license: adopt MIT for project sources

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Pirate Ray contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -158,5 +158,7 @@ Windows toolchain; bundle creation requires an already reviewed runtime.
 - Vendor executables, DLLs, and drivers from the evidence snapshot are never
   run as part of analysis.
 
-No project license has been selected yet. Until that decision is recorded,
-the contents are not offered under an open-source license.
+The Pirate Ray's original code and documentation are available under the
+[MIT License](LICENSE). Bundled or referenced third-party material retains its
+own license and attribution requirements; see `third_party/licenses/` and
+[ADR 0003](docs/adr/0003-project-license-and-upstream-boundary.md).

docs/CODEX_HANDOFF.md

@@ -1,6 +1,6 @@
 # Codex continuation brief
 
-- Updated: 2026-10-24
+- Updated: 2026-10-26
 - Current focus: produce and accept the packaged Windows M1 checkpoint
 - Hardware access: prohibited
 - Automatic toolchain installation: prohibited
@@ -29,8 +29,8 @@ The repository now provides:
   timezone-stamped human review is recorded;
 - pinned upstream contract/license manifests and a drift checker;
 - a fail-closed API-23 adapter isolating Rayforge's internal driver registry;
-- a proposed MIT project-license decision in ADR 0003; Kaz has not accepted
-  it, so the repository remains unlicensed;
+- an accepted MIT project-license decision in ADR 0003 and a root `LICENSE`;
+  third-party notices and distribution-sidecar requirements remain in force;
 - a fail-closed M3 hardware-research protocol, incomplete public plan template
   and validator; validation can reach only `ready_for_review` and never
   authorizes hardware access.
@@ -111,8 +111,8 @@ order:
 If no artifact is available, send the external-builder handoff in
 `docs/research/m1-no-device-acceptance.md`; do not start another research
 branch or install a build environment here. The evidence-backed vector MOPA
-import mapping and synthetic tests are complete; Kaz's explicit decision on
-ADR 0003 is also outstanding.
+import mapping and synthetic tests are complete; ADR 0003 is accepted and the
+project's original code and documentation are licensed under MIT.
 The M3 protocol can also be reviewed offline, but its
 operation allowlist must stay empty until exact read-only request evidence is
 available. ADR 0002 is accepted for the offline architecture. Until the

docs/adr/0003-project-license-and-upstream-boundary.md

@@ -1,7 +1,8 @@
 # ADR 0003: Project license and upstream attribution boundary
 
-- Status: Proposed
+- Status: Accepted
 - Date: 2026-10-21
+- Accepted: 2026-10-23 by Kaz
 
 ## Context
 
@@ -33,7 +34,8 @@ separate project responsibilities.
 
 ## Consequences
 
-- A root project `LICENSE` can be added only after Kaz accepts this ADR.
+- The root project `LICENSE` grants MIT terms for original The Pirate Ray
+  code and documentation.
 - Source provenance becomes part of code review and release acceptance.
 - A Windows installer may not be published alone; its verified license
   sidecar and checkpoint manifest are part of the distribution set.
@@ -54,9 +56,10 @@ separate project responsibilities.
 
 ## Acceptance
 
-Kaz must explicitly choose the project license. Until then this ADR remains
-Proposed, the README's no-license statement remains authoritative, and no root
-`LICENSE` file is created.
+Kaz explicitly accepted the proposed MIT license on 2026-10-23. This ADR is
+therefore Accepted and the root `LICENSE` is authoritative for original The
+Pirate Ray code and documentation. Third-party material retains its own terms
+and attribution requirements.
 
 The compatibility-adapter part of item 5 is implemented for the offline addon
 and fails closed outside Rayforge addon API 23. This implementation evidence

docs/research/upstream-contract-and-license-audit.md

@@ -44,8 +44,8 @@ and permission notice to accompany copies or substantial portions. Therefore:
   include the MeerK40t notice;
 - attribution must name the upstream project and exact revision without
   implying endorsement;
-- The Pirate Ray still needs its own explicit license before original project
-  code is offered under open-source terms.
+- The Pirate Ray's original code and documentation are licensed under MIT by
+  accepted ADR 0003; third-party notices remain separately required.
 
 Checkpoint schema 2 now requires a verified Rayforge license sidecar and the
 same notice inside the portable ZIP. The installer must be distributed with
@@ -86,10 +86,10 @@ Before adapting any BalorMK implementation code:
 5. review the resulting diff for copied comments, identifiers and substantial
    structure rather than assuming a rewrite has no attribution duty.
 
-## Recommendation requiring owner decision
+## Accepted owner decision
 
 MIT is the simplest project-license candidate because both principal
 upstreams use MIT and the intended addon is meant for upstream contribution.
-This audit does not select it. Kaz must explicitly approve the project license
-before a root `LICENSE` file is added or upstream implementation code is
-adapted.
+Kaz accepted MIT for The Pirate Ray on 2026-10-23 in ADR 0003. This does not
+waive the source provenance, upstream notice or adaptation-review requirements
+recorded above.

docs/roadmap.md

@@ -354,7 +354,8 @@ The pinned upstream contracts and license notices are now machine-verifiable.
 Rayforge's documented addon lifecycle is viable, but production driver
 registration still needs a supported symmetric registry API. The current
 internal access is contained by a fail-closed API-23 compatibility adapter;
-project license selection remains an explicit owner decision in ADR 0003.
+the project license is MIT under accepted ADR 0003; upstream attribution and
+distribution notice requirements remain mandatory.
 
 ## Decision rules