Licence hygiene: add LICENSE, header the unheadered files, quarantine the GPL modules

[transfix]

Cleans up the licensing state of the repository, from a licence audit run on 2026-09-03. Full analysis in cvc-engagement-docs/modernization/f2dock-port-hamiltonian-docking-acceleration.md §4.2 (branch contract/f2dock-ph-docking-modernization).

Smallest-risk first, one commit per change. Two findings are deliberately not addressed here — see Left for a human decision.

What was wrong

The repository asserted LGPL-2.1 in prose only (README.md, OVERVIEW.md) and had no LICENSE file at any root, while CPACK_RESOURCE_FILE_LICENSE pointed at INSTALL — a build-instructions file — so every generated package shipped with no licence text. 44 sources had no header at all. And GPL-2.0-or-later code was compiled into the LGPL binary by default, including a GPL header #included directly into the LGPL core header.

Commits

1. docs(licence) — add the LGPL-2.1 text and ship it in packages
FSF LGPL-2.1 as LICENSE, CPack pointed at it, installed alongside README.md. Verified: cpack -G TGZ now contains LICENSE.

2. docs(licence) — add the project licence banner to files that had none
44 files get the same UT Austin LGPL-2.1 banner the rest of the tree uses, year from when the file first appeared, author line taken from a sibling in the same module where the tree records one. Six files are deliberately skipped because they are not this project's work — sturm.h, dsexceptions.h, and four libmol files. cuckoo.{h,cc} already carried a permissive BRICS grant.

3. docs(licence) — make the two SPDX tags agree with the rest of the tree
DockMode.h and test_dock_mode.cpp were the only files with an SPDX tag and it read LGPL-2.1-or-later; the other 68 LGPL files grant 2.1 with no "or later" clause. Aligned. Revert this commit alone if 2.1-or-later was in fact the intent.

4. build — gate the GPL modules behind F2DOCK_ENABLE_GPL_COMPONENTS (default OFF)

Module	Licence	Feature	Was it built?
sparsefft3	GPL-2.0-or-later	useSparseFFT	Yes, and it was the default FFT path
libicp / f3dock-icp	GPL-2.0-or-later	icpRefine	Yes, via F2DOCK_ENABLE_F3DOCK_EXPERIMENTAL=ON

Both now behind one option, OFF by default. inc/f2dock/Docking.h no longer #includes the GPL headers: inc/fft-utils/sparsefft3-api.h is the seam, forwarding to the real header when the module is built and otherwise declaring the same three entry points against an incomplete plan type — which is all the core needs, since the plan is only ever held and passed as an opaque pointer. sparsefft3-stub.cpp satisfies the link and fails loudly if reached.

pr.useSparseFFT was unconditionally true; it now follows the build. The dense FFTW fallback is the existing, already-exercised useSparseFFT false path — Docking.cpp pins both plan pointers to NULL and every call site tests for that — not new code. Asking for either feature in a parameter file is now an error with an explanation, following the F2DOCK_HAVE_NFFT precedent, rather than a silent downgrade.

5. docs — THIRD-PARTY.md
Nine vendored trees with upstream, author, licence, and whether the default build compiles them.

6. ci — build the GPL configuration once
After commit 4 nothing in the matrix compiled the GPL modules, so they would have rotted silently. One extra ubuntu-latest/Release job builds and tests with the option ON. Drop this commit if the extra CI minutes are not wanted.

Verification

Check	Result
Default build (F2DOCK_ENABLE_GPL_COMPONENTS=OFF)	configures, builds, 187/187 unit tests pass
GPL build (=ON)	configures, builds, 197/197 pass (the 10 extra ICP tests)
GPL symbols in the default binary	only the stubs, against the opaque type — no GPL header was reached; no libf3dock-icp.a
1A2K docking run, dense vs sparse	pose output identical — every score, rank, RMSD, rotation and translation matches, differing only in signed zero on columns that are numerically zero
useSparseFFT true / icpRefine true in a default build	rejected with the explanatory message, exit 1
cpack -G TGZ	ships LICENSE
clang-format --dry-run --Werror, whole tree	clean

The dense path is slower — 8.9s vs 23.1s on the reduced 8-rotation smoke case, though that ratio is inverted from the real workload and is not a benchmark. Replacing sparsefft3 with a permissively-licensed sparse transform remains the right long-term fix.

