From 398f59f46136323f5310c83a2dbef3e8f0214fe9 Mon Sep 17 00:00:00 2001
From: Virgil <virgil@lethean.io>
Date: Mon, 30 Mar 2026 00:05:54 +0000
Subject: [PATCH] fix(ax): enforce SPDX headers in references

Co-Authored-By: Virgil <virgil@lethean.io>
---
 .core/reference/fs.go                         |  2 +
 .core/reference/log.go                        |  2 +
 pkg/lib/lib_test.go                           | 50 +++++++++++++++++++
 .../workspace/default/.core/reference/fs.go   |  2 +
 .../workspace/default/.core/reference/log.go  |  2 +
 5 files changed, 58 insertions(+)

diff --git a/.core/reference/fs.go b/.core/reference/fs.go
index a18a3d2..d37b8f8 100644
--- a/.core/reference/fs.go
+++ b/.core/reference/fs.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: EUPL-1.2
+
 // Sandboxed local filesystem I/O for the Core framework.
 package core
 
diff --git a/.core/reference/log.go b/.core/reference/log.go
index 65f8c5f..4a2dd9e 100644
--- a/.core/reference/log.go
+++ b/.core/reference/log.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: EUPL-1.2
+
 // Structured logging for the Core framework.
 //
 //	core.SetLevel(core.LevelDebug)
diff --git a/pkg/lib/lib_test.go b/pkg/lib/lib_test.go
index ebccf80..25165ca 100644
--- a/pkg/lib/lib_test.go
+++ b/pkg/lib/lib_test.go
@@ -3,6 +3,7 @@
 package lib
 
 import (
+	"runtime"
 	"testing"
 
 	core "dappco.re/go/core"
@@ -296,3 +297,52 @@ func TestLib_ExtractWorkspace_Good_AXConventions(t *testing.T) {
 		}
 	}
 }
+
+func TestLib_ReferenceFiles_Good_SPDXHeaders(t *testing.T) {
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller(0) failed")
+	}
+
+	repoRoot := core.PathDir(core.PathDir(core.PathDir(file)))
+	refDir := core.JoinPath(repoRoot, ".core", "reference")
+	goFiles := core.PathGlob(core.JoinPath(refDir, "*.go"))
+	if len(goFiles) == 0 {
+		t.Fatalf("no .go files found in %s", refDir)
+	}
+
+	for _, path := range goFiles {
+		assertSPDXHeader(t, path)
+	}
+}
+
+func TestLib_ExtractWorkspace_Good_ReferenceHeaders(t *testing.T) {
+	dir := t.TempDir()
+	data := &WorkspaceData{Repo: "test-repo", Task: "carry SPDX headers into workspace references"}
+
+	if err := ExtractWorkspace("default", dir, data); err != nil {
+		t.Fatalf("ExtractWorkspace failed: %v", err)
+	}
+
+	refDir := core.JoinPath(dir, ".core", "reference")
+	goFiles := core.PathGlob(core.JoinPath(refDir, "*.go"))
+	if len(goFiles) == 0 {
+		t.Fatalf("no extracted .go files found in %s", refDir)
+	}
+
+	for _, path := range goFiles {
+		assertSPDXHeader(t, path)
+	}
+}
+
+func assertSPDXHeader(t *testing.T, path string) {
+	t.Helper()
+
+	r := testFs.Read(path)
+	if !r.OK {
+		t.Fatalf("failed to read %s", path)
+	}
+	if !core.HasPrefix(r.Value.(string), "// SPDX-License-Identifier: EUPL-1.2") {
+		t.Fatalf("%s missing SPDX header", path)
+	}
+}
diff --git a/pkg/lib/workspace/default/.core/reference/fs.go b/pkg/lib/workspace/default/.core/reference/fs.go
index a18a3d2..d37b8f8 100644
--- a/pkg/lib/workspace/default/.core/reference/fs.go
+++ b/pkg/lib/workspace/default/.core/reference/fs.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: EUPL-1.2
+
 // Sandboxed local filesystem I/O for the Core framework.
 package core
 
diff --git a/pkg/lib/workspace/default/.core/reference/log.go b/pkg/lib/workspace/default/.core/reference/log.go
index 65f8c5f..4a2dd9e 100644
--- a/pkg/lib/workspace/default/.core/reference/log.go
+++ b/pkg/lib/workspace/default/.core/reference/log.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: EUPL-1.2
+
 // Structured logging for the Core framework.
 //
 //	core.SetLevel(core.LevelDebug)