NVIDIA · johnnygreco · Aug 13, 2026 · Aug 13, 2026
diff --git a/.github/workflows/license-headers.yml b/.github/workflows/license-headers.yml
@@ -0,0 +1,33 @@
+name: License headers
+
+"on":
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: license-headers-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Check license headers
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Check license headers
+        run: python scripts/update_license_headers.py --check
diff --git a/projects/egress-gate/analysis/render_latency_plot.py b/projects/egress-gate/analysis/render_latency_plot.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Render the Egress Gate latency proof-of-concept figure as deterministic SVG."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/examples/class-based-gate/keyword_gate.py b/projects/egress-gate/examples/class-based-gate/keyword_gate.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """A minimal class-based Egress Gate implementation."""
 
 from typing import Literal

diff --git a/projects/egress-gate/examples/custom-gate/keyword_gate.py b/projects/egress-gate/examples/custom-gate/keyword_gate.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """A minimal custom Egress Gate implementation."""
 
 from typing import Literal

diff --git a/projects/egress-gate/scripts/check.sh b/projects/egress-gate/scripts/check.sh
@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")/.."

diff --git a/projects/egress-gate/src/egress_gate/__init__.py b/projects/egress-gate/src/egress_gate/__init__.py
@@ -1 +1,4 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Egress Gate: an OpenShell supervisor middleware. See the package README."""
diff --git a/projects/egress-gate/src/egress_gate/base.py b/projects/egress-gate/src/egress_gate/base.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Package-wide base class for validated, immutable domain objects."""
 
 from pydantic import BaseModel, ConfigDict

diff --git a/projects/egress-gate/src/egress_gate/cli.py b/projects/egress-gate/src/egress_gate/cli.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Egress Gate command-line application."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/config.py b/projects/egress-gate/src/egress_gate/config.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Strict Egress Gate policy configuration."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/constants.py b/projects/egress-gate/src/egress_gate/constants.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Package-wide Egress Gate constants and operational limits.
 
 Keep this module dependency-free within the package: it must not import from

diff --git a/projects/egress-gate/src/egress_gate/errors.py b/projects/egress-gate/src/egress_gate/errors.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Content-safe failures shared across Egress Gate trust boundaries."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/gates/__init__.py b/projects/egress-gate/src/egress_gate/gates/__init__.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Public Egress Gate authoring and built-in gate surface."""
 
 from egress_gate.gates.base import (

diff --git a/projects/egress-gate/src/egress_gate/gates/base.py b/projects/egress-gate/src/egress_gate/gates/base.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Trusted request-level gate extension contract."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/gates/regex.py b/projects/egress-gate/src/egress_gate/gates/regex.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Bounded regex catalog compilation, matching, and gate evaluation."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/gates/regex_scans.py b/projects/egress-gate/src/egress_gate/gates/regex_scans.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Public action and source configuration for regex request scans."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/gates/registry.py b/projects/egress-gate/src/egress_gate/gates/registry.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Gate registration and lazy policy-schema construction."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/gateway_config.py b/projects/egress-gate/src/egress_gate/gateway_config.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """OpenShell gateway registration management for the command-line application."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/logging.py b/projects/egress-gate/src/egress_gate/logging.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Native Python logging configuration for Egress Gate."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/request.py b/projects/egress-gate/src/egress_gate/request.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Immutable request and mutation models shared by Egress Gate components."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/request_content/__init__.py b/projects/egress-gate/src/egress_gate/request_content/__init__.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Public structured request-content parsing surface."""
 
 from egress_gate.request_content.json import (

diff --git a/projects/egress-gate/src/egress_gate/request_content/_json_parser.py b/projects/egress-gate/src/egress_gate/request_content/_json_parser.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Private bounded parser for source-aware strict JSON documents."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/request_content/json.py b/projects/egress-gate/src/egress_gate/request_content/json.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Strict source-aware JSON request-content parsing and selection."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/request_content/json_values.py b/projects/egress-gate/src/egress_gate/request_content/json_values.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Shared JSON value kinds used by public documents and the private parser."""
 
 from enum import StrEnum

diff --git a/projects/egress-gate/src/egress_gate/request_content/messages.py b/projects/egress-gate/src/egress_gate/request_content/messages.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Normalized agent message blocks derived from structured JSON content."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/request_content/parsers.py b/projects/egress-gate/src/egress_gate/request_content/parsers.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Gate-agnostic parsers for text-bearing request content."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/request_content/text.py b/projects/egress-gate/src/egress_gate/request_content/text.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Shared immutable values for parsed request text and its replacements."""
 
 from dataclasses import dataclass

diff --git a/projects/egress-gate/src/egress_gate/request_processor.py b/projects/egress-gate/src/egress_gate/request_processor.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Ordered gate execution over one mutable-current immutable request value."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/result.py b/projects/egress-gate/src/egress_gate/result.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Immutable gate evaluations and Egress Gate result models.
 
