@softspark/ai-toolkit 4.19.1 → 4.21.0

package/CHANGELOG.md

@@ -7,6 +7,127 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v4.21.0 — one KB taxonomy, in one place (2026-07-28)
+
+### Fixed
+
+- **The `documentation-standards` skill contradicted itself.** Its frontmatter
+  said "5-category taxonomy", its table listed those five, and three paragraphs
+  below a "Valid categories" line named six — adding `planning`. An author
+  reading the table and a validator reading the code disagreed about what was
+  legal, and only the validator got a vote.
+- **`decisions` and `runbooks` were not valid categories**, while the
+  `kb-migration` SOP had been instructing people to create exactly those
+  directories for months. A correctly-filed ADR failed `scripts/validate.py`.
+  Both are now in the taxonomy, which is eight: `reference`, `howto`,
+  `procedures`, `troubleshooting`, `best-practices`, `decisions`, `runbooks`,
+  `planning`.
+- **`procedures` and `runbooks` no longer describe each other.** The table gave
+  "SOPs, runbooks, operational processes" for `procedures`, which left no way to
+  choose between them. `procedures` is a process a person follows; `runbooks`
+  are run against a live system, usually under pressure.
+
+### Added
+
+- **`section:` is documented as what it is: a legacy alias for `category:`.**
+  Older documents and the `kb-migration` SOP write `section:`; both names are
+  read in the wild. A document may carry both, and `validate.py` now rejects it
+  when they disagree — a document filed as `category: reference` and
+  `section: howto` is indexed twice and found once.
+- **`validate.py` checks that a document's category names its directory.** The
+  rule is scoped to directories that *are* category names, deliberately:
+  `kb/history/completed/` is a lifecycle location rather than a type, and a
+  finished plan filed there is still a `planning` document. Fifteen of this
+  project's own documents are in exactly that position.
+
+### Changed
+
+- `VALID_KB_CATEGORIES` in `scripts/validate.py` and the taxonomy table in
+  `app/skills/documentation-standards/SKILL.md` are one list in two places, and
+  each now says so. They were previously two lists that had drifted.
+
+---
+
+## v4.20.0 — Apache-2.0, nine plugin packs removed (2026-07-27)
+
+### Changed — licence: MIT to Apache-2.0
+
+The project is now licensed under the Apache License 2.0. It stays permissive:
+fork it, modify it, ship it commercially. What changes is what a redistributor
+owes back.
+
+- **`NOTICE` is the point.** MIT already required keeping the copyright notice,
+  so attribution is not new. What Apache-2.0 adds is §4(d): a redistributor must
+  carry the contents of the `NOTICE` file — project name, copyright, source URL —
+  into their distribution. That is the strongest attribution mechanism available
+  in a permissive licence, and it is why this change was made. `NOTICE` is now in
+  `package.json` `files`, so it ships with the npm package.
+- **Modified files must say so** (§4b). MIT had no equivalent.
+- **Express patent grant with retaliation** (§3) and **no trademark rights**
+  (§6). Neither existed under MIT.
+- **Nothing is revoked.** Releases up to and including v4.20.0 were published
+  under MIT and remain available under MIT. This applies going forward.
+- **Prior contributions are handled correctly.** Contributions received while the
+  project was MIT-licensed remain their authors' copyright. MIT permits
+  sublicensing, so they are redistributed under Apache-2.0 with the original MIT
+  notice preserved verbatim in `NOTICE`, which is what MIT requires.
+
+`LICENSE` now holds the verbatim Apache-2.0 text, cross-verified against two
+independent published copies before being written.
+
+- **SPDX headers on 253 source files.** Short three-line form, placed after the
+  shebang. Markdown is deliberately excluded: skill and agent files carry parsed
+  frontmatter, and their descriptions cost 5,051 and 2,750 tokens of every
+  session's context, so a header there would be billed on every conversation for
+  a notice Apache only recommends.
+- **`tests/test_licensing.bats`, 7 assertions, enforced in CI**: headers present
+  and naming Apache-2.0, no header in markdown, `LICENSE` complete, `NOTICE`
+  carrying attribution and section 4(d), both files in `package.json` `files`,
+  and every manifest agreeing. The release SOP gains Phase 5c running the same
+  gate before the tag. Convention and reasoning: `kb/reference/licensing.md`.
+
+### Removed
+
+- **Nine plugin packs that installed nothing**: `csharp-pack`, `java-pack`,
+  `kotlin-pack`, `ruby-pack`, `rust-pack`, `swift-pack`, `frontend-pack`,
+  `research-pack`, `security-pack`. Every one declared only skills and agents
+  that already ship in the core install, so `plugin install` reported
+  `(0 file items)` and put no file on disk. Measured on both runtimes and all
+  three profiles. Eight of the nine owned nothing but a `README.md`.
+
+  **Nothing is lost.** `rust-patterns`, `java-patterns`, `security-patterns`,
+  `research-mastery` and every other asset those packs named are core skills and
+  agents; they are still installed and still trigger exactly as before. A pack
+  never held them.
+
+  `frontend-pack` was the sole partial exception: on codex it copied core's
+  `post-tool-use.sh` in under a pack-prefixed name. That is a generic hook with a
+  domain label, not frontend functionality. If `post-tool-use` should run on
+  codex it belongs in the core codex hook set, as its own change.
+
+  Full measurement: `kb/history/completed/no-op-plugin-packs-removed-20260727.md`.
+- `kb/reference/language-packs.md`, the reference for six of the removed packs,
+  moved to `kb/history/completed/language-packs-removed-20260727.md`.
+
+### Changed
+
+- **`plugin-creator` now requires a pack to do something.** The authoring rule
+  said "reference existing toolkit assets before duplicating", which against a
+  core install that ships everything produces a no-op every time — nine packs
+  followed it exactly. It now requires that a pack install files the core does
+  not, and the validation checklist carries a non-zero-file-count check on every
+  runtime the pack claims.
+- `kb/reference/plugin-pack-conventions.md` documents the two surviving packs by
+  what they **own**, not by what they list.
+
+### Kept
+
+`memory-pack` (2 hooks, 2 scripts, its own `mem-search` skill) and
+`enterprise-pack` (`status-line.sh`, `output-style.sh`) — the two packs that
+ship files of their own.
+
+---
+
 ## v4.19.1 — re-release from corrected history (2026-07-27)
 
