license: remove GPL-family build tooling path

[seonghobae]

Problem

Noema commercial dependency baseline does not accept GPL/LGPL/AGPL-family tooling paths as ordinary inbound dependencies. The historical protected lockfile path wrangler → miniflare → sharp → @img/sharp-libvips-* carried LGPL-family metadata. Apache-2.0 source licensing does not relicense or waive third-party tooling obligations.

Current protected authority — 2026-09-10 KST

Fresh protected source is GitHub-verified main@b946d04236613544ceedb2160ed68b4e6d855dd8 after normal #582 integration. Source remediation from merged #540 remains protected history; it is not an active candidate and must not be reimplemented.

Current protected executable contract test/cloudflare-toolchain-license-boundary.test.ts still requires Wrangler, Miniflare, Sharp and @img/sharp-libvips-* to be absent from the committed dependency graph, pins direct esbuild@0.28.1 and workerd@1.20260625.1, requires deployment through scripts/cloudflare-worker-deploy.mjs, and rejects GPL/LGPL/AGPL-family lockfile metadata. It also verifies local development uses pinned workerd and does not reintroduce Wrangler/Miniflare. This is current source evidence, not immutable release evidence.

The former #540 exact candidate 05bc2d47c3899ebe17538070f9a30172f90307ac reached its unchanged-head CI/reviewer/Security/image evidence before normal integration. Subsequent protected work, including #542 durable runtime, #550 work-conserving workflow concurrency, #566 patch-validator image/runtime repair, #570/#573 lane-ordering repair, and #574–#582 lifecycle/operability work, has not reopened the retired dependency path.

Fresh Noema GitHub Release inventory on 2026-09-10 remains 0 releases. Therefore source remediation is protected, but immutable released-artifact rights/provenance evidence is still absent. Current Draft #583 is documentation-authority repair only and does not own this licensing/publication boundary.

Completion criteria

• Remove the Wrangler/Miniflare/Sharp/Libvips dependency path from protected source.
• Pin the direct workerd/esbuild contract and preserve deterministic lock/license evidence.
• Preserve work-conserving concurrency, durable runtime source and reviewer/package authority during ordinary/non-force convergence.
• Reach one unchanged fix(toolchain): replace Wrangler/Miniflare GPL-family path #540 exact head with terminal-success CI, reviewer-ci, required Security Scan and patch-validator-image evidence and clean review authority.
• Normal protected merge completed and the removal remains enforced by a current protected executable contract.
• Bind the exact then-current protected release candidate to package/SBOM/provenance/reproducibility evidence and an immutable release before distribution/acquisition readiness is claimed.
• Preserve third-party NOTICE/attribution and obtain explicit outbound-rights/transfer evidence for the actual released artifact; automation does not choose that legal authority.

Keep this issue open only for the release/publication/legal evidence class above. Source remediation itself is protected and must not be recreated in a successor lane.

Guardrails

Do not hide dependency/license metadata, mutate lock digests for apparent compliance, reuse PR-head checks as release evidence, choose outbound licensing authority by automation, weaken required gates, or recreate the retired tooling path. Publication/release evidence remains distinct from source integration and is coordinated with #36/#5/#66.

Related: #5, #27, #30, #36, #66, #558, #583.

[seonghobae]

Fresh licensing/toolchain due diligence narrows the replacement path rather than treating the LGPL finding as a documentation-only exception.

Verified current constraint

The repository's own docs/LICENSING_AND_IP_TRANSFER.md / gap baseline already identify the transitive development/deploy path wrangler -> miniflare -> sharp -> @img/sharp-libvips-* with LGPL-3.0-or-later. That remains commercially usable in the abstract but is incompatible with ContextualWisdomLab's no-GPL-family inbound policy, so upgrading Wrangler without proving the transitive graph changed is not closure.

Commercially compatible replacement boundary to evaluate

Cloudflare currently documents first-party HTTP APIs that cover the deployment responsibilities Noema actually needs without requiring the Wrangler/Miniflare dependency graph in the repository toolchain:

• Worker script upload: https://developers.cloudflare.com/api/resources/workers/subresources/scripts/methods/update/
• version upload: https://developers.cloudflare.com/api/resources/workers/subresources/scripts/subresources/versions/methods/create/
• multipart metadata / bindings / Durable Object migrations: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/
• script secret CRUD/bulk API: https://developers.cloudflare.com/api/resources/workers/

The direct API path is a candidate architecture, not yet an implementation claim. It still needs an exact contract for bundling the TypeScript Worker into the module uploaded to Cloudflare, deployment/version promotion, Durable Object migrations, secrets, rollback/provenance receipts, local development, and smoke evidence.

Closure bar

Do not close this issue merely because the root source license is Apache-2.0 or because the LGPL packages are optional/dev-only. Close only when the exact committed dependency graph no longer contains the disallowed GPL-family path and the replacement developer/deploy workflow preserves the existing Worker, Durable Object, secret, release-evidence, and rollback contracts with executable tests/CI. If Wrangler is retained, evidence must prove the exact pinned graph is policy-compatible; otherwise replace its repository-owned responsibilities with the direct API/bundling boundary or another Apache/MIT-compatible toolchain.

[seonghobae]

Fresh upstream feasibility evidence narrows the remediation path. Current Noema protected main@6b2b3e90dc3d5bd24cd27ed11db41b9eb7106010 still pins wrangler ^4.25.0 and overrides sharp to 0.35.3; the lock contains @img/sharp-libvips-* LGPL-family packages. A simple Wrangler upgrade is not a causal remedy: Cloudflare workers-sdk current packages/wrangler/package.json is 4.128.0 and still has a runtime dependency on miniflare; current upstream packages/miniflare/package.json (5.20260831.0-alpha on main) still depends directly on sharp 0.35.2. Thus the wrangler -> miniflare -> sharp -> libvips architecture remains upstream-current, even though the specific sharp security version has advanced.

Treat two hypotheses as falsified for #531: (1) upgrading only sharp; (2) upgrading only wrangler. Neither removes the LGPL-family build-tool path from the repository dependency graph. Do not suppress license inventory or weaken the policy. The remaining causal design space is a bounded replacement of Wrangler/Miniflare responsibilities (deployment and local Worker execution) with commercially compatible tooling/API/runtime boundaries, or an upstream Cloudflare release that actually removes the Sharp/Libvips dependency. Before source mutation, characterize the exact Noema-owned wrangler deploy and wrangler dev contracts and preserve them as RED tests; then choose the smallest replacement that removes the lockfile entries while keeping Worker deployment/dev semantics and exact-head release evidence.