LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jeffrey Paul <sneak@sneak.berlin>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,7 +1,8 @@
 # lora.vegas
 
-`lora.vegas` is the website of the Las Vegas Meshtastic and LoRa community: a
-single-page static site, built with Hugo, by [@sneak](https://sneak.berlin).
+`lora.vegas` is the website of the Las Vegas Meshtastic and LoRa community: an
+MIT-licensed single-page static site, built with Hugo, by
+[@sneak](https://sneak.berlin).
 
 It publishes what the local mesh needs in one linkable place:
 
@@ -109,7 +110,9 @@ The live task list is in [TODO.md](TODO.md).
 
 ## License
 
-Content is provided as-is for community use.
+MIT. See [LICENSE](LICENSE). This covers everything in the repository — the Hugo
+configuration, the `script/` entrypoints, the vendored `themes/loravega/`
+templates and CSS, and the site content in `content/`.
 
 ## Author
 

TODO.md

@@ -13,23 +13,49 @@
 pre-1.0
 
 No git tags. The site is live and now has the scripts-to-rule-them-all scaffold
-(`Makefile`, `script/`, `Dockerfile`, `check.yml`) and the canonical policy
-dotfiles; `LICENSE` is the only mandated file still missing. Every external
-reference in the repo is now pinned by cryptographic hash (or, for the wrangler
-CLI install, an exact version), and the Hugo that builds the published site is a
-deliberate pinned version rather than whatever the base image's package repo
-serves. The site now ships a Cloudflare Pages `_headers` file, so its response
-security headers are declared in the repo instead of being whatever the edge
-defaults to — unverified in production until the next deploy.
+(`Makefile`, `script/`, `Dockerfile`, `check.yml`), the canonical policy
+dotfiles and `LICENSE`, so the mandated minimum file list is complete. Every
+external reference in the repo is now pinned by cryptographic hash (or, for the
+wrangler CLI install, an exact version), and the Hugo that builds the published
+site is a deliberate pinned version rather than whatever the base image's
+package repo serves. The site now ships a Cloudflare Pages `_headers` file, so
+its response security headers are declared in the repo instead of being whatever
+the edge defaults to — unverified in production until the next deploy.
 
 # Next Step
 
-Add `LICENSE` (#10) and replace the README's "content is provided as-is" note
-with the committed license. Blocked on the owner's choice of license — the
-remaining policy scaffold is otherwise complete.
+Move the artifact actions in `.gitea/workflows/deploy.yml` to v4 once this Gitea
+Actions instance serves the v4 artifact protocol; they are pinned on the
+deprecated v3 line because v4 fails here (#20). This touches the live deploy
+path, so it needs a real workflow run to verify rather than a local check.
 
 # Completed Steps
 
+- 2026-08-10: added the `LICENSE` file and made the README say what it says
+  (closes #10). The repo is public (`private: false` on the Gitea API, verified
+  rather than assumed), so the owner's standing policy — MIT on any public repo
+  lacking a license — applies. `LICENSE` is byte-identical to the canonical
+  `sneak/homoicon` copy, confirmed by git blob hash rather than by eye
+  (`3274443`), and its body is word-for-word the SPDX MIT text with only the
+  line wrapping differing. The README's "Content is provided as-is for community
+  use." — which granted nothing and matched no committed file — is replaced by
+  `MIT. See [LICENSE](LICENSE).` plus an explicit statement that the licence
+  covers the content in `content/` as well as the code, since this repo carries
+  both and MIT names only "the Software". The Description first line now carries
+  the licence, which `REPO_POLICIES.md` requires and which was the one field it
+  was missing. Nothing published contradicts the choice: the built `public/`
+  tree carries no copyright, all-rights-reserved or terms-of-use string
+  anywhere, in `index.html`, `css/style.css`, `index.xml` or `sitemap.xml` — the
+  footer `baseof.html` renders names `@sneak` and links the repo but asserts no
+  reservation of rights, and the content is factual mesh channel data with no
+  licence claim of its own. The fmt gate cannot reach `LICENSE` and needed no
+  `.prettierignore` entry: `script/fmt` passes prettier the explicit globs
+  `'**/*.md'` and `'**/*.css'`, and an extensionless root file matches neither.
+  Measured, not assumed — a `script/fmt` run leaves the file's hash unchanged,
+  and a counterfactual `LICENSE.md` copy was reflowed by the same run, which is
+  the direct evidence that it is the extension and not an ignore rule doing the
+  excluding. Deliberately not done, per the issue: per-file licence headers and
+  SPDX identifiers, which no org standard mandates
 - 2026-08-09: added `static/_headers` so Cloudflare Pages serves baseline
   response security headers (closes #14). Hugo copies `static/` verbatim into
   `public/`, which is the deploy root Pages reads the file from; this is the
@@ -200,9 +226,6 @@ remaining policy scaffold is otherwise complete.
 
 # Future Steps
 
-- Move the artifact actions to v4 once this Gitea Actions instance serves the v4
-  artifact protocol; they are pinned on the deprecated v3 line because v4 fails
-  here (#20)
 - Move the deploy container to a pinned node 22 so the wrangler pin can advance
   past 4.86.0 (#21)
 - After the next deploy, confirm the `_headers` file actually took effect, on