 No functional change. The package contents are identical to v4.19.0.

package/LICENSE

@@ -1,21 +1,201 @@
-MIT License
-
-Copyright (c) 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,55 @@
+ai-toolkit
+Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+
+This product includes software developed by SoftSpark.
+Source: https://github.com/softspark/ai-toolkit
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+If you redistribute this software or a derivative of it, Section 4(d) of the
+License requires you to carry the contents of this NOTICE file with it.
+
+--------------------------------------------------------------------------------
+
+PRIOR LICENSE
+
+Releases up to and including v4.20.0 were distributed under the MIT License.
+Those releases remain available under MIT; this change applies going forward and
+does not revoke any permission already granted.
+
+Contributions made while the project was MIT-licensed remain the copyright of
+their authors and were received under MIT terms. MIT permits sublicensing, so
+they are redistributed here under the Apache License 2.0 with the original
+notice preserved below, as MIT requires.
+
+    MIT License
+
+    Copyright (c) 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.

package/README.md

@@ -3,29 +3,35 @@
 > Professional-grade AI coding toolkit with multi-platform support. Machine-enforced safety, 108 skills, 44 agents, expanded lifecycle hooks, persona presets, experimental opt-in plugin packs, and benchmark tooling — works with Claude Code, Claude Chat/Cowork, Cursor, Devin, Copilot, Gemini, Cline, Roo/Zoo Code, Aider, Augment, Google Antigravity, Codex CLI, and opencode.
 
