comment naming claude/license-mit-door-kit. The assignee projection was not made — but claim-ticket.yml treats assignment as best-effort and explicitly non-load-bearing, and skips it itself whenever the actor is not assignable. The hand claim carries none of the window's serialization guarantee, so it does not defend against a racing claim.

Also worth recording: bash .claude/org-repair.sh printed ORG_BOOT_SHA256 unset — not a bounded-systems cloud session; nothing to do and exited 0 — neither bootstrap in effect nor REFUSED. And no org context block loaded, so this was a degraded-mode session under the CLAUDE.md stanza: this repo only, no org-level or cross-repo changes. That is within scope for this PR, which touches nothing outside door-kit.

Merging does not finish the job

The org's lic gate reads each package's latest published version, not what main declares. It stays red for door-kit after this merges, until door-kit is actually released — dispatching cut-release.yml, which runs mint version, commits the bump, and cuts v0.12.0, which drives publish.yml to JSR.

I have not tagged or published, and this PR does not. That is gated on a broker credential that does not exist yet — bounded-systems/.github#243.

Still owed after this: release door-kit once #243 lands, and the same relicense for guest-room, the last package still on PolyForm.

Not changed

No README or docs line states the licence — door-kit's README has no licence section — so there was nothing to update for step 6. I did not add one; that is a new section rather than a correction, and it is not what this PR was asked to do.

Refs bounded-systems/.github-private#669, bounded-systems/.github#243.

---

Generated by Claude Code

[claude]

CI is green — all 10 checks pass on bc836f5: standard / test, standard / osv, standard / dependency-review, osv / osv-scan, version / version-check, jsr publish, add, CodeQL, Analyze (actions), Analyze (javascript-typescript). mergeable_state: clean.

I could not merge it, and I could not take it out of draft. Both are session-capability limits, not anything wrong with the branch:

• PUT /repos/bounded-systems/door-kit/pulls/41/merge → 403 Merging into a protected base branch is not permitted for this session type. That is a refusal on the merge itself, so undrafting first would not have changed it.
• Taking a PR out of draft is GraphQL-only (markPullRequestReadyForReview); the REST PATCH ... {"draft": false} is silently ignored by GitHub, and this session serves only a pinned set of GraphQL PR-review operations, which does not include that mutation.

So this needs a human: click "Ready for review", then merge. Nothing else is outstanding on the branch — it is pushed, in sync with origin, and every check has already run against the exact commit that would merge.

As the description says, merging still does not finish the job. The lic gate reads door-kit's latest published version, so it stays red until cut-release.yml is dispatched and v0.12.0 publishes — gated on bounded-systems/.github#243. I have not tagged or published anything.

One more thing for whoever picks this up: issue #40 is claimed by hand (claimed label + marker comment) because the claim-ticket.yml window was unreachable from this session — details in the comment on #40. If this PR is abandoned rather than merged, release the claim by removing that label.

---

Generated by Claude Code

[claude]

Follow-ups from this PR are now filed, so nothing here is carried in prose alone:

• release: cut door-kit v0.12.0 (first MIT release) — blocked on the broker credential #42 — cut v0.12.0, the first MIT release. This is the one that actually turns the org lic gate green for door-kit; merging this PR does not. Blocked on bounded-systems/.github#243.
• license: relicense guest-room from PolyForm-Noncommercial-1.0.0 to MIT guest-room#76 — relicense guest-room, the last package still on PolyForm. Checked it at 7c10b70 rather than assuming it mirrors this repo, and it does not: jsr.json there has no license field at all, while package.json and LICENSE carry PolyForm — the mirror image of the defect here. It also already has two unreleased intents, so a licence intent rides along in 0.6.0.
• bounded-systems/infra#463 — claim-ticket.yml is unreachable from a cloud session, which is why license: relicense door-kit from PolyForm-Noncommercial-1.0.0 to MIT #40 was claimed by hand. Filed in infra rather than .github for precisely the reason the issue is about.

---

Generated by Claude Code