@ours.network/notifications 0.1.1

package/mufl_code/config.mufl

@@ -0,0 +1,21 @@
+// ours-notifications service packet — compile configuration.
+// Full ADAPT stdlib + the shared ours mufl core (mufl_code/core/ submodule)
+// + the protocol_container boot stub the SDK wrapper executes at packet
+// registration.
+config script
+{
+    stdlib_config = (config_load #$MUFL_STDLIB_PATH).
+    core_config = (config_load #"core").
+
+    (
+        $imports ->
+        (
+            $libraries -> (stdlib_config $exports $libraries)'(core_config $exports $libraries)'($protocol_container -> #"protocol_container.mm"),
+        ),
+        $exports ->
+        (
+            $libraries -> (,),
+            $applications -> (,)
+        )
+    ).
+}

package/mufl_code/core/.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# GitHub Sponsors account — uncomment once the account is approved:
+# github: [adapt-toolkit]
+custom: ["https://github.com/adapt-toolkit/ours-donate"]

package/mufl_code/core/.github/workflows/docs.yml

@@ -0,0 +1,39 @@
+name: docs
+on:
+  push:
+    branches: [main]
+    paths: ['docs/**', '.github/workflows/docs.yml']
+  pull_request:
+    paths: ['docs/**', '.github/workflows/docs.yml']
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults: { run: { working-directory: docs } }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 20, cache: npm, cache-dependency-path: docs/package-lock.json }
+      - run: npm ci
+      - run: npm run docs:check
+      - run: npm run docs:build
+      - run: node scripts/gen-llms.mjs
+      - uses: actions/upload-pages-artifact@v3
+        with: { path: docs/.vitepress/dist }
+
+  deploy:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

package/mufl_code/core/.github/workflows/tests.yml

@@ -0,0 +1,66 @@
+# Core test suite — fully self-contained (house rule: in-repo orchestration, no
+# committed binaries, no self-hosted runner). The toolchain and runtime come from
+# the PUBLISHED @adapt-toolkit packages; the broker is the standalone
+# @adapt-toolkit/broker bin (the sdk's embedded dev broker was removed in the
+# #137 line). The runner scripts expect an adapt-checkout layout, so a 4-symlink
+# shim over the npm mufl package provides it.
+#
+# TOOLCHAIN_VERSION pins the exact published tuple the suite runs under — bump
+# it deliberately alongside consumer pins (see the ours ecosystem VERSIONS.md
+# discipline), never with a range.
+name: tests
+
+on:
+  push:
+    branches: [main, 'fable/**', 'feat/**', 'fix/**']
+  pull_request:
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  TOOLCHAIN_VERSION: 0.10.12
+
+jobs:
+  suite:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install published toolchain (mufl + sdk + broker)
+        run: |
+          mkdir -p /tmp/toolchain && cd /tmp/toolchain
+          npm init -y > /dev/null
+          npm i --no-audit --no-fund \
+            "@adapt-toolkit/mufl@${TOOLCHAIN_VERSION}" \
+            "@adapt-toolkit/sdk@${TOOLCHAIN_VERSION}" \
+            "@adapt-toolkit/broker@${TOOLCHAIN_VERSION}"
+      - name: Build the adapt-checkout shim over the npm mufl package
+        run: |
+          M=/tmp/toolchain/node_modules/@adapt-toolkit/mufl
+          S=/tmp/tk-shim
+          mkdir -p "$S/build.linux.release"
+          ln -s "$M/prebuilds/linux-x64/mufl-compile" "$S/build.linux.release/mufl-compile"
+          for d in mufl_stdlib meta transactions; do ln -s "$M/$d" "$S/$d"; done
+      - name: Run the migration suite (incl. the v0-blob A3 gate)
+        run: |
+          export ADAPT_TOOLKIT=/tmp/tk-shim
+          export OURS_SDK_NODE_MODULES=/tmp/toolchain/node_modules
+          export DEV_BROKER=/tmp/toolchain/node_modules/@adapt-toolkit/broker/dist/cli.js
+          bash tests/run_mig.sh
+      - name: Run the core loopback suite
+        run: |
+          export ADAPT_TOOLKIT=/tmp/tk-shim
+          export OURS_SDK_NODE_MODULES=/tmp/toolchain/node_modules
+          export DEV_BROKER=/tmp/toolchain/node_modules/@adapt-toolkit/broker/dist/cli.js
+          bash tests/run.sh
+      - name: Run the notifications suite
+        run: |
+          export ADAPT_TOOLKIT=/tmp/tk-shim
+          export OURS_SDK_NODE_MODULES=/tmp/toolchain/node_modules
+          export DEV_BROKER=/tmp/toolchain/node_modules/@adapt-toolkit/broker/dist/cli.js
+          bash tests/run_notif.sh