 [![CI](https://github.com/softspark/ai-toolkit/actions/workflows/ci.yml/badge.svg)](https://github.com/softspark/ai-toolkit/actions/workflows/ci.yml)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![Skills](https://img.shields.io/badge/skills-108-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
-[![Tests](https://img.shields.io/badge/tests-1465%20passing-success)](tests/)
-
-## What's New in v4.19.1
-
-v4.19.1 is v4.19.0 re-published from a corrected commit history — same package contents, no functional change. What that release does:
-
-Removes `rtk-pack`. The pack that v4.18.0 shipped is gone; everything the work built underneath it stays.
-
-- **`rtk-pack` retired**: it broke every command it rewrote. rtk names itself bare in the rewrite, the pack kept its binary off `PATH` on purpose, and the result was exit 127 on `git`, `ls`, `cat`, `find`, `grep` and the rest. Measured value before the defect was 0.0615% of input tokens against a 0.05% kill number, so the fix was not worth the surface. See [the retirement note](kb/history/completed/rtk-pack-retirement-20260727.md).
-- **Pack hook wiring for Cursor and Gemini stays**: packs write user-scope entries to `~/.cursor/hooks.json` and `~/.gemini/settings.json`, tagged per pack, and `plugin remove` takes only its own back out.
-- **`ai-toolkit update` maintains installed packs**: it runs the equivalent of `plugin update --all`. Updates are version-aware, so a pack whose manifest has not moved is a silent no-op instead of a remove-and-reinstall.
-- **Packs can report their own health**: `plugin status` picks up a pack's `scripts/status.py`, replacing a hardcoded per-pack branch.
-- **Security gates cover packs**: `audit_skills.py --ci` and the ShellCheck gate now scan `app/plugins/`, which they previously skipped.
-
-If you installed the pack under v4.18.0, run `ai-toolkit plugin remove rtk-pack`.
+[![Tests](https://img.shields.io/badge/tests-1473%20passing-success)](tests/)
+
+## What's New in v4.21.0
+
+v4.21.0 makes the KB taxonomy one list instead of three, and teaches
+`validate.py` to enforce it.
+
+- **The taxonomy is eight categories**: `reference`, `howto`, `procedures`,
+  `troubleshooting`, `best-practices`, `decisions`, `runbooks`, `planning`.
+  `decisions` and `runbooks` were missing while the `kb-migration` SOP had been
+  telling people to create those directories for months — a correctly-filed ADR
+  failed validation.
+- **The `documentation-standards` skill no longer contradicts itself.** Its
+  frontmatter said "5-category", its table listed five, and a line below named
+  six. Author and validator disagreed, and only the validator got a vote.
+- **`section:` is documented as a legacy alias for `category:`**, and
+  `validate.py` rejects a document carrying both with different values — that
+  document is indexed twice and found once.
+- **A document's category must name its directory**, checked only for
+  directories that are category names: `kb/history/completed/` is a lifecycle
+  location, not a type, and a finished plan filed there is still `planning`.
+- **`procedures` and `runbooks` stopped describing each other.** A procedure is
+  followed by a person; a runbook is run against a live system.
 
 See [CHANGELOG.md](CHANGELOG.md) for full history.
 
----
-
 ## Table of Contents
 
 - [Install](#install)
@@ -147,7 +153,7 @@ See [CLI Reference](kb/reference/cli-reference.md) for all commands and options.
 | `skills/` (knowledge) | 46 | Domain knowledge auto-loaded by agents (includes 13 `<lang>-rules` skills) |
 | `agents/` | 44 | Specialized agents across 10 categories |
 | `hooks/` | 28 entries / 14 events + statusLine | Quality gates, path safety, prompt governance, loop guard, session lifecycle |
-| `plugins/` | 11 packs | Opt-in domain bundles (security, research, frontend, enterprise, memory, 6 language packs) |
+| `plugins/` | 2 packs | Opt-in packs that install files of their own (memory, enterprise) |
 | `constitution.md` | 7 articles | Machine-enforced safety rules |
 | `rules/` | auto-synced | Global/project rule files for Claude and other editors |
 | `kb/` | reference docs | Architecture, procedures, and best practices |
@@ -164,7 +170,7 @@ ai-toolkit/
 │   ├── rules/           # Source rules synced into Claude/editor rule files
 │   ├── hooks/           # Hook scripts (29 entries, 14 lifecycle events)
 │   ├── claude-app/      # Generated Chat/Cowork plugin rules, hooks, instructions
-│   ├── plugins/         # 11 experimental plugin packs (opt-in)
+│   ├── plugins/         # 2 experimental plugin packs (opt-in)
 │   ├── output-styles/   # System prompt output style overrides
 │   ├── constitution.md  # 7 immutable safety articles
 │   └── ARCHITECTURE.md  # Full system design
@@ -312,7 +318,15 @@ See [SECURITY.md](SECURITY.md) for responsible disclosure policy.
 
