legal: addlicense headers + normalize legacy variants (Phase 0 RED-4)

Phase 0 closure (Path B2, post-rewrite):

addlicense sweep — adds the canonical certctl LLC copyright + BUSL-1.1
SPDX header to every production Go file. Template:

  // Copyright 2026 certctl LLC. All rights reserved.
  // SPDX-License-Identifier: BUSL-1.1

Coverage: 338 / 338 production Go files (cmd/ + internal/, excluding
*_test.go and **/testdata/**). Pre-sweep coverage was 22 / 338 (6.5%);
post-sweep is 338 / 338 (100%).

Normalized 22 pre-existing legacy headers (`// Copyright (c) certctl`
+ `// SPDX-License-Identifier: BSL-1.1`) and 1 file using a
`Certctl Contributors` attribution. The legacy SPDX ID `BSL-1.1`
is non-standard; the official SPDX identifier for Business Source
License 1.1 is `BUSL-1.1` (capital U). All 338 files now share the
canonical form.

Generated via:
  addlicense -c "certctl LLC" -y 2026 \
    -f cowork/legal/copyright-header.tpl \
    -ignore '**/testdata/**' -ignore '**/*_test.go' \
    cmd/ internal/

Verification:
  find cmd internal -name '*.go' -not -name '*_test.go' \
    -not -path '*/testdata/*' \
    -exec grep -L '^// Copyright 2026 certctl LLC' {} \; | wc -l

  Returns: 0

gofmt clean. Header additions are comments only, no compile impact.

Closes: cowork/certctl-architecture-diligence-audit.html#fix-RED-4

internal/connector/discovery/awssm/awssm.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package awssm implements the domain.DiscoverySource interface for AWS Secrets Manager.
 //
 // AWS Secrets Manager is a managed service for storing and managing secrets including

internal/connector/discovery/azurekv/azurekv.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package azurekv implements the domain.DiscoverySource interface for
 // Azure Key Vault certificate discovery.
 //

internal/connector/discovery/gcpsm/gcpsm.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package gcpsm implements the domain.DiscoverySource interface for GCP Secret Manager.
 //
 // GCP Secret Manager is a Google Cloud service for securely storing and managing secrets,

internal/connector/issuer/acme/acme.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package acme
 
 import (

internal/connector/issuer/acme/ari.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package acme
 
 import (

internal/connector/issuer/acme/dns.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package acme
 
 import (

internal/connector/issuer/acme/profile.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package acme
 
 import (

internal/connector/issuer/asyncpoll/asyncpoll.go

@@ -1,5 +1,5 @@
-// Copyright (c) certctl
-// SPDX-License-Identifier: BSL-1.1
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
 
 // Package asyncpoll provides bounded polling for async-CA issuer
 // connectors (DigiCert, Sectigo, Entrust, GlobalSign).

internal/connector/issuer/awsacmpca/awsacmpca.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package awsacmpca implements the issuer.Connector interface for AWS Certificate Manager Private CA (ACM PCA).
 //
 // AWS ACM Private CA provides a fully managed private certificate authority

internal/connector/issuer/digicert/digicert.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package digicert implements the issuer.Connector interface for DigiCert CertCentral.
 //
 // DigiCert CertCentral is an enterprise certificate authority offering DV, OV, and EV

internal/connector/issuer/ejbca/ejbca.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package ejbca implements the issuer.Connector interface for EJBCA (Keyfactor).
 //
 // EJBCA is an open-source and enterprise certificate authority platform.

internal/connector/issuer/entrust/entrust.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package entrust implements the issuer.Connector interface for Entrust Certificate Services.
 //
 // Entrust Certificate Services provides enterprise certificate authority offerings via

internal/connector/issuer/factory.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package issuer
 
 // Factory has been moved to internal/connector/issuerfactory to avoid import cycles.

internal/connector/issuer/globalsign/globalsign.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package globalsign implements the issuer.Connector interface for GlobalSign Atlas HVCA.
 //
 // GlobalSign Atlas HVCA (Hosted Validation CA) is an enterprise certificate authority

internal/connector/issuer/googlecas/googlecas.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package googlecas implements the issuer.Connector interface for
 // Google Cloud Certificate Authority Service (CAS).
 //

internal/connector/issuer/interface.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package issuer
 
 import (

internal/connector/issuer/lifecycle.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package issuer
 
 import "context"

internal/connector/issuer/local/keymem.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package local
 
 import (

internal/connector/issuer/local/keystore.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package local
 
 import (

internal/connector/issuer/local/local.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Bundle-9 / Audit L-014 (Document the CA-key-in-process threat model):
 //
 // The local CA holds its private key in this process's heap (c.caSigner

internal/connector/issuer/local/ocsp_responder.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package local
 
 import (

internal/connector/issuer/mtlscache/cache.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package mtlscache caches a parsed mTLS keypair plus a precomputed
 // *http.Transport across API calls in connectors that authenticate via
 // client certificates. RefreshIfStale stats the cert file on the

internal/connector/issuer/openssl/openssl.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package openssl implements the issuer.Connector interface for custom CA integrations.
 //
 // This connector delegates certificate signing to user-provided scripts/commands.

