license: replace GPL-family runtime and normalize repository grant

[seonghobae]

Problem

Commercial-license due diligence on the public README lane found two incompatible licensing boundaries that must be resolved before aFIPC can be presented as compliant with ContextualWisdomLab's inbound policy.

1. DESCRIPTION currently declares License: GPL-3 | file LICENSE, while the root LICENSE contains only YEAR: 2026 and COPYRIGHT HOLDER: Seongho Bae rather than a complete standalone permissive grant.
2. DESCRIPTION directly imports mirt, and the calibration implementation calls mirt::mirt, mirt::mod2values, and related APIs throughout the core linking path. Current CRAN metadata for mirt 1.47 (published 2026-08-20) declares GPL (>= 3): https://cran.r-project.org/package=mirt.

ContextualWisdomLab's commercial intake policy does not accept GPL/LGPL/AGPL-family software as the normal dependency baseline. The repository's own source license and the third-party runtime dependency are separate questions; changing README prose or a root license file alone cannot make the current runtime graph policy-compatible.

Provenance observed

• The repository's initial commit c799d59cd04f85c080ec869b5647a2252d190ea3 is authored/committed by seonghobae and already contains the core autoFIPC() implementation identifying Seongho Bae in the package output.
• Current package metadata names Seongho Bae as author/maintainer.
• This evidence supports a focused relicensing review of the repository-authored source, but it is not sufficient to waive the separate mirt obligation or any later third-party contribution/provenance issue.

Required outcome

Replace the GPL-family runtime path with a commercially compatible implementation boundary while preserving the actual aFIPC estimand and fixed-item linking behavior. Candidate work must not silently substitute a different psychometric model merely to remove the dependency.

Acceptance should include:

• no GPL/LGPL/AGPL-family runtime, build, vendored, copied-source, or derivative obligation in the committed dependency/material inventory under the intended distribution model;
• explicit Apache-2.0 or MIT repository grant only after the complete source/contributor provenance supports it;
• package metadata and root license bytes agree on that grant;
• regression fixtures that establish numerical compatibility for the fixed-item calibration/linking outputs currently produced through mirt;
• R CMD check and package tests on the replacement graph;
• updated README/docs that distinguish repository source licensing from third-party dependencies.

Do not close this by suppressing dependency-license evidence, classifying mirt as merely optional while the core code still calls it, or by treating commercial use permitted by GPL as equivalent to the organization's no-GPL-family intake policy.

[seonghobae]

Owner-path evidence for the GPL-family runtime replacement is now concrete enough to narrow the prerequisite, but not to declare the issue solved.

fast-mlsirm is an active dedicated-owner repository, so this fleet writer is not modifying it. Its immutable v0.9.1 release (published 2026-08-26) is MIT-licensed at the package/repository level, lists only NumPy as its Python runtime dependency, and ships Rust-owned marginal fitting. The released fitting path has an explicit FIPC mode: when anchors are supplied it selects pop_kind="singlefree", requires at least two fixed anchors per trait dimension, passes fixed alpha/b/zeta (and optional tau) into the compiled Rust fit_marginal, and fails closed rather than silently selecting the NumPy reference backend. The same release also exposes link_fixed_item_parameters() with Rust-owned affine linking and fixed_item_calibration_diagnostics().

That is a plausible canonical numerical owner, not yet a drop-in replacement for aFIPC/mirt. aFIPC supports model/parameter contracts that must be compared explicitly (including its 2PL/3PL/Rasch/itemtype behavior, old-form fixed-anchor semantics, free mean/variance controls, IPD path, expected-score/theta outputs, SE/vcov/second-order evidence). link_fixed_item_parameters() is a post-fit metric transform, and fixed_item_calibration_diagnostics() ranks supplied probability candidates; neither alone proves parity with autoFIPC() calibration.

RED → GREEN acceptance for the owner/consumer handoff:

1. fast-mlsirm owner RED: against the immutable v0.9.1 API, run an aFIPC compatibility matrix using right-cleared or publication-derived realistic item designs: 2PL first, then every aFIPC model family actually retained for commercial support. Include shifted/non-normal latent distributions, multiple sample sizes and anchor proportions, missing responses, and invalid/missing anchor schemas. Record all seeds and keep failed replications in the denominator.
2. Scientific GREEN: for the same estimand, demonstrate anchor fixity plus true-parameter recovery RMSE, signed bias and interval coverage; verify theta/expected-score scale behavior and finite uncertainty/second-order diagnostics where aFIPC promises them. Do not accept correlation-only or one-seed equivalence.
3. Contract GREEN in fast-mlsirm: if v0.9.1 cannot express the required fixed-calibration estimand, add the smallest Rust-owned released API there rather than copying estimator code into aFIPC. Publish a new immutable version with CHANGELOG, tests, SBOM/provenance and dependency-license inventory. No mutable sibling-head consumption.
4. aFIPC consumer GREEN: replace mirt only after that immutable owner release exists, pin/declare the released dependency contract, remove the GPL-family runtime path rather than hiding it behind optional metadata, and rerun the aFIPC fixed-anchor contract plus test: true-parameter FIPC linking RMSE recovery gate #264-style recovery evidence on the exact consumer head.
5. Commercial/relicense GREEN: only after the runtime graph and transitive license inventory are policy-compatible, complete the repository source/contributor provenance needed for any aFIPC license-grant change. This is repository-policy acceptance, not a legal conclusion.

Until all five are green, #320 remains the commercial-release prerequisite. The useful change is that the replacement path no longer needs to start from a new numerical engine: the first compatibility target is the already immutable fast-mlsirm v0.9.1 contract, with any missing estimand capability repaired by its dedicated owner and released before aFIPC consumes it.