chore: license under AGPL-3.0-or-later

README.md

@@ -302,3 +302,7 @@ Three in-app reference UIs render the same spec — `/scalar` (Scalar), `/docs`
 | `OPF_DECODE_MODE`              | `viterbi` or `argmax`. OPF-only. Default `viterbi`.                  |
 | `SKYFLOW_VAULT_URL` / `_ID` / `_BEARER_TOKEN` | Required for the `skyflow` **detector**.              |
 | `SKYFLOW_TOKEN_VAULT_URL` / `_ID` / `_BEARER_TOKEN` | Required for `/api/replace` `label_token` mode. See [docs/token-vault-setup.md](docs/token-vault-setup.md). |
+
+## License
+
+Licensed under the **GNU Affero General Public License v3.0 or later** ([LICENSE](LICENSE)). Notably, the AGPL's network clause (§13) requires anyone who runs a modified version of this code as a network service to make the modified source available to its users. The unmodified upstream OPF model in [`privacy-filter/`](https://github.com/openai/privacy-filter) is licensed separately by its author and is not relicensed by this repo.

api/pyproject.toml

@@ -1,7 +1,9 @@
 [project]
 name = "opf-api"
-version = "0.6.0"
+version = "0.6.1"
 description = "Unified privacy-detection API — one contract, multiple backends"
+license = "AGPL-3.0-or-later"
+license-files = ["../LICENSE"]
 requires-python = ">=3.10"
 dependencies = [
     "opf",

api/src/opf_api/main.py

@@ -104,7 +104,7 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(
     title="Privacy-detection API",
-    version="0.6.0",
+    version="0.6.1",
     summary="Unified PII detection across OPF, GLiNER, Presidio, and Skyflow.",
     description=API_DESCRIPTION,
     lifespan=lifespan,
@@ -113,6 +113,10 @@ async def lifespan(app: FastAPI):
         "name": "local-privacy",
         "url": "https://github.com/jstjoe/local-privacy",
     },
+    license_info={
+        "name": "AGPL-3.0-or-later",
+        "url": "https://www.gnu.org/licenses/agpl-3.0.html",
+    },
     servers=[
         {"url": "http://localhost:8000", "description": "Local dev"},
     ],

docs/api/openapi.json

@@ -748,9 +748,13 @@
       "url": "https://github.com/jstjoe/local-privacy"
     },
     "description": "Unified PII detection across **OPF**, **GLiNER**, **Presidio**, and **Skyflow**.\nPick a backend with the `detector` field; canonical labels apply uniformly across all of them.\n\n## Endpoints\n\n- `POST /api/find` \u2014 find sensitive data; return spans only, no text rewriting.\n- `POST /api/replace` \u2014 find spans and replace each one under one of four modes.\n- `GET /api/detectors` \u2014 list registered detectors and their category coverage.\n- `GET /api/health` \u2014 liveness probe; does not exercise detector backends.\n\n## Versioning\n\nThe API is pre-`1.0`. `info.version` is the only version surface today \u2014\nevery breaking change to request or response shape lands as a minor bump\n(`0.x.0 -> 0.(x+1).0`); non-breaking additions land as patch bumps.\n\nURL paths are unversioned (`/api/...`). When the API stabilizes, the\nintent is to move to **header-based date-string versioning** in the style\nof Stripe \u2014 clients will pin to a release date via `API-Version:\n2026-05-13`. Until that header lands, treat `info.version` as the contract.\n\n## Canonical labels\n\nEvery detector's raw output maps into a 15-label taxonomy:\n`PERSON`, `EMAIL`, `PHONE`, `ADDRESS`, `URL`, `DATE`, `ACCOUNT`, `SECRET`, `USERNAME`,\n`DEMOGRAPHIC`, `ORGANIZATION`, `OCCUPATION`, `MONEY`, `VEHICLE`, `PHYSICAL`.\nDetectors vary in coverage \u2014 `GET /api/detectors` reports each detector's category list.\n",
+    "license": {
+      "name": "AGPL-3.0-or-later",
+      "url": "https://www.gnu.org/licenses/agpl-3.0.html"
+    },
     "summary": "Unified PII detection across OPF, GLiNER, Presidio, and Skyflow.",
     "title": "Privacy-detection API",
-    "version": "0.6.0"
+    "version": "0.6.1"
   },
   "openapi": "3.1.0",
   "paths": {

docs/api/openapi.yaml

@@ -56,7 +56,10 @@ info:
   contact:
     name: local-privacy
     url: https://github.com/jstjoe/local-privacy
-  version: 0.6.0
+  license:
+    name: AGPL-3.0-or-later
+    url: https://www.gnu.org/licenses/agpl-3.0.html
+  version: 0.6.1
 servers:
 - url: http://localhost:8000
   description: Local dev

docs/guides/overview.md

@@ -29,6 +29,6 @@ Then visit one of `/scalar`, `/docs`, `/redoc`. The OpenAPI spec itself lives at
 
 ## Versioning
 
-The API is pre-`1.0`. `info.version` (in this OpenAPI spec) is the only version surface today — currently `0.6.0`. Each breaking change to request or response shape lands as a minor bump (`0.x.0 -> 0.(x+1).0`); non-breaking additions land as patch bumps.
+The API is pre-`1.0`. `info.version` (in this OpenAPI spec) is the only version surface today — currently `0.6.1`. Each breaking change to request or response shape lands as a minor bump (`0.x.0 -> 0.(x+1).0`); non-breaking additions land as patch bumps.
 
 URL paths are unversioned (`/api/...`). When the API stabilizes, the intent is to move to **header-based date-string versioning** in the style of Stripe — clients will pin to a release date via `API-Version: 2026-05-13`. Until that header lands, treat `info.version` as the contract.

eval/pyproject.toml

@@ -2,6 +2,8 @@
 name = "opf-eval"
 version = "0.1.0"
 description = "Benchmark harness comparing OPF and Skyflow Detect"
+license = "AGPL-3.0-or-later"
+license-files = ["../LICENSE"]
 requires-python = ">=3.10"
 dependencies = [
     "opf",

pyproject.toml

@@ -2,6 +2,8 @@
 name = "local-privacy"
 version = "0.0.0"
 description = "Workspace root for OPF benchmark + REST API"
+license = "AGPL-3.0-or-later"
+license-files = ["LICENSE"]
 requires-python = ">=3.10"
 dependencies = [
     "opf",