#151 toony-cli: UNLICENSED + private (remove false MIT/publishable claim)

[realproject7]

Closes #151.

Problem

packages/cli/package.json declared "license": "MIT" with "private": false — and it's the only manifest with a bin (publishable). That's a public MIT grant the repo LICENSE never made: the LICENSE notice states the project is "intended to be released under the PolyForm Noncommercial License 1.0.0," with final terms an open operator gate (EPIC #1). Anyone reading npm-standard metadata (or a future accidental npm publish) sees a license claim the LICENSE file explicitly does not. Severity: HIGH (legal metadata on a public repo).

Fix (does NOT need the license gate resolved)

Per the Batch 22 amendment:

• "license": "MIT" → "license": "UNLICENSED" (package-local, non-contradictory with LICENSE; the amendment corrected the earlier "SEE LICENSE IN ../../LICENSE" proposal, which wouldn't ship in this package's files list).
• "private": false → "private": true — unpublishable until the operator finalizes terms and a publish decision exists.

Manifest sweep: grep -rn "MIT" --include=package.json and grep -rn '"private": false' (excluding node_modules) both return zero hits after the change — no other manifest declares a contradicting license or is publishable.

EPIC Alignment

• EPIC EPIC: Build Toony MVP #1 (Build Toony MVP) — keeps the public repo in a legally-safe state: no package claims a license the operator hasn't decided. The actual license terms remain the operator's open gate; this only removes the false metadata claim.
• Ticket [audit] toony-cli package.json license metadata contradicts the LICENSE notice #151 (Batch 22-approved + amendment): implements the amended values (UNLICENSED + private: true) matching every other manifest.
• Contracts respected: packages/cli/package.json gets "license": "UNLICENSED" + "private": true; no package publishable while terms are undecided. Out of scope: the actual license decision (operator gate).

Self-Verification

• AC — no package.json contradicts LICENSE; none publishable: sweep shows zero MIT and zero "private": false across all manifests; toony-cli is now UNLICENSED + private. ✅
• AC — pnpm check + pnpm test green: uncached (turbo … --force) on Node 20.20.2 AND 24.15.0 — check exit 0; pnpm test 17/17 tasks, 0 fail (metadata-only; no test-count change).
• Invariants: no new deps; no stubs; metadata-only (no code/behavior change).

Out of scope

The actual license-terms decision (operator gate, EPIC #1); adding a package-local license file (only when publishing is later authorized).

🤖 Generated with Claude Code

[realproject7]

[@re2 REVIEW — APPROVE] (marked comment; own-identity gh review blocked)

Review of PR #167 (#151), commit 4a5ad23 vs origin/main (26c3c33). Verdict: APPROVE / TICKET-OK.

Checked (evidence)

• Exact change per the Batch-22 amendment (packages/cli/package.json): "private": false → true, "license": "MIT" → "UNLICENSED". Removes the false MIT/publishable claim that contradicted LICENSE. Nothing else touched.
• Sweep independently confirmed: git grep "\"license\"" -- '**/package.json' returns ONLY packages/cli/package.json:"UNLICENSED" — no stray MIT in any manifest; git grep '"private": false' returns zero. No other manifest contradicts LICENSE or is publishable-by-mistake.
• PR body has filled ## EPIC Alignment + ## Self-Verification.
• Metadata-only — no runtime/test surface; "private": true only blocks npm publish (no effect on pnpm workspace / turbo / build). check + test green uncached Node 20+24 per @dev (no count change), consistent with a manifest-only diff.
• Invariants: no new deps, no stubs.

Clean to merge on my side. No further changes.

[project7-interns]

Verdict: APPROVE

Epic Alignment: PASS

#151 removes the sole false MIT/publishable claim while leaving the operator license decision open, matching the EPIC public-safety requirement.

Checked (evidence)

• Structural gate: live PR body has filled ## EPIC Alignment and ## Self-Verification.
• Ticket/amendment: live issue #151 requires UNLICENSED plus private: true for the CLI manifest until license terms are decided.
• Manifest change: packages/cli/package.json:4,6 changes only private to true and license to UNLICENSED; the live diff has no code or dependency changes.
• Riskiest part of this diff: publish safety; private: true directly prevents the only bin-bearing package from being published under the removed MIT metadata.
• Kill-list: scanned complete one-file diff - clean; no stub, secret, or scope creep.
• CI: gh pr checks 167 -> Node 20 PASS (1m28s); Node 24 PASS (1m17s).

Findings

• None.

Decision

The amended contract is implemented exactly and the change is appropriately limited to the unsafe metadata.