Prepare Posecode 0.3 licensing boundary

.changeset/config.json

@@ -16,5 +16,8 @@
   "baseBranch": "main",
   "privatePackages": false,
   "updateInternalDependencies": "patch",
+  "___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH": {
+    "onlyUpdatePeerDependentsWhenOutOfRange": true
+  },
   "ignore": []
 }

.changeset/open-product-boundary.md

@@ -0,0 +1,9 @@
+---
+"posecode-parser": minor
+"posecode-render": minor
+"posecode-share": minor
+"posecode-embed": minor
+"posecode-mcp": minor
+---
+
+Establish the Posecode 0.3 open-standard and product-layer license boundary. The specification, parser, and share codec remain Apache-2.0. The renderer, embed, and MCP product surfaces move to AGPL-3.0-only with a separately negotiated commercial option. Earlier MIT and Apache-2.0 releases keep their existing rights.

COMMERCIAL-LICENSE.md

@@ -0,0 +1,9 @@
+# Commercial licensing
+
+Posecode's product-facing packages are available under AGPL-3.0-only. Organizations that cannot comply with AGPL-3.0 may contact [hello@posecode.org](mailto:hello@posecode.org?subject=Posecode%20commercial%20license) to discuss a separate commercial agreement.
+
+A commercial agreement may cover closed-source embedding, white-label distribution, support, security review, maintenance commitments, or service-level terms.
+
+This file is not a commercial license, price list, offer, warranty, support commitment, or grant of additional rights. Commercial rights exist only after both parties execute a separate written agreement.
+
+Apache-2.0 components listed in `LICENSING.md` do not require a Posecode commercial license when used in accordance with Apache-2.0.

CONTRIBUTING.md

@@ -109,3 +109,19 @@ To add a new movement preset to the catalog:
 - **TypeScript First**: All core library files must be written in strongly-typed TypeScript.
 - **Framework-Agnostic Core**: Keep packages under `packages/` dependency-light and decoupled from frontend frameworks (like React or Vue) to maximize embeddability.
 - **Range of Motion Clamping**: Never bypass the `posecode-parser` ROM bounds. All custom rigs or movements must adhere to healthy physical thresholds.
+
+---
+
+## Licensing and sign-off
+
+Every commit must include a Developer Certificate of Origin sign-off:
+
+```bash
+git commit -s
+```
+
+The sign-off certifies the statements in [DCO](DCO). It does not transfer copyright.
+
+Contributions to Apache-2.0 components are accepted under Apache-2.0. Product-layer components are AGPL-3.0-only and are also intended for separate commercial licensing. External contributions to the product layer require a separately executed, lawyer-reviewed contributor license agreement before merge. Until that agreement is available, maintainers must not merge external product-layer code.
+
+Do not submit code, assets, model output, or employer-owned work unless you have the right to contribute it under the applicable terms. Identify material AI assistance in the pull request when it produced a substantial part of the contribution.

DCO

@@ -0,0 +1,18 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or
+
+(c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it.
+
+(d) I understand and agree that this project and the contribution are public and that a record of the contribution, including all personal information I submit with it, including my sign-off, is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved.

LEGAL_REVIEW.md

@@ -0,0 +1,28 @@
+# Legal review checklist
+
+This is an engineering audit checklist, not legal advice. Resolve these points with an intellectual-property lawyer before relying on dual licensing at scale.
+
+## Copyright ownership and relicensing authority
+
+- Repository shortlog review on 2026-07-18 found one apparent human contributor represented by two author-name aliases sharing the same email address, plus Claude, Copilot, Dependabot, and GitHub Actions identities. Confirm that no commits attributed to tools or bots incorporate copyright owned by an undisclosed human or third party.
+- Confirm that the project owner personally owns the relevant code or has written assignments from any employer, client, cofounder, contractor, or other party whose agreement could cover the work.
+- Review material AI-assisted code under the applicable provider terms and local law. Confirm provenance, training-output risk policy, and whether the desired copyright and commercial relicensing position is supportable.
+- Preserve immutable evidence of the versions previously released under MIT and Apache-2.0, including Git tags, npm metadata, and release records.
+
+## Contributor strategy
+
+- DCO sign-off documents contributor provenance but does not itself grant broad relicensing authority.
+- Before accepting external contributions to an AGPL component that will also be commercially licensed, adopt a lawyer-reviewed individual and corporate CLA or another explicit copyright/relicensing grant.
+- Define how existing contributions will be handled if a contributor cannot or will not sign the future CLA. Keep those contributions out of commercially relicensed builds unless counsel confirms another basis.
+
+## Commercial and brand documents
+
+- Have counsel draft the actual commercial license agreement, warranty and liability terms, support terms, SLA, privacy terms, export controls, and pricing/order documents. `COMMERCIAL-LICENSE.md` is only a contact notice.
+- Confirm ownership and registrability of the Posecode name and logos before trademark registration, enforcement, or representations about exclusive rights.
+- Review product copy so “open source” always identifies the Apache-2.0 and AGPL-3.0 split and does not imply that third-party assets share those licenses.
+
+## Third-party materials
+
+- Recheck the current Adobe Mixamo terms for redistribution of `xbot.glb` and `jumping-jacks.fbx`, especially for npm, source archives, hosted demos, white-label offerings, and customer redistribution.
+- Replace the remaining Mixamo-derived files with owned or clearly redistributable assets if the intended distribution is not covered.
+- Run a dependency and source-provenance audit for every release artifact, including bundled JavaScript, model files, fonts, images, and generated content. Preserve all required notices.