package/mufl_code/core/COMMERCIAL-LICENCE.md

@@ -0,0 +1,25 @@
+# Commercial Licence
+
+ours.network is released under the [Functional Source License, Version 1.1 (FSL-1.1-Apache-2.0)](./LICENSE). The FSL lets you use, copy, modify, and redistribute the software **for any purpose except a Competing Use** — broadly, making the software available to others in a commercial product or service that substitutes for ours.network, substitutes for another product or service Adapt Framework Solutions Ltd offers using the software, or provides the same or substantially similar functionality. Two years after each release is published, that version additionally becomes available under Apache 2.0.
+
+If you want to use ours.network in a way the FSL does not permit — in particular a **Competing Use** — you need a separate **commercial licence** from **Adapt Framework Solutions Ltd**, the owner and licensor of ours.network.
+
+## When you need a commercial licence
+
+You need a commercial licence if, for example, you intend to:
+
+- offer a hosted or managed service that provides the same or substantially similar functionality as ours.network;
+- embed ours.network in a commercial product or service that competes with ours.network, or with another product or service Adapt Framework Solutions Ltd offers using the software; or
+- otherwise make a Competing Use as defined in the [LICENSE](./LICENSE).
+
+You do **not** need a commercial licence for a Permitted Purpose under the FSL — including your internal use and access, non-commercial research or education, or professional services you provide to a licensee using the software under the FSL. When in doubt, ask.
+
+## How to obtain one
+
+Contact Adapt Framework Solutions Ltd: **license@adaptframework.solutions**
+
+Please include a short description of your intended use so we can propose suitable terms.
+
+---
+
+Note: ours.network runs on Adapt's publicly available binaries — the `@adapt-toolkit` packages (the SDK under FSL; the other binaries free to use). Adapt's own source code (its C++ core) is not open yet — it will be opened later.