 These models deliberately contain no protobuf or gRPC types. ``SourcedFinding``

diff --git a/projects/egress-gate/src/egress_gate/service/__init__.py b/projects/egress-gate/src/egress_gate/service/__init__.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """gRPC transport and servicer for the Egress Gate middleware."""
 
 from egress_gate.service.server import EgressGateServer

diff --git a/projects/egress-gate/src/egress_gate/service/server.py b/projects/egress-gate/src/egress_gate/service/server.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Programmatic Egress Gate gRPC server lifecycle."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/service/servicer.py b/projects/egress-gate/src/egress_gate/service/servicer.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """gRPC boundary for the protobuf-free Egress Gate pipeline processor."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/src/egress_gate/string_validators.py b/projects/egress-gate/src/egress_gate/string_validators.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Reusable string validators and the field types built from them."""
 
 from typing import Annotated

diff --git a/projects/egress-gate/src/egress_gate/timeout.py b/projects/egress-gate/src/egress_gate/timeout.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """A shared monotonic timeout for one request-pipeline run."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/__init__.py b/projects/egress-gate/tests/__init__.py
@@ -1 +1,4 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Egress Gate test package."""
diff --git a/projects/egress-gate/tests/gates/__init__.py b/projects/egress-gate/tests/gates/__init__.py
@@ -1 +1,4 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Gate contract and built-in gate tests."""
diff --git a/projects/egress-gate/tests/gates/test_base.py b/projects/egress-gate/tests/gates/test_base.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Contract tests for trusted request-level gates."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/gates/test_function_gate.py b/projects/egress-gate/tests/gates/test_function_gate.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Tests for the resource-free function-gate authoring helper."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/gates/test_regex.py b/projects/egress-gate/tests/gates/test_regex.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Behavior, scans, actions, safety, caching, and concurrency tests for regex."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/gates/test_registry.py b/projects/egress-gate/tests/gates/test_registry.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Registry sealing and exact pipeline-schema tests."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/request_content/__init__.py b/projects/egress-gate/tests/request_content/__init__.py
@@ -1 +1,4 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Structured request-content tests."""
diff --git a/projects/egress-gate/tests/request_content/test_json.py b/projects/egress-gate/tests/request_content/test_json.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Contracts for strict JSON selection and source-preserving replacement."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/request_content/test_messages.py b/projects/egress-gate/tests/request_content/test_messages.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Contracts for normalized message blocks backed by JSON text nodes."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/request_content/test_parsers.py b/projects/egress-gate/tests/request_content/test_parsers.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Contracts for reusable request-content text parsers."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/service/__init__.py b/projects/egress-gate/tests/service/__init__.py
@@ -1 +1,4 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Egress Gate service tests."""
diff --git a/projects/egress-gate/tests/service/test_grpc_integration.py b/projects/egress-gate/tests/service/test_grpc_integration.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Loopback coverage for the generated OpenShell gRPC service."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/service/test_server.py b/projects/egress-gate/tests/service/test_server.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Programmatic Egress Gate server lifecycle and transport-isolation tests."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/service/test_servicer.py b/projects/egress-gate/tests/service/test_servicer.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Transport-boundary tests for the canonical OpenShell protobuf adapter."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/test_cli.py b/projects/egress-gate/tests/test_cli.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Command-line tests for Egress Gate discovery and policy schema surfaces."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/test_config.py b/projects/egress-gate/tests/test_config.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Strict pipeline configuration tests."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/test_errors.py b/projects/egress-gate/tests/test_errors.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 import inspect
 
 from egress_gate.errors import (

diff --git a/projects/egress-gate/tests/test_gateway_config.py b/projects/egress-gate/tests/test_gateway_config.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """OpenShell gateway registration management tests."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/test_logging.py b/projects/egress-gate/tests/test_logging.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Egress Gate logging configuration tests."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/test_request.py b/projects/egress-gate/tests/test_request.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Focused boundary tests for the protobuf-free request domain models."""
 
 from __future__ import annotations

diff --git a/projects/egress-gate/tests/test_request_processor.py b/projects/egress-gate/tests/test_request_processor.py
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 """Ordered current-request execution and decision-provenance tests."""
 
 from __future__ import annotations