#3324 extension manifest: optional SPDX license: field, scored in quality and the rubric (field and LICENSE file, one point each)

Part 2 of 6 of the extension license requirement (#3323–#3328). Plan: Extension license proposal (https://claude.ai/code/artifact/8c256b86-ce33-4898-8b70-223ec3b827f2).

Change (swamp CLI)

1. Manifest license: field: an SPDX license expression.
   • Every license id must be on the SPDX License List.
   • WITH takes an exception from the SPDX exceptions list, plus exactly one custom addition: AdditionRef-Swamp-Extension-Exception (the Swamp Extension and Definition Exception), as in AGPL-3.0-only WITH AdditionRef-Swamp-Extension-Exception and its -or-later form (Seth, 2026-10-12).
   • Every other LicenseRef- or AdditionRef- is refused until someone asks for one.
   • Use one shared SPDX expression parser: the same one the dependency trust plan's fix 2 needs.
2. extension quality and push:
   • A public push (a new extension, or a new version of an existing one) without license: is an error, and --yes doesn't waive it.
   • A malformed or unknown expression is an error.
   • A private push may omit the field; if present, it is validated.
3. A LICENSE file is required too (Seth, 2026-10-13: many licenses require their text to accompany the code). A public push needs both the license: field and a LICENSE, LICENSE.md or LICENSE.txt at the archive root. The file must be present and non-empty. It is not parsed or compared with the field. A private push needs neither.
4. Rubric: the CLI's "License declared" factor needs both the field and the file.
5. Confirm: the field is sent at confirm. extension info shows it.
6. extension search: passes licensed=true (from #3323) by default, with --include-unlicensed until day 60.
7. Docs and skill: the extension skill's manifest examples, the publishing reference and the rubric reference document the field. They state that a public extension needs both license: and a LICENSE file.

Notes

• Today's CLIs drop unknown manifest keys (the top-level manifest schema isn't strict), so adding license: to manifests is harmless before this ships.
• A UAT item covers: refusal without the field, refusal without a LICENSE file, a malformed field, a private push without it, the AdditionRef accepted, other custom refs refused, info and search.

Re-scoped 2026-10-13 (Seth and the team): the license is OPTIONAL

This section overrides anything above that conflicts with it.

• Nothing is refused. A push with no license: and no LICENSE file publishes, public or private.
• An invalid value warns and earns no points, never blocks. That covers a malformed expression or an id not on the SPDX list.
• Only SPDX license identifiers count. Every LicenseRef-, and AdditionRef- including the Swamp exception form, warns and earns no points.
• Two rubric items, one point each, in extension quality and the CLI rubric: (1) a valid SPDX license: in the manifest; (2) a LICENSE, LICENSE.md or LICENSE.txt at the archive root.
• The field is still sent at publish, and extension info shows it.
• extension search no longer filters by default. Drop --include-unlicensed. An opt-in flag for the API's licensed=true is fine, but not required.
• Docs and the skill say the license is optional and earns points.
• UAT: the merged #3324 UAT asserts refusals; change those to warnings with no points.