package/mufl_code/core/COMPATIBILITY.md

@@ -0,0 +1,221 @@
+# COMPATIBILITY — the versioned type registry (core 0.5.0)
+
+This document is **binding on every core change**. It declares the oldest peer this core
+interoperates with, the registry of versioned wire types, the discriminator rules, and the
+PR checklist a wire change must satisfy. Companion mechanism doc:
+`docs/how-it-works/versioning.md`. The registry itself lives in **`a2a_versions.mm`**.
+
+## Invariant
+
+> **OLD PEERS NEVER CRASH.** Any payload a peer ≥ OSP sends is either dispatched to a typed
+> per-version branch, or converted into a **first-class error value returned as data**
+> (`a2a_versions::version_error_t`) — never a raw `EVAL_ERROR` escaping to the client.
+> Crypto/tamper failures and identity-verification failures remain hard aborts by design.
+
+## OSP — oldest supported peer
+
+**OSP = core 0.2.0** (`faa2b52`, the deployed ours-mcp pin) → version floor
+`a2a_versions::min_wire_version = 2`.
+
+Raising the OSP is an **owner decision recorded here**: drop the dead `v*_t` types from the
+unions, delete their corpus fixtures (a visible, reviewed act), and update this section.
+
+## The wire version id (`$pv`)
+
+- `wire_version = 8` (minor-version ints: 0.5.0 stamped `$pv -> 5`; 0.7.x stamps `7` — the
+  rcp/receipts surface registered in 0.7 warranted the bump; the initial 0.7.0 under-bump left
+  pre-receipts contacts permanently receipt-gated, the fixed single-tick bug; 0.8.0 stamps `8` —
+  the **e2e** signed-message surface registered in 0.8). Monotone; bump **only** when a wire
+  surface registers a new versioned type — not on every release.
+- Stamped on every core-originated send: cleartext `$targ` envelopes **and** inside the
+  boxed identity-bundle payloads (invite legs 1/3, restore legs 1/2).
+- Absence ⇒ pre-0.5 peer; the registry's per-surface **shape-inference rule** applies.
+- A **mistyped** `$pv` (non-int) is treated as unstamped — reading the discriminator can
+  never abort.
+- `$pv` is peer-asserted metadata riding authenticated channels: it gates parsing branches,
+  send-side feature selection, and diagnostics — **NEVER authz** (REG-6). Signed-artifact
+  `$version` ints (fail-closed) remain the only security-relevant version checks.
+- Passive learning: `a2a_messaging::contact_pv` (cid → last-seen dialect; 0 = pre-0.5) and
+  `contact_caps` (cid → advertised capability ids), learned on invite/restore legs and from
+  stamped `$pv` on message/file traffic (an *unstamped* message never overwrites the more
+  precise invite-time inference). Both maps are additive in the export blob, guarded on
+  import.
+- **Refresh scope (by design):** ordinary message/file traffic refreshes **`$pv` only** —
+  `$caps` refreshes solely via the bundle legs (invite redeem / contact restore) or a future
+  daemon-driven `get_manifest` pull (backlog); it is deliberately NOT piggybacked on every
+  message (wire cost). Consequence: a peer that upgrades and then only sends ordinary
+  messages is re-learned as `contact_pv = 5` with stale/absent caps — **benign** under the
+  fail-open CAP-1 gate (absent/empty caps pass). Learning is per-contact lazy; there is no
+  bulk re-sync. Monotonicity: unstamped traffic writes nothing, and a caps entry is never
+  downgraded to empty — only replaced by a newer non-empty advertisement; `contact_pv`
+  itself is last-*stamped*-wins so an honest software downgrade is re-learned (a forged
+  lower `$pv` only degrades the forger's own UX — REG-6).
+
+## Registry rules (REG-1…6)
+
+- **REG-1** — every wire-visible input surface has a registry entry; a never-changed surface
+  registers a single version (pre-wiring the change procedure).
+- **REG-2** — a wire shape change = registering a **new** `v*_t` beside the frozen old ones
+  (shipped versioned types are historical facts, never mutated). Union + dispatch gain one
+  branch; reviewers see the whole compat surface in the diff.
+- **REG-3** — the handler accepts the union of **all** registered versions ≥ OSP. Dropping a
+  version from the union = an OSP raise (owner decision, recorded here).
+- **REG-4 (dispatch-then-narrow)** — dispatch reads the discriminator off the RAW value and
+  exact-casts to the matched version's type. **Never** cast-to-union as the selector
+  (disjunction casts pick alternatives in canonical — not declaration — order and rebuild/
+  strip; pinned by `tests/mufl_semantics/`). A `$pv` **newer** than the newest registered
+  version narrows as the newest (class-A additions are strippable by construction).
+- **REG-5 (safety net)** — below the registry, display/UX-class optional fields keep the
+  `opt_*` NIL-tolerant read idiom (`a2a_versions::opt_str/opt_int/opt_bool`) as defense in
+  depth. Review rule: **any new `safe` on wire data must be inside a registry
+  `narrow`/branch or an `opt_*` call.**
+- **REG-6** — `$pv`/`$caps` never gate authorization.
+
