chore(legal): relicense to MIT and add PATENTS notice

[CryptoFewka]

Replaces the Microsoft Reference Source License with the unmodified MIT License, updates the README badge and License section, and adds PATENTS. Appends PATENTS to the existing Dockerfile COPY so it ships to /usr/share/doc/optimum-gateway/ alongside the other legal files.

The notice matters more here than in the source-available repos. MIT grants copyright permissions only and no patent rights, but most engineers read MIT as "safe to use". Someone who adopts this gateway, wires it to an RLNC engine and runs a network is practicing CodeOn patents with no license from anyone. The PATENTS file therefore carries a different disclaimer here, stating plainly that MIT confers no patent rights.

MIT is nonetheless the right permissive choice, and safer than Apache-2.0 — Apache §3 contains an express patent grant, and we cannot grant patent rights we hold only under license.

PATENTS lists the licensed rights grouped by jurisdiction under a "may be covered by one or more" statement, the usual form for virtual marking. 121 entries covering the live rights on the schedule.

For v2, not for this PR: third parties are not expected to build this binary yet, so MIT on the source is fine today. Two things need resolving before that changes at v2, when the gateway moves to mump2p-protocol:

• go.mod still pulls github.com/getoptimum/rlnc transitively (indirect, via the pinned optimum-p2p v0.0.1-rc12.2). Current optimum-p2p has no such dependency, so a bump plus go mod tidy should clear it.
• This repo links optimum-p2p directly, which is not becoming source-viewable. A third party building from MIT source would need a grant for that dependency.

optimum-p2p gets its own PATENTS file in getoptimum/optimum-p2p#275, since marking follows distribution rather than source visibility.

Written with Claude Code

Summary by CodeRabbit

• Documentation
  • Updated the README to reflect MIT licensing, including patent information and third-party dependency notices.
  • Clarified security research safe-harbor terms and the relationship between the security policy and software license.
• Legal and Compliance
  • Added the PATENTS file to runtime distributions alongside existing licensing and attribution notices.
  • Updated license and patent-marking references for clearer compliance information.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: getoptimum/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6c10fd0a-fc99-4444-b985-f9391e539630

📥 Commits

Reviewing files that changed from the base of the PR and between ec956ad and ee8190f.

⛔ Files ignored due to path filters (1)

• PATENTS is excluded by none and included by none

📒 Files selected for processing (1)

• SECURITY.md

---

📝 Walkthrough

Walkthrough

The README changes the license badge and License section from Ms-RSL to MIT. The section adds patent-rights information and links to PATENTS, THIRD-PARTY-NOTICES.md, and NOTICE. The Dockerfile adds PATENTS to the runtime image documentation bundle. The security policy updates its safe-harbor terms and defers software rights to the LICENSE.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• getoptimum/optimum-gateway#962: Both PRs revise licensing, Docker attribution files, README content, and security safe-harbor terms.
• getoptimum/mump2p-protocol#284: Both PRs update Dockerfile and README licensing, patent, and third-party notices.
• getoptimum/optimum-p2p#275: Both PRs add a PATENTS notice to the runtime image.

Suggested reviewers: abergasov, hpsing, alexanderbez, swarna1101

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows the required format and accurately describes the relicensing and PATENTS notice changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Line 13: Update the license statement in SECURITY.md to reference the MIT
License instead of Ms-RSL, while preserving the separate safe-harbor permission
language.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: getoptimum/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 845c1aa1-500e-4e35-aab3-2113d63a6b89

📥 Commits

Reviewing files that changed from the base of the PR and between df3bbed and ec956ad.

⛔ Files ignored due to path filters (5)

• LICENSE is excluded by none and included by none
• NOTICE is excluded by none and included by none
• PATENTS is excluded by none and included by none
• docs/sbom-full.json is excluded by none and included by none
• docs/sbom.json is excluded by none and included by none

📒 Files selected for processing (2)

• Dockerfile
• README.md