 ## License
 
-MIT — see [LICENSE](LICENSE).
+Apache License 2.0 — see [LICENSE](LICENSE) and [NOTICE](NOTICE).
+
+Fork it, modify it, ship it commercially. Three things the licence asks in return:
+
+- **Keep the attribution.** Redistributions must carry the contents of [NOTICE](NOTICE) (§4d) — that is where the project name, copyright and source URL live.
+- **Say what you changed.** Modified files must carry a prominent notice stating that you changed them (§4b).
+- **Names are not included.** The licence grants no rights to the "ai-toolkit" or "SoftSpark" names or marks (§6).
+
+Releases up to and including v4.20.0 were published under MIT and stay available under MIT; the change applies going forward and revokes nothing already granted. Contributions received while the project was MIT-licensed remain their authors' copyright and are redistributed under Apache 2.0 with the original MIT notice preserved in [NOTICE](NOTICE), as MIT requires.
 
 ## Changelog
 

package/app/.claude-plugin/plugin.json

@@ -3,13 +3,13 @@
   "name": "ai-toolkit",
   "displayName": "AI Toolkit",
   "description": "Professional-grade engineering skills, agents, rules, and lifecycle guardrails for Claude Code, Claude Chat, and Cowork.",
-  "version": "4.19.1",
+  "version": "4.21.0",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"
   },
   "repository": "https://github.com/softspark/ai-toolkit",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "homepage": "https://github.com/softspark/ai-toolkit",
   "skills": "./claude-app/skills/",
   "hooks": "./claude-app/hooks/hooks.json",

package/app/hooks/_hook-io.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # _hook-io.sh — shared JSON input/output helpers for multi-editor hooks.
 #
 # Source this file from hook scripts. It expects the caller to set INPUT to the

package/app/hooks/_locate-toolkit.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # _locate-toolkit.sh — shared toolkit-root locator for hooks needing scripts/.
 #
 # Source this file to get $TOOLKIT_DIR set to the ai-toolkit checkout root.

package/app/hooks/_profile-check.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # _profile-check.sh — shared profile skip logic for hooks
 # Source this file at the top of any hook that should be skipped in minimal profile.
 #

package/app/hooks/_search-capability.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # _search-capability.sh — determine whether strict search-first enforcement is safe.
 #
 # Default is conservative: do not block users unless a search provider is

package/app/hooks/_session-paths.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # _session-paths.sh — shared per-repo session storage paths for lifecycle hooks.
 #
 # All auto-generated session artifacts live OUTSIDE the project repo, under a

package/app/hooks/ai-toolkit-statusline.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # ai-toolkit-statusline.sh — comprehensive Claude Code status line.
 #
 # Renders one line. Left side: cwd, git, ctx%, i/o token split.

package/app/hooks/commit-quality.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # commit-quality.sh — Advisory commit message quality check.
 #
 # Fires on: PreToolUse (Bash)

package/app/hooks/config-desync-guard.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # config-desync-guard.sh — Warn when ~/.claude/settings.json drifts from
 # the ai-toolkit source manifest (app/hooks.json).
 #

package/app/hooks/governance-capture.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # governance-capture.sh — Log security-sensitive operations to governance log.
 #
 # Fires on: PostToolUse

package/app/hooks/guard-config.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # guard-config.sh — Block edits to linter/formatter config files unless explicitly requested.
 #
 # Fires on: PreToolUse (Edit|Write|MultiEdit)

package/app/hooks/guard-destructive.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # guard-destructive.sh — Block destructive bash commands.
 #
 # Fires on: PreToolUse (Bash)

package/app/hooks/guard-path.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # guard-path.sh — Prevent Claude from guessing/hallucinating user home directory paths.
 #
 # Fires on: PreToolUse (Bash|Read|Edit|Write|MultiEdit|Glob|Grep|NotebookEdit|mcp__filesystem__.*)

package/app/hooks/instructions-audit.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Lukasz Krzemien (biuro@softspark.eu)
+# Source: https://github.com/softspark/ai-toolkit
+#
 # instructions-audit.sh — Log which CLAUDE.md / rules / skills loaded.
 #
 # Fires on: InstructionsLoaded