+## Error-as-data (`version_error_t`)
+
+A below-floor or unrecognized payload produces, **as data** (never an abort):
+
+```
+version_error_t: ($code, $surface, $message, $peer_version, $min_supported, $max_supported)
+```
+
+Stable `$code` values (wire contract):
+
+| code | meaning |
+|---|---|
+| `peer_version_unsupported` | peer dialect below `min_wire_version` (too old) |
+| `payload_shape_unrecognized` | payload matches no registered version ≥ floor |
+
+On async inbound surfaces the handler early-returns `transaction::success` carrying a
+`_notify_agent` event **before any state write**:
+
+```
+($event -> $protocol_error, $context -> $invite_redeem | $invite_complete | $contact_restore,
+ $message -> <context-specific, render-ready>, $error -> version_error_t,
+ $peer_cid -> …, $invite_id -> … when applicable)
+```
+
+Consumer obligation: the MCP daemon / control-plane frontend surface `$message` (and may
+resolve `$error` for details). **Client-side rendering is a separate follow-up task**; the
+core guarantees the shape above.
+
+Owner-specified UX (implemented): a version-incompatible **invite second phase** does NOT
+consume the invite — after the peer updates, the **same invite** redeems successfully. The
+inviter's message says exactly that.
+
+The CAP-1 denial (below) uses the sibling shape
+`($ok -> FALSE, $error -> ($code -> "capability_not_advertised", $cap, $message, $peer_cid))`
+returned as the transaction's data result.
+
+### Abort-free classification (M1) and its documented residual
+
+`try_narrow_*` pre-checks every **non-nullable** field the exact cast reads: presence AND
+runtime domain via `_typeof` (str→`STRING`, int→`INTEGER`; `global_id` rides `STRING`).
+Nullable fields (`bin+`, `str[]+`) are exempt (absent ⇒ NIL passes). Residual, accepted:
+`safe global_id` also hex-validates, so a STRING-but-not-valid-hex id still aborts inside
+the exact cast — no shipped sender can produce that; reaching it requires a hostile
+hand-crafted box, which is the malformed/tamper class where an abort is correct.
+
+## Registry index (0.5.0)
+
+| Surface | Registry | Registered versions | Discriminator (pre-`$pv` inference) |
+|---|---|---|---|
+| leg-1 boxed identity bundle (`submit_invite_response`) | **sir** | v2 / v3 (+`$name`) / v5 (+`$pv`,`$caps`) | `$pv`; else `$name` present ⇒ 3, else 2. `$pv` 3..4 ⇒ v3 (0.4.x never shipped; wire-identical to 0.3), ≥5 ⇒ v5 |
+| leg-3 boxed identity bundle (`complete_invite`) | **cin** | v2 / v5 (+`$pv`,`$caps`; never carried `$name`) | `$pv`; else 2 |
+| restore legs 1/2 boxed bundles (`submit_restore_response`, `complete_restore`) | **rst** | v2 / v5 (+`$pv`,`$caps`) | `$pv`; else 2 |
+| legacy `accept_contact` args | **acc** | v2 / v3 (+`$joiner_name`) | `$pv`; else `$joiner_name` present ⇒ 3, else 2. Path slated for class-C removal at the next OSP raise |
+| `receive_message` `$targ` | **rmsg** | single version (+`$pv` stamp in 0.5.0) | `$pv`; else 2 |
+| `receive_file` `$targ` | **rfil** | single version (+`$pv` stamp in 0.5.0) | `$pv`; else 2 |
+| `receive_receipt` `$targ` (0.7.0) | **rcp** | single version (v1: `$kind`, `$wire_ids`, `$date+`, `$pv+`) | `$pv`; else 7 (surface cannot predate 0.7). Reachable only behind positive `core.receipts.*` caps |
+| `e2e_signed_message` variant (0.8.0) | **e2e** | single version (v1: `$e2e_envelope` = `t_e2e_envelope`(`$session_id`,`$olm_type`,`$ciphertext`,`$pv+`), `$emsignature`) | inner `$e2e_envelope.$pv`; else 8 (surface cannot predate 0.8). Reachable only behind the `core.e2e` cap + AD v2 bundle; decode branch keys on the `$e2e_envelope` marker |
+
+**Deferred surfaces** (tolerant field-by-field readers today; register on their first shape
+change, or when REG-1 is extended repo-wide — owner question SPEC Q9): invite/restore
+cleartext envelopes (`{$invite_id/$rid, $epk, $v, $data}` — now `$pv`-stamped on send),
+`ingest_connect_descriptor`, `enroll_delegated_node`, `control_message` envelope,
+monitoring copies / `push_to_cp` pushes (generic pass-through `$targ`, not stamped),
+`notify_*` service surfaces (all `$pv`-stamped on send), signed artifacts (class D,
+fail-closed, unchanged), export/import blob (`core_format_version`, INV-C3).
+
+## Capability piggyback + CAP-1
+
+The v5 bundle payloads carry `$caps -> str[]` — the sender's capability **ids** (from
+`a2a_capabilities::self_cap_ids`, captured at `init` from `$supported`; empty for an app
+that never wired capabilities). Learned into `contact_caps`.
+
+**CAP-1 gate** (at the notify client sends `notify_register` / `send_notification`): deny —
+**as data, degrade never abort** — only on **positive evidence**: a non-empty learned caps
+set that lacks `core.notifications`. Unknown / absent / empty caps pass (pre-0.5 peers and
+pre-0.5-established contacts keep working). Owner-approved fail-open interpretation.
+
+## Wire-change taxonomy
+
+| Class | What | Procedure |
+|---|---|---|
