chore: add SPDX copyright headers and update license year

Add `// Copyright Sunbeam Studios 2026` and `// SPDX-License-Identifier:
Apache-2.0` headers to all source files missing them. Update LICENSE
copyright year, Dockerfile copyright header, and .dockerignore for new
project structure (lean4/, docs/, training artifacts).

Signed-off-by: Sienna Meridian Satterwhite <sienna@sunbeam.pt>

.dockerignore

@@ -2,4 +2,31 @@ target/
 .git/
 .gitignore
 *.md
+
+# Lean 4 proofs
+lean4/
+
+# Paper / docs
+docs/
+
+# Training data, datasets, artifacts
+*.bin
+*.jsonl
+models/
+.fastembed_cache/
+
+# burn training artifacts (checkpoints, experiment logs)
+src/ensemble/gen/scanner_artifacts/
+src/ensemble/gen/ddos_artifacts/
+
+# Dev / CI files
 certs/
+.github/
+.vscode/
+.idea/
+.claude/
+scripts/
+infrastructure/
+*.swp
+*.swo
+*~

Dockerfile

@@ -1,3 +1,6 @@
+# Copyright Sunbeam Studios 2026
+# SPDX-License-Identifier: Apache-2.0
+
 # ── Stage 1: build ──────────────────────────────────────────────
 FROM rust:slim AS builder
 
@@ -23,6 +26,7 @@ COPY Cargo.toml Cargo.lock ./
 RUN mkdir -p src benches && \
     echo 'fn main() {}' > src/main.rs && \
     echo 'fn main() {}' > benches/scanner_bench.rs && \
+    echo 'fn main() {}' > benches/ddos_bench.rs && \
     cargo build --release --target "$(cat /rust-target)" ; \
     rm -rf src benches
 
@@ -46,7 +50,6 @@ FROM cgr.dev/chainguard/static:latest
 
 COPY --from=builder /tini                       /tini
 COPY --from=builder /sunbeam-proxy              /usr/local/bin/sunbeam-proxy
-COPY models/ /models/
 
 EXPOSE 80 443
 

LICENSE

@@ -184,7 +184,7 @@
       comment syntax for the file format. Please also get (or round off)
       your own UID and put it after the copyright sign.
 
-   Copyright 2025-2026 Sunbeam Studios
+   Copyright 2026 Sunbeam Studios
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

benches/ddos_bench.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use criterion::{black_box, criterion_group, criterion_main, Criterion};
 use sunbeam_proxy::ensemble::ddos::ddos_ensemble_predict;
 use sunbeam_proxy::ensemble::gen::ddos_weights;

src/acme.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use futures::StreamExt;
 use k8s_openapi::api::networking::v1::Ingress;
 use kube::{runtime::watcher, Api, Client};

src/autotune/gp.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 /// Gaussian Process surrogate with RBF kernel and Cholesky solver.
 /// Designed for <200 observations in 4-10 dimensions.
 

src/autotune/mod.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod ddos;
 pub mod gp;
 pub mod optimizer;

src/autotune/optimizer.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use crate::autotune::gp::GaussianProcess;
 use crate::autotune::params::ParamSpace;
 use serde::Serialize;

src/autotune/params.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use rand::Rng;
 
 #[derive(Debug, Clone)]

src/cache.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use pingora_cache::MemCache;
 use std::sync::LazyLock;
 

src/cert.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use anyhow::{Context, Result};
 use k8s_openapi::api::core::v1::Secret;
 use kube::{Api, Client};

src/cluster/bandwidth.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use rustc_hash::FxHashMap;
 use std::collections::VecDeque;
 use std::sync::atomic::{AtomicU64, Ordering};

src/cluster/messages.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use serde::{Deserialize, Serialize};
 
 /// Envelope for all cluster gossip messages.

src/cluster/mod.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod bandwidth;
 pub mod messages;
 pub mod node;

src/cluster/node.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use std::net::SocketAddr;
 use std::path::Path;
 use std::sync::Arc;

src/dataset/mod.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod sample;
 pub mod modsec;
 pub mod cicids;

src/dataset/sample.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::Path;

src/dataset/synthetic.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 //! Synthetic data generation for DDoS and scanner training samples.
 //!
 //! DDoS synthetic samples are generated by sampling from CIC-IDS2017 timing

src/ddos/features.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use rustc_hash::FxHashSet;
 use serde::{Deserialize, Serialize};
 use std::time::Instant;

src/dual_stack.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 //! Dual-stack TCP listener implementation inspired by `tokio_dual_stack`.
 //!
 //! This module provides a `DualStackTcpListener` that can listen on both IPv4 and IPv6

src/ensemble/gen/mod.rs

@@ -1,2 +1,5 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod ddos_weights;
 pub mod scanner_weights;

src/ensemble/mlp.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 /// Two-layer MLP forward pass with a fixed hidden size of 32:
 ///
 ///   hidden = ReLU(W1 @ input + b1)

src/ensemble/mod.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod ddos;
 pub mod gen;
 pub mod mlp;

src/ensemble/tree.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 /// Decision from a tree leaf node.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum TreeDecision {

src/metrics.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use prometheus::{
     Encoder, Gauge, Histogram, HistogramOpts, IntCounterVec, Opts, Registry, TextEncoder,
 };

src/rate_limit/cidr.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use std::net::IpAddr;
 
 /// A parsed CIDR block for allowlist matching.

src/rate_limit/key.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use std::hash::{Hash, Hasher};
 use std::net::IpAddr;
 

src/rate_limit/limiter.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use crate::config::{BucketConfig, RateLimitConfig};
 use crate::rate_limit::cidr::{self, CidrBlock};
 use crate::rate_limit::key::RateLimitKey;

src/rate_limit/mod.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod cidr;
 pub mod key;
 pub mod limiter;

src/scanner/allowlist.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use crate::config::BotAllowlistRule;
 use crate::rate_limit::cidr::CidrBlock;
 use rustc_hash::FxHashMap;

src/scanner/features.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use rustc_hash::FxHashSet;
 use serde::{Deserialize, Serialize};
 

src/ssh.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use tokio::io::copy_bidirectional;
 use tokio::net::TcpStream;
 

src/static_files.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use pingora_http::ResponseHeader;
 use pingora_proxy::Session;
 use std::path::{Path, PathBuf};

src/telemetry.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use opentelemetry::trace::TracerProvider as _;
 use opentelemetry_otlp::WithExportConfig;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt, EnvFilter};

src/training/tree.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 //! CART decision tree trainer (pure Rust, no burn dependency).
 //!
 //! Trains a binary classification tree using Gini impurity and outputs

src/watcher.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use futures::StreamExt;
 use k8s_openapi::api::core::v1::{ConfigMap, Secret};
 use kube::{runtime::watcher, Api, Client};

tests/cluster_test.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 //! Integration test: spin up two gossip nodes with bootstrap discovery
 //! and verify that bandwidth reports propagate between them.
 

tests/dual_stack_test.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 //! Integration test for dual-stack TCP listener functionality.
 
 use std::net::{Ipv4Addr, SocketAddr, SocketAddrV4};

tests/proptest.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use bytes::Bytes;
 use proptest::prelude::*;
 use std::collections::HashSet;

tests/rate_limit_test.rs

@@ -1,3 +1,6 @@
+// Copyright Sunbeam Studios 2026
+// SPDX-License-Identifier: Apache-2.0
+
 use std::net::IpAddr;
 use sunbeam_proxy::config::{BucketConfig, RateLimitConfig};
 use sunbeam_proxy::rate_limit::key::{self, RateLimitKey};