chore: add ASF source headers and a RAT release gate

English

Part of #2974 — G4: source headers and RAT.

Outcome

Apply the agreed ASF source-header policy and enforce it with an automated audit
of the source release candidate.

Exit criteria

Define the file types, generated files, third-party files, fixtures, and
other justified exclusions covered by the header policy.
Add ASF license headers to applicable tracked source files.
Record the mechanical header-only change in .git-blame-ignore-revs if
the project decides that is appropriate.
Add Apache RAT or an equivalent mentor-approved audit with a reviewed
exclusion list.
Run the audit against the extracted source archive, not only the Git
checkout.
Make the release workflow fail on an unexpected unapproved file.
Update DISCLAIMER-WIP when its missing-header disclosure is no longer
true.

Existing work

PR #3397 implements this gate. The boxes above record what that pull request
does; none of it is on main until it merges.

Two exit criteria stay open on purpose:

The audit is an equivalent Node implementation rather than Apache RAT. The
reasoning is in the pull request, and it needs mentor confirmation before it
counts as the "mentor-approved equivalent" this issue asks for.
.git-blame-ignore-revs carries the placeholder entry the file's own
convention requires. Because this repository squash-merges, the landed hash
goes in a follow-up right after the merge: a hash that never reaches main
makes git blame fail outright.

Out of scope

Rewriting NOTICE or auditing third-party license classifications.
General formatting or unrelated source cleanup.

References

Ownership

Leave this issue unassigned until explicitly claimed.

简体中文

#2974 的一部分——G4：源码 headers 与 RAT。

目标结果

落实约定的 ASF 源码 header 策略，并通过源码 RC 的自动化审计持续执行。

完成条件

定义 header 策略覆盖的文件类型，以及 generated files、third-party files、
fixtures 和其他合理排除项。
为适用的已跟踪源文件添加 ASF license headers。
如果项目认为合适，将纯机械 header 变更记录到 .git-blame-ignore-revs。
添加 Apache RAT 或 mentors 认可的等效审计，并使用经过审查的排除清单。
对解压后的源码归档运行审计，而不只是检查 Git checkout。
出现未预期且未经批准的文件时，让发版 workflow 失败。
当缺少 header 的问题解决后，更新 DISCLAIMER-WIP 中不再成立的披露。

已有工作

PR #3397 实现了这一 gate。上面的勾选记录的是该 PR 的内容；在它合入之前，这些都不在
main 上。

有两条完成条件是有意保持开放的：

审计采用等效的 Node 实现而非 Apache RAT。理由写在 PR 描述里，需要 mentor 确认后
才算本 issue 要求的"mentors 认可的等效审计"。
.git-blame-ignore-revs 目前只有该文件自身约定要求的占位条目。由于本仓库采用
squash-merge，落地 hash 需要在合并后的 follow-up 中补上：main 上不存在的 hash 会
让 git blame 直接报错。

不在范围内

重写 NOTICE 或审计第三方许可证分类。
一般格式化或无关源码清理。

参考资料

负责人边界

明确认领前保持 unassigned。

Claiming this.

Draft PR: #3397

It applies the header policy and enforces it with an audit that runs inside the extracted source archive, reusing the G2 archive path from #3278/#3332 rather than adding a second one. Two commits: policy + audit + release gate, then the mechanical sweep.

Two points that need a decision rather than more code:

RAT equivalence. The PR implements an equivalent Node audit instead of Apache RAT. Reasons are in the PR description; the short version is that RAT would add a JVM and a downloaded jar to the path a voter is expected to reproduce, and its glob exclusions fail open, while this audit fails closed on any file that matches neither a header rule nor a reviewed exclusion. This still needs mentor confirmation to count as the "mentor-approved equivalent" this issue asks for. If mentors want literal RAT output, the policy data carries over to a rat-excludes file, but the fail-closed property does not.
.git-blame-ignore-revs. That file's own convention requires hashes that exist on main, and this repository squash-merges, so the PR adds the placeholder entry and the landed hash goes in a follow-up right after the merge. An unknown hash makes git blame fail outright.

The exclusion list is the part that needs human review, not the header insertion — npm run check:asf-headers -- --report prints every rule with its justification and the exact files it claims.

Merging the sweep will require open pull requests to rebase.

Prepared with Claude Code; the exclusion rules and their justifications are AI-drafted and need a human contributor of record to confirm them.