+| **A** | add an optional field to a tolerant surface | register `v<next>_t` (REG-2); union + dispatch gain a branch; corpus proves OSP unaffected. MINOR |
+| **B** | new transaction (new inbound name) | new registry, single version; sends gated by CAP-1/`$pv`. MINOR |
+| **C** | change/remove a field, change semantics | BREAKING: parallel transaction (class B) or new registered version with a dual-accept window; old version leaves the union only on an OSP raise. MAJOR |
+| **D** | evolve a signed artifact | mint `vN+1` core metadef beside `vN`; verifiers accept an explicit version set; unknown version **fail-closed** (authz). Never mutate a signed shape |
+
+## Message receipts (core 0.7.0) — capability-gated, fail-closed
+
+Two protocol events on the recipient produce two pings to the message sender, both carried
+by ONE new class-B transaction `::a2a_messaging::receive_receipt`
+(`$kind "delivered"|"read"`, `$wire_ids str[]` — the shared message+file namespace, `$date+`,
+`$pv+`): **delivered** fires atomically inside the accepted
+`receive_message`/`receive_file` transaction (app-hook abort = no receipt); **read** fires on
+the consumer's get/mark-read path via `read_receipt_actions` (readonly trns cannot send, so
+the unread→read MARK is the read event — exact-once for free).
+
+**Gate (hybrid since the caps-relearn fix):** caps are exchanged only on invite/restore
+bundle legs and never re-negotiate on app update, so an EXPLICIT caps opinion (any
+`core.receipts.*` id in the learned set) is followed strictly (receive ⇒ send; opinion
+without receive ⇒ opt-out), while a caps-silent peer with learned dialect `pv >= 7` gets
+`receive` IMPLIED — `contact_pv` re-learns from every stamped ordinary message, so two
+upgraded peers self-heal on their first exchange, no re-pair. Old peers (`pv < 7`) stay
+silent. Same hybrid drives `receipt_expectation`.
+
+Capabilities (2 flat ids in `a2a_capabilities`, advertised via the new **`$advertise`** init
+param — protocol-surface ids with no control verbs, so the `$supported`
+declared-implies-implemented handler guard doesn't apply to them):
+`core.receipts.emit` ("I will emit both kinds") and `core.receipts.receive` ("send me
+yours"). Delivery-vs-read is wire metadata, not a capability split.
+
+**Gate polarity — deliberately the OPPOSITE of CAP-1:** receipts fail **CLOSED** on
+unknown/absent caps. Emit iff self advertises `emit` AND the peer POSITIVELY advertises
+`receive` in learned `contact_caps`. Old clients advertise neither id ⇒ nothing is ever sent
+to them (nothing they can't parse) and nothing is expected from them — zero transaction
+failures both directions, by construction. Sender-side state is DERIVED
+(`receipt_expectation`: "expected" iff the peer advertises `emit`, else "unknown" — absence
+of a receipt is NEVER failure; no timeout state in core). Ingest is tolerant and never
+load-bearing: unknown `$kind` = future receipt kind (ignore-success), malformed shapes are
+dropped abort-free (rcp M1 checks incl. the list-domain guard), unknown senders get silent
+success, and no receipt is ever emitted for a receipt. Consumer hook
+(`on_receipt_received`, optional, default no-op) contract: application is MONOTONIC per
+(peer, wire_id) on `unknown < sent < delivered < read`.
+
+## Golden-wire corpus (release gate)
+
+One fixture per registered version per registry, built as the **exact wire shape** that
+version's sender emits (fixtures-as-code in `tests/test_actor.mu::qa_corpus_narrow` — the
+payloads carry real ids + a real AD, which JSON files cannot encode), replayed through
+`try_narrow_*`; the driver asserts the branch taken, the error-as-data classifications
+(below-floor, unrecognized, mistyped fields), forward-compat (`$pv=7`⇒newest, `$pv=4`⇒v3),
+and that the strict `narrow_*` aborts with the stable message.
+
+Run: `tests/run_corpus.sh` (fast) — also exercised by the full suite `tests/run.sh`
+(V-series: cross-version leg-1 end-to-end, Additions A/B, CAP-1, `$pv` learning) and
+`tests/mufl_semantics/run.sh` (toolchain-behavior pins; verified on the **vendored mufl
+0.8.0**). **A release is green only if every registered version parses and dispatches to
+its branch.** Raising the OSP deletes corpus entries deliberately.
+
+## PR checklist — any wire change
+
+- [ ] New `v<next>_t` metadef registered beside the frozen ones (never mutate a shipped type)
+- [ ] Union + `versions_t` vector + `version_of`/`try_narrow` branch updated in `a2a_versions.mm`
+- [ ] Non-nullable fields of the new type added to the `_typeof` shape check (M1)
+- [ ] Corpus fixture added (`qa_corpus_narrow`) + driver assertion (`tests/corpus.mjs`)
+- [ ] `wire_version` bumped iff the surface's shape changed; pv↔core table updated in `docs/how-it-works/versioning.md`
+- [ ] Release note carries a **Wire delta** section (fields added, surfaces, OSP impact)
+- [ ] `version.mm` bumped
+- [ ] Registry index table above updated

