synapsecommand-public
Copyright 2026 Decent Cybersecurity s.r.o.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use
this work except in compliance with the License. You may obtain a copy of the
License in the LICENSE file at the root of this repository, or at:

    http://www.apache.org/licenses/LICENSE-2.0

--------------------------------------------------------------------------------
WHY THIS FILE AND NOT THE APPENDIX IN LICENSE

Apache-2.0's APPENDIX is a TEMPLATE FOR PER-FILE HEADERS — "attach the following
boilerplate notice, with the fields enclosed by brackets replaced with your own
identifying information". This repository has no per-file headers: NO tracked
file carries an SPDX tag, and every copyright notice in the tree is in a LICENCE
FILE — LICENSE, this file, and DCO, whose notice is the Linux Foundation's and
not ours, together with the byte-identical copies of LICENSE and this file that
sit beside packages/cdm/pyproject.toml. Those two copies exist for one reason
and have no other: setuptools resolves `license-files` against the DISTRIBUTION
root, so without them the built wheel carries the SPDX expression Apache-2.0 and
not one byte of licence text — and section 4(d), below, makes carrying this file
a condition of redistributing the Work. A wheel on an index is a redistribution.
tests/test_cdm_packaging.py makes any drift from the originals a build failure,
which is the only reason a second copy is allowed to exist at all. The licence
policy is stated at the repository level instead, in README.md and
CONTRIBUTING.md. Filling in a
template for headers that will never exist is completing the wrong form.

That sentence used to read "none of its 769 tracked files", and by the day this
repository went public the tree held 770. A count of every file in the
repository is a number that goes stale on the next commit that adds one, so it
is a stale-count generator rather than a fact — and the count was never the
claim. The claim is the ABSENCE. So the absence is what is stated, and it is
what tests/test_cdm_publication.py enforces over every tracked file, in both
halves: no SPDX tag anywhere, and no copyright notice outside a licence file —
where the set of licence files is derived from this repository's own packaging
declaration rather than typed out, so a copy added for a second distribution
cannot be forgotten in one place and remembered in the other.

NOTICE is the file Apache-2.0 actually defines for this. Section 4(d) requires a
redistributor of a Work that includes a NOTICE file to carry its attribution
notices forward, which is precisely the effect wanted — and it is achieved
without editing LICENSE, whose text stays byte-identical to the canonical
Apache-2.0 so that GitHub's licence detection and any SPDX scanner keep
recognising it. A modified LICENSE is a licence tools stop being sure about.

WHY ONE YEAR AND NOT A RANGE

2026 is the year of the first commit (d798601, 2026-08-22) and the current year.
A range asserts a span of authorship, and there is not yet a span to assert. When
this repository sees a second calendar year of work the convention is to extend
it then — a range written in advance is a claim about the future.

WHAT THIS FILE DOES NOT COVER

The specification documents this repository PINS are not part of the Work and are
not covered by this licence. None of their bytes is in this repository or in its
history: each is recorded by SHA-256, byte count, page count, edition and source
URL, and the documents themselves remain under their publishers' own terms —
EUROCONTROL's for the ASTERIX specifications, NATO's for the STANAGs and AEDPs,
MISB's for the Motion Imagery Standards Profile. See the pin records under
packages/cdm/synapse_cdm/fixtures/*/spec/ for each document's terms as its own
front matter states them.

THIRD-PARTY NOTICES RETAINED IN THE TREE, AND WHERE

Added 2026-09-21, adapter expansion phase 7. The rule above — no copyright
notice outside a licence file — is this repository's rule about ITS OWN work.
A third party's licence can oblige the opposite: BSD-2-Clause's first condition
is that a redistribution in source form "must retain the above copyright
notice", so a third-party file this repository redistributes carries that
party's notice by obligation, not as a per-file header of the Work. Those files
are enumerated here, one per line under the marker below, and
tests/test_cdm_publication.py reads THIS list: a listed file must exist, be
tracked and actually carry a notice, and no file outside the list may carry one.
The list is the vocabulary the policy lacked; the absence it states for the
Work's own files is unchanged.

  THIRD-PARTY NOTICE CARRIERS:
  packages/cdm/synapse_cdm/fixtures/aixm511/independent/donlon_extract.xml
  packages/cdm/synapse_cdm/fixtures/aixm511/independent/donlon_extract_arc_airspace.xml
  packages/cdm/synapse_cdm/fixtures/aixm511/spec/build_fixtures.py

The first two are extracts of the EUROCONTROL/FAA Donlon fictitious AIXM 5.1.1
data set (github.com/aixm/Donlon_2025, BSD-2-Clause), cut by the third — the
generator that writes them and therefore holds the notice it must write into
each — and every one carries the notice the licence requires verbatim, as the
comment at the top of the file. The extracts are the independent inputs of the
aixm511 adapter's `independent_expected` evidence category and are not part of
the Work's authorship; their provenance is fixtures/aixm511/independent/PROVENANCE.json.
