Migrate current ARSVIN releases to GPL with commercial licensing

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,14 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Security report
+  - name: Security vulnerability
     url: https://github.com/masarray/arsvin/security/advisories/new
-    about: Please report security issues privately.
-  - name: Support guide
+    about: Report vulnerabilities privately. Do not publish exploit or confidential evidence.
+  - name: Support and sanitization guide
     url: https://github.com/masarray/arsvin/blob/main/SUPPORT.md
-    about: Read what information to include in support requests.
+    about: Review environment details, evidence limits, and data-sanitization requirements before filing an issue.
+  - name: Commercial licensing
+    url: https://github.com/masarray/arsvin/blob/main/COMMERCIAL-LICENSE.md
+    about: Review the commercial licensing notice. Do not post confidential commercial or station information publicly.
+  - name: Product website
+    url: https://masarray.github.io/arsvin/
+    about: Product overview, downloads, engineering documentation, and licensing model.

.github/pull_request_template.md

@@ -1,6 +1,10 @@
-## Summary
+## Engineering problem
 
-Describe the change, why it is needed, and the user or engineering impact.
+Describe the change, why it is needed, and whether it belongs in the shared engine, Publisher, Subscriber, documentation, website, or release tooling.
+
+## Solution
+
+Summarize the implementation and any application/engine boundary changes.
 
 ## Type of change
 
@@ -11,29 +15,46 @@ Describe the change, why it is needed, and the user or engineering impact.
 - [ ] Refactor
 - [ ] Build / CI
 - [ ] Release preparation
-- [ ] Safety wording / guardrail
+- [ ] Operational wording / guardrail
+- [ ] Licensing / provenance
 
-## Engineering notes
+## Engineering and evidence notes
 
-Explain any IEC 61850, Sampled Values, SCL/SCD, COMTRADE, PTP, timing, packet-layout, or UI behavior affected by this PR. Write **Not applicable** when the change is unrelated to runtime engineering behavior.
+Explain any IEC 61850, Sampled Values, SCL/SCD, COMTRADE, timing, packet-layout, capture, or UI behavior. Identify the requirement source and evidence environment. Write **Not applicable** when unrelated to runtime behavior.
 
-## Safety impact
+## Operational impact
 
 - [ ] No runtime or live-network behavior changes
-- [ ] Changes offline parsing, display, reporting, or PCAP behavior only
-- [ ] Changes live capture behavior and was tested on an authorized isolated link
-- [ ] Changes live packet publishing and was tested on an authorized isolated link
-- [ ] Safety documentation or warnings were reviewed and updated where needed
+- [ ] Offline parsing, display, reporting, or PCAP behavior only
+- [ ] Live capture was tested only on an authorized isolated link
+- [ ] Live transmission was tested only on an authorized isolated link
+- [ ] Operational documentation and warnings were reviewed
 
 ## Validation
 
+- [ ] Current-license, provenance, and public-wording checks passed
 - [ ] `dotnet build ARSVIN.sln -c Release`
-- [ ] `dotnet test tests/ARSVIN.Tests/ARSVIN.Tests.csproj -c Release`
-- [ ] Public-site validator passed, when applicable
+- [ ] Relevant automated tests and coverage gates passed
+- [ ] Public-site build and validator passed, when applicable
 - [ ] Release packaging and installer smoke test passed, when applicable
-- [ ] Manual dry run tested, when applicable
-- [ ] Live mode tested only on an isolated lab link, when applicable
+- [ ] Simulator, loopback, or dry-run evidence recorded, when applicable
+- [ ] Laboratory equipment evidence recorded, when applicable
+- [ ] Public documentation updated for changed behavior or claims
+
+## Data and external-material boundary
+
+- [ ] No confidential customer, employer, station, credential, restricted network, or production data is included
+- [ ] Any SCL, COMTRADE, PCAP, screenshot, or diagnostic sample is synthetic, contributor-owned, or documented as authorized and sanitized
+- [ ] No external proprietary code, API composition, example, test, wording, screenshot, manual, report, asset, or UI design was copied or mechanically translated
+- [ ] The change does not claim formal conformance, universal interoperability, calibrated measurement, deterministic timing, functional safety, cybersecurity approval, switching authority, or IED-consumption proof
+
+## Contribution licensing
+
+- [ ] I have read and affirmatively agree to `CONTRIBUTOR-LICENSE-AGREEMENT.md`
+- [ ] I have the legal right and any required employer or organizational authorization to submit this contribution
+- [ ] Every commit includes a DCO sign-off: `Signed-off-by: Name <email>`
+- [ ] Any third-party material is identified with its license and provenance
 
 ## Evidence
 
-Add relevant screenshots, sanitized Wireshark notes, test output, release artifact names, or a concise explanation when visual/packet evidence is not applicable.
+Add the smallest relevant test output, screenshots, or sanitized protocol evidence. Explain what the evidence demonstrates and what it does not demonstrate.

