chore: formalize Bessemer as an Apache-2.0 project

CONTRIBUTING.md

@@ -43,5 +43,6 @@ Report vulnerabilities through the private process in
 
 ## License
 
-Contributions are licensed under both the [MIT license](LICENSE-MIT) and the
-[Apache License 2.0](LICENSE-APACHE).
+Unless explicitly stated otherwise, contributions submitted to Bessemer are
+licensed under the [Apache License 2.0](LICENSE-APACHE). Preserve every
+copyright, license, and attribution notice in inherited files.

Cargo.toml

@@ -167,7 +167,7 @@ resolver = "2"
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-license = "MIT OR Apache-2.0"
+license = "Apache-2.0"
 repository = "https://github.com/dedalus-labs/bsmr"
 
 [workspace.dependencies]

NOTICE

@@ -1,3 +1,11 @@
+Bessemer
+Copyright (c) 2026 Dedalus Labs, Inc. and its contributors
+
+Bessemer is derived from Buck2, copyright Meta Platforms, Inc. and affiliates.
+Except where an inherited notice states otherwise, Bessemer is licensed under
+Apache-2.0. Buck2-derived and third-party files retain their original
+copyright, license, and attribution notices.
+
 The code in `app/bsmr_error_derive` is adapted from thiserror (https://github.com/dtolnay/thiserror).
 
 The code in `tools/testing/completion/verify/src/runtime` is adapted from `complete_pty`

README.md

@@ -38,5 +38,10 @@ that remote should remain disabled.
 
 ## License
 
-Bessemer is available under either the [MIT license](LICENSE-MIT) or the
-[Apache License 2.0](LICENSE-APACHE).
+Except where an inherited notice states otherwise, Bessemer is licensed under
+the [Apache License 2.0](LICENSE-APACHE).
+
+Buck2-derived and third-party files retain their original copyright and
+license notices. [LICENSE-MIT](LICENSE-MIT) records Meta's upstream grant; it
+does not license Bessemer-authored additions under MIT. See [NOTICE](NOTICE)
+for attribution details.

STYLE.md

@@ -5,7 +5,7 @@ Bessemer code should be obvious to inspect, operate, and extend.
 ## Source documentation
 
 - Start every new Dedalus-owned source file with the repository preamble below.
-- State the file's responsibility in one sentence inside the preamble.
+- State the file's responsibility in one sentence below the legal header, after one blank line.
 - Preserve existing Meta and third-party notices exactly. Claim Dedalus copyright only for Dedalus-authored work.
 - Mark modifications when an inherited file's license requires it; never replace the original notice.
 - Document every named function in new or materially modified code with the language's native documentation syntax.
@@ -16,11 +16,11 @@ Bessemer code should be obvious to inspect, operate, and extend.
 
 ```text
 //===----------------------------------------------------------------------===//
-// Copyright 2026 Dedalus Labs, Inc.
-// SPDX-License-Identifier: MIT OR Apache-2.0
-//
-// Describe this file's single responsibility.
+// Copyright (c) 2026 Dedalus Labs, Inc. and its contributors
+// SPDX-License-Identifier: Apache-2.0
 //===----------------------------------------------------------------------===//
+
+// Describe this file's single responsibility.
 ```
 
 ## Engineering

ci/cli.test.ts

@@ -1,10 +1,10 @@
 //===----------------------------------------------------------------------===//
-// Copyright 2026 Dedalus Labs, Inc.
-// SPDX-License-Identifier: MIT OR Apache-2.0
-//
-// Verifies CLI command selection, ordering, and fail-fast execution.
+// Copyright (c) 2026 Dedalus Labs, Inc. and its contributors
+// SPDX-License-Identifier: Apache-2.0
 //===----------------------------------------------------------------------===//
 
+// Verifies CLI command selection, ordering, and fail-fast execution.
+
 import assert from "node:assert/strict";
 import { readFile } from "node:fs/promises";
 import { test } from "node:test";

ci/cli.ts

@@ -1,10 +1,10 @@
 //===----------------------------------------------------------------------===//
-// Copyright 2026 Dedalus Labs, Inc.
-// SPDX-License-Identifier: MIT OR Apache-2.0
-//
-// Routes repository CI commands through Hollywood's typed process executor.
+// Copyright (c) 2026 Dedalus Labs, Inc. and its contributors
+// SPDX-License-Identifier: Apache-2.0
 //===----------------------------------------------------------------------===//
 
+// Routes repository CI commands through Hollywood's typed process executor.
+
 import { realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

docs/getting_started/what_is_bsmr.md

@@ -15,6 +15,7 @@ It provides:
 - a shared prelude for common language toolchains.
 
 Bessemer is derived from
-[Buck2](https://github.com/facebook/buck2). The project retains upstream
-copyright notices and licenses while developing under its own name and public
-interfaces.
+[Buck2](https://github.com/facebook/buck2). Except where an inherited notice
+states otherwise, Bessemer is licensed under Apache-2.0. Buck2-derived and
+third-party files retain their original copyright, license, and attribution
+notices.

package.json

@@ -2,6 +2,7 @@
 	"name": "bsmr-ci",
 	"private": true,
 	"type": "module",
+	"license": "Apache-2.0",
 	"scripts": {
 		"ci": "node ci/cli.ts"
 	},

packages/rust/starlark/starlark_js_example/Cargo.toml

@@ -1,6 +1,7 @@
 [package]
 description = "Example of running starlark-rust interpreter in browser"
 edition = "2024"
+license = "Apache-2.0"
 name = "starlark_js_example"
 publish = false
 version = "0.0.0"

packages/rust/starlark/vscode/package.json

@@ -5,7 +5,7 @@
         "workspace"
     ],
     "author": "Facebook",
-    "license": "Apache2",
+    "license": "Apache-2.0",
     "version": "1.0.0",
     "repository": {
         "type": "git",