package/mufl_code/core/CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# Contributing to ours.network
+
+Thank you for your interest in ours.network. We welcome bug reports, feature discussion, documentation fixes, and code contributions.
+
+## Before you start
+
+- **Bug reports and ideas:** open an issue. Please include reproduction steps and your environment.
+- **Security issues:** do **not** open a public issue — see [SECURITY.md](./SECURITY.md).
+- **Code contributions:** require a signed Contributor Licence Agreement (CLA) — see below. Until the CLA process is live, we are accepting **issues and feedback only**, not pull requests.
+
+## The CLA, and why we require it
+
+ours.network is licensed under the Functional Source License (FSL-1.1-Apache-2.0): source-available today and converting to Apache 2.0 in the future, with paid commercial licences available for organisations that need terms beyond the FSL. The commercial licences are what fund full-time maintenance of this project.
+
+For that model to work, Adapt Framework Solutions Ltd must hold sufficient rights in the entire codebase, including external contributions. So before we can merge your first pull request, we ask you to sign our CLA. **You keep ownership of your contribution**; you grant us a broad licence to it, including the right to include it in commercially licensed versions.
+
+We know CLAs are sometimes criticised as one-sided ("you can relicense our work; we can't relicense yours"). That asymmetry is real, and this is the honest reason for it: it is what keeps the source-available version maintained. If that trade isn't acceptable to you, we completely understand — issues, reviews, and discussion are valuable contributions that need no paperwork.
+
+## Pull request guidelines
+
+1. Open or comment on an issue first for anything non-trivial, so we can agree the approach before you write code.
+2. Keep PRs focused — one change per PR.
+3. Include tests for behavioural changes and update documentation affected by your change.
+4. **Wire changes** (anything a peer sends or receives) must follow the versioned
+   type registry rules and PR checklist in [COMPATIBILITY.md](./COMPATIBILITY.md) —
+   register a new versioned type, add a corpus fixture, note the Wire delta, bump
+   `version.mm`.
+5. Sign the CLA when prompted by the CLA bot (first PR only).
+6. Use clear commit messages; reference the issue number.
+
+## Code of conduct
+
+Be kind, be constructive, assume good faith. Maintainers may close issues or PRs that don't follow these guidelines.
+
+## Licence of contributions
+
+By contributing, you agree that your contributions are provided under the terms of the CLA and will be distributed under the project's licences (the Functional Source License, FSL-1.1-Apache-2.0, and the Company's commercial licences).

package/mufl_code/core/LICENSE

@@ -0,0 +1,98 @@
+# Functional Source License, Version 1.1, Apache 2.0 Future License
+
+## Abbreviation
+
+FSL-1.1-Apache-2.0
+
+## Notice
+
+Copyright 2026 Adapt Framework Solutions Ltd
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to use,
+copy, modify, create derivative works, publicly perform, publicly display and
+redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or service
+that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software that
+   exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee using
+   the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to the
+infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software, you
+must include a copy of or a link to these Terms and Conditions and not remove any
+copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, INCLUDING
+WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE, NON-INFRINGEMENT, OR THAT THE SOFTWARE IS FREE OF DEFECTS. IN NO EVENT
+WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE SOFTWARE,
+INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF WE HAVE
+BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following will
+apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.