internal/connector/issuer/sectigo/sectigo.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package sectigo implements the issuer.Connector interface for Sectigo Certificate Manager (SCM).
 //
 // Sectigo Certificate Manager is an enterprise certificate authority offering DV, OV, and EV

internal/connector/issuer/stepca/jwe.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package stepca — JWE decryption for step-ca provisioner keys.
 //
 // step-ca stores provisioner private keys as JWE-encrypted JSON files using:

internal/connector/issuer/stepca/stepca.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package stepca implements the issuer.Connector interface for Smallstep step-ca
 // private certificate authority.
 //

internal/connector/issuer/vault/vault.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package vault implements the issuer.Connector interface for HashiCorp Vault PKI
 // secrets engine.
 //

internal/connector/issuer/vault/vault_renew.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package vault
 
 // Top-10 fix #5 of the 2026-05-03 issuer-coverage audit. Pre-fix,

internal/connector/issuerfactory/factory.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package issuerfactory
 
 import (

internal/connector/notifier/email/adapter.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package email
 
 import (

internal/connector/notifier/email/email.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package email
 
 import (

internal/connector/notifier/interface.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package notifier
 
 import (

internal/connector/notifier/opsgenie/opsgenie.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package opsgenie
 
 import (

internal/connector/notifier/pagerduty/pagerduty.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package pagerduty
 
 import (

internal/connector/notifier/slack/slack.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package slack
 
 import (

internal/connector/notifier/teams/teams.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package teams
 
 import (

internal/connector/notifier/webhook/webhook.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package webhook
 
 import (

internal/connector/target/apache/apache.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package apache implements the Apache httpd target connector.
 // As of the deploy-hardening I master bundle Phase 5, Apache
 // follows the canonical pattern established by NGINX (Phase 4):

internal/connector/target/awsacm/awsacm.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package awsacm implements a target.Connector for deploying certificates to
 // AWS Certificate Manager (ACM). ACM is the public AWS service for storing
 // TLS certificates that AWS-managed TLS-termination endpoints (Application

internal/connector/target/azurekv/azurekv.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package azurekv implements a target.Connector for deploying certificates
 // to Azure Key Vault. Key Vault is the Azure-managed secret/certificate
 // store that App Service / Application Gateway / Front Door / Container

internal/connector/target/azurekv/sdk_client.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package azurekv
 
 // sdk_client.go isolates the imports of github.com/Azure/azure-sdk-for-go/

internal/connector/target/caddy/caddy.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package caddy
 
 import (

internal/connector/target/caddy/validate_only.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package caddy
 
 import (

internal/connector/target/certutil/certutil.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package certutil provides shared certificate utility functions for target connectors.
 // These functions handle PEM/PFX conversion, key parsing, thumbprint computation,
 // and random password generation. Extracted from the IIS connector (M39) to enable

internal/connector/target/configcheck/configcheck.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package configcheck provides server-side syntactic validation of target
 // connector configurations.
 //

internal/connector/target/envoy/envoy.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package envoy
 
 import (

internal/connector/target/envoy/validate_only.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package envoy
 
 import (

internal/connector/target/f5/f5.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package f5
 
 import (

internal/connector/target/f5/validate_only.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package f5
 
 import (

internal/connector/target/haproxy/haproxy.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package haproxy implements the HAProxy target connector.
 //
 // HAProxy expects all TLS material concatenated in a single PEM

internal/connector/target/iis/iis.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package iis
 
 import (

internal/connector/target/iis/validate_only.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package iis
 
 import (

internal/connector/target/iis/winrm.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package iis
 
 import (

internal/connector/target/interface.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package target
 
 import (

internal/connector/target/javakeystore/javakeystore.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package javakeystore implements a target connector for deploying certificates
 // to Java KeyStores (JKS/PKCS#12) via the keytool CLI. This enables TLS cert
 // deployment for Tomcat, Jetty, Kafka, Elasticsearch, and any JVM-based service

internal/connector/target/javakeystore/validate_only.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package javakeystore
 
 import (

internal/connector/target/k8ssecret/k8ssecret.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package k8ssecret implements a target.Connector for deploying certificates to Kubernetes Secrets.
 // This enables the "proxy agent" pattern — a certctl agent running in a Kubernetes cluster
 // (or outside with kubeconfig access) can deploy certificates as kubernetes.io/tls Secrets.

internal/connector/target/k8ssecret/validate_only.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package k8ssecret
 
 import (

internal/connector/target/nginx/internals.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package nginx
 
 import (

internal/connector/target/nginx/nginx.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package nginx implements the NGINX target connector. As of the
 // deploy-hardening I master bundle Phase 4 (the canonical
 // implementation that Phases 5-9 model on), NGINX is the first

internal/connector/target/postfix/postfix.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package postfix implements the Postfix + Dovecot mail-server
 // target connector. As of the deploy-hardening I master bundle
 // Phase 7, both modes follow the canonical NGINX template:

internal/connector/target/ssh/ssh.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package ssh implements a target.Connector for agentless certificate deployment
 // via SSH/SFTP. This enables the "proxy agent" pattern — a certctl agent in the
 // same network zone deploys certificates to remote servers without requiring the

internal/connector/target/ssh/validate_only.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package ssh
 
 import (

internal/connector/target/traefik/traefik.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package traefik implements the Traefik file-provider target
 // connector. Bundle 4 of the 2026-05-02 deployment-target audit:
 // upgraded from two separate deploy.AtomicWriteFile calls (cert,

internal/connector/target/wincertstore/validate_only.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 package wincertstore
 
 import (

internal/connector/target/wincertstore/wincertstore.go

@@ -1,3 +1,6 @@
+// Copyright 2026 certctl LLC. All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Package wincertstore implements a target connector for deploying certificates
 // to the Windows Certificate Store via PowerShell. Unlike the IIS connector,
 // this connector only imports certificates into the store — it does not manage