Left for a human decision

Neither of these is touched by this PR. Both need a decision, and probably UT counsel, rather than a commit.

libmol (72 of 76 files). The Boston University notice at inc/libmol/mask.h:3–16 grants copy-and-modify rights only to "US Universities and US Government supported Research Institutions", only for educational and research purposes, and says the software "may not be distributed to any other institution without express permission". That is a class-of-licensee and field-of-use restriction incompatible with the LGPL, with the GPL, and with redistribution generally. HAVE_LIBMOL is OFF so it is not compiled — but it is in the published source tree, and source redistribution is exactly what the notice restricts. Neither CVC-Lab/F2Dock nor CVC-Lab/F3Dock ships it, while F3Dock's src/CMakeLists.txt still calls ADD_SUBDIRECTORY (libmol) for a directory that is not in its checkout — consistent with deliberate stripping before publication. Verified against the local F3Dock-upstream and F2Dock-cvclab checkouts.

inc/f2dock/ElementInformation.h provenance. GPL-2.0-or-later in both CVC-Lab repositories, LGPL-2.1-only here, copyright year moved 2003 → 2011. UT holds both, so UT can relicense its own work — but nothing in the tree or the history records the decision.

Two smaller items are recorded in THIRD-PARTY.md and also left alone:

• src/f3dock-loop-closure/tripep_closure.{h,cpp} — bare copyright, no grant of any kind, and built by default. The algorithm is published and the original is widely redistributed, so this looks like an oversight, but the fix is an explicit grant from the authors.
• inc/libicp/kdtree.h — AFL-1.1, referencing a LICENSE file with "additional provisions" that is not in the tree. Now unbuilt by default as part of the libicp gate, but the unknown provisions remain unknown.

These are observations about the source tree, not legal advice.

CI is red on macOS and Windows, and it is not this branch

All four Linux jobs pass, including the new GPL-components one. The six macOS and Windows jobs fail with one shared cause that predates this branch:

CGAL/Filtered_kernel/internal/Static_filters/Static_filter_error.h:110
  double error()  const { return _e; }
note: expanded from macro 'error'
  libcvc-src/src/cvc/SDF/SignDistanceFunction_v2/reg3data.h:12

Both runners now resolve CGAL 6.2 (Homebrew on macOS, vcpkg on Windows). In CGAL 6 the deprecated AABB_traits.h forwards to AABB_traits_3.h, which newly pulls in Static_filter_error.h. libcvc's reg3data.h:12 defines #define error(x) {fprintf(stderr, "%s\n", x); exit(1);} — an unguarded function-like macro escaping a header — and error() matches it with an empty argument. On MSVC the macro body shows up in the errors verbatim ('fprintf': is not a member of 'CGAL::internal::Static_filter_error').

Why it cannot be this branch:

• The failing translation unit is _deps/libcvc-build/src/cvc/algorithm.cpp.o — target 11 of 229, inside libcvc, before any F2Dock source compiles. Every error in all six jobs is that one; there is not a single error from an F2Dock source file.
• libcvc is pinned at LIBCVC_GIT_SHA 08c15b5e…, unchanged here.
• On macOS and Windows F2DOCK_ENABLE_GPL_COMPONENTS is OFF, so the only lines this branch adds that run before libcvc is configured are an option() and a message(STATUS ...).
• Two independent compilers and two independent package managers reproduce it identically.

master has not run CI since 2026-05-21, when Homebrew and vcpkg still shipped CGAL 5.x, which is why this surfaces now rather than then.

The fix belongs in libcvc — reg3data.h should not leak an error macro out of a header — or, as a stopgap, this workflow could pin the CGAL version it installs. Either is a separate change from this PR.