.github/workflows/ci.yml

@@ -12,12 +12,15 @@ permissions:
 
 jobs:
   public-content:
-    name: Validate public terminology
+    name: Validate licensing, provenance, and public wording
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
+      - name: Verify current GPL and commercial-license boundaries
+        run: python3 scripts/verify-current-license.py
+
       - name: Validate public terminology neutrality
         id: neutrality
         continue-on-error: true
@@ -54,6 +57,9 @@ jobs:
             src/**/packages.lock.json
             tests/**/packages.lock.json
 
+      - name: Verify current licensing and public wording
+        run: python scripts/verify-current-license.py
+
       - name: Build public site and HTML documentation
         run: python scripts/build-public-site.py --output artifacts/public-site
 
@@ -97,4 +103,4 @@ jobs:
         run: dotnet list src/ARSVIN/ARSVIN.csproj package --vulnerable --include-transitive
 
       - name: Subscriber dependency vulnerability report
-        run: dotnet list src/ARSVIN.Subscriber/ARSVIN.Subscriber.csproj package --vulnerable --include-transitive
+        run: dotnet list src/ARSVIN.Subscriber/ARSVIN.Subscriber.csproj package --vulnerable --include-transitive

.github/workflows/pages.yml

@@ -6,10 +6,17 @@ on:
     paths:
       - 'site/**'
       - 'docs/**'
+      - 'README.md'
+      - 'LICENSE'
+      - 'NOTICE'
+      - 'COMMERCIAL-LICENSE.md'
+      - 'TRADEMARK.md'
       - 'scripts/build-public-site.py'
+      - 'scripts/public_site_builder.py'
       - 'scripts/validate-public-site.ps1'
       - 'scripts/validate-public-site.py'
       - 'scripts/validate-public-neutrality.py'
+      - 'scripts/verify-current-license.py'
       - '.github/workflows/pages.yml'
   workflow_dispatch:
 
@@ -32,6 +39,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
+      - name: Verify current GPL and commercial-license boundaries
+        run: python3 scripts/verify-current-license.py
+
       - name: Validate public terminology neutrality
         run: python3 scripts/validate-public-neutrality.py
 
@@ -52,4 +62,4 @@ jobs:
 
       - name: Deploy
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

AGENTS.md

@@ -1,13 +1,32 @@
 # Repository Guidance
 
-ARSVIN is a focused IEC 61850 Sampled Values injector.
+ARSVIN is an IEC 61850 Sampled Values engineering suite with a shared engine, ARSVIN Publisher, and ArSubsv Subscriber.
 
-Priority order:
+## Priority order
 
-1. Correct SV injection behavior.
-2. Clean public user workflow.
-3. Multi-stream and COMTRADE reliability.
-4. Release automation and documentation.
-5. Avoid analyzer-style scope creep.
+1. Observable and evidence-backed Sampled Values behavior.
+2. Explicit operational guardrails for live capture and transmission.
+3. Clear separation between Publisher, Subscriber, and shared engine responsibilities.
+4. Repeatable SCL, COMTRADE, PCAP, scenario, test, and release workflows.
+5. Accurate public documentation, licensing, provenance, and claim boundaries.
+6. Performance and usability improvements that preserve engineering evidence.
 
-Do not add broad station-analysis features unless they directly support SV injection.
+## Architecture boundary
+
+Protocol parsing, stream generation, SCL semantics, profile observations, comparison logic, capture, and transport behavior belong in `ARSVIN.Engine`. WPF applications should consume typed engine contracts rather than reimplement protocol rules.
+
+## External-material boundary
+
+External software may be used only as a lawfully licensed black-box interoperability endpoint. Do not use unrelated source, API composition, examples, tests, internal structure, documentation wording, UI composition, screenshots, icons, reports, or extracted resources as implementation design material.
+
+Use synthetic or contributor-owned fixtures. Real SCL, COMTRADE, PCAP, screenshots, and diagnostics require documented authority to share and sanitization.
+
+## Public claim boundary
+
+Do not claim formal IEC 61850 conformance, universal interoperability, calibrated measurement, deterministic real-time execution, functional safety, cybersecurity certification, switching authority, or proof that another IED consumed a multicast stream.
+
+State the evidence source and use scoped terms such as implemented, tested, observed, provisional, unsupported, or not yet verified.
+
+## Licensing boundary
+
+Current community revisions are `GPL-3.0-or-later`. Historical Apache-2.0 revisions end at `9440f08b6909ef2dc93dd483cfdcb4e1e86077d0` and remain on `archive/apache-2.0-final`. Commercial rights require a separate negotiated agreement and can cover only rights controlled by the relevant copyright holder.