[thiagoralves]

Summary

OpenPLC Runtime moves from MIT to a dual licence: GPLv3 for everyone, and a commercial licence for users who do not want the GPLv3 obligations.

• LICENSE is the GPLv3 text; every first-party SPDX header reads GPL-3.0-only, and every Autonomy copyright line reads Copyright (c) 2026 Autonomy® (legal texts name the licensor Autonomy Logic Inc.).

• README License section and a new LICENSING.md: the runtime is dual-licensed, commercial use may need a commercial licence, and licences are bought from the OpenPLC Editor at program upload.

• Contributions go under a Contributor License Agreement (CLA.md): ticking the new checkbox in the PR template means agreeing to it, and a CLA job fails until the box is ticked. Everyone ticks it, staff included; only bots pass without it. CLA.md is versioned ("Version 1.0, 2026-10-21") and the checkbox names that version. The job reads only the PR event, with read-only permissions.

• VERSION is v4.3.2.

Out of scope: EtherDOG (stays GPLv3), third-party notices and Snap7 relinking (RTOP-326), STruC++ (RTOP-376), editor and baremetal runtime (DOPE-731).

Ticket

RTOP-375 — https://autonomylogic.atlassian.net/browse/RTOP-375

Small change, no Requirements Gathering: the task carries the specification. No Cybersecurity Risk Assessment: licence text and repository configuration only, no attack surface touched.

How it was tested

• No SPDX-License-Identifier: MIT left; every relicensed file carries the Autonomy copyright, and third-party files (cJSON, Snap7, the S7comm plugin) are untouched.
• LICENSE is byte-identical to the GPLv3 text.
• The CLA check script, run locally: bot passes, box ticked passes (old and version 1.0 wording), unticked fails, no checkbox fails. Its pattern accepts [x] and [X] and rejects an unticked box, an empty body and a mid-line match.
• Testing the check from an outside account was waived by the developer.

Checklist

• bash scripts/run-pytest.sh passes (not run: the change touches only header comments, docs and a new workflow)
• pre-commit run clean (not run, same reason)
• Docs updated if behavior changed (README, CLAUDE.md, docs/)
• Follows the shared review process (summary in .claude/review-guidelines.md)

Contributor License Agreement

• I have read and agree to the Contributor License Agreement, version 1.0

🤖 Generated with Claude Code

https://claude.ai/code/session_01MRWeC5FUhe5ZwEEbLUGpZ6

[Gustavohsdp]

Review of RTOP-375 against its acceptance criteria.

Verified, no action needed

• AC1: LICENSE is byte-identical to https://www.gnu.org/licenses/gpl-3.0.txt; no MIT SPDX header left. The header hunks change only the SPDX line (273 files) plus __license__ and the drivers README. cJSON (MIT), Snap7 and the S7comm plugin (LGPL-3.0-or-later) are untouched.
• AC4: CONTRIBUTING.md covers the CLA, SPDX, third-party and GPLv3 rules and links CLA.md.
• The workflow passes the PR body through env and not through ${{ }} inside run, so there is no script injection, and it runs with read-only permissions. The "no attack surface" justification holds.
• No Jira key in commit messages, no new typing.Any.

To address (inline comments below)

1. The member bypass in cla.yml does not trigger for organisation members whose membership is private, and that is most of the org. This PR's own CLA run took the "accepted" branch instead of "Organisation member". So AC3's "organisation members pass" is not met as written.
2. LICENSING.md makes claims that go beyond AC2 (PLC programs falling under GPLv3 source obligations, licences bound to hardware, an editor notice that belongs to DOPE-731). Please confirm counsel approved this wording, or trim it to the AC2 text.
3. CLA.md carries no version or date, and the template links the moving development branch. Nothing records which text a contributor agreed to.
4. Nit: new files must use "the Autonomy copyright line" (Copyright (c) 2026 Autonomy®), but the CLA and LICENSING.md name the licensor as Autonomy Logic Inc.

Open questions

• AC3 "required for merging": per the task this happens after merge. Who is turning on the required status check on development and main, and when?
• Task item 3 (release as a new major version): VERSION is still v4.3.1. Is the bump tracked in a separate PR?
• AC3 end-to-end (PR from an outside account) was waived. Given point 1, please run it at least once from a non-member account and from a private-member account before making the check required.

[thiagoralves]

Answers to the open questions in the review:

• Required check: a maintainer turns CLA into a required status check on development right after this PR merges, and on main when it reaches main, so open PRs are not blocked before the workflow exists on the base branch.
• Version: VERSION is now v4.3.2 (b642e74). The task was corrected: this ships as a patch release, not a major version.
• Outside-account test: waived by the developer. With the member bypass removed, every author takes the same path (box ticked or not), which this PR's own CLA run exercises; the local script tests cover bot, ticked, unticked and missing checkbox.

Other changes in b642e74: every SPDX header reads GPL-3.0-only, and the CLA's commitment names GPLv3.