chore(license): flip 69 PMPL→MPL-2.0 stamps (Phase 1 — root + small infra)#103
Merged
Conversation
…all infra) Per 2026-06-02 estate license-policy directive: sole-owner repos default to MPL-2.0. developer-ecosystem has MPL-2.0 LICENSE + MPL-2.0 in deno.json, but ~11.8k source files still carry legacy PMPL-1.0-or-later SPDX stamps from the old owner-carve-out convention (pre-#77/2026-05-19). ## Phase 1 scope (this PR) 69 files in: - Repo root: 20 files (READMEs, CHANGELOG, QUICKSTARTs, MAINTAINERS, SECURITY, CONTRIBUTING, etc.) - .github/: 9 files - .machine_readable/: 29 files - docs/, tests/, hooks/, contractiles/, ffi/, .well-known/, shellstate/: 15 files combined ## Explicitly EXCLUDED from this PR - Submodule subtrees: v-ecosystem/, satellites/, julia-ecosystem/, scaffoldia/ — these are separate repos, will be addressed in their own. - rescript-ecosystem/rescript-tea/ — possible upstream fork (third-party, leave alone per estate policy). - rescript-ecosystem/idaptik-rescript13-staging/ — AGPL inheritance from son-shared idaptik repo, do not flip. - affinescript-ecosystem/affinescript-vite/ — possible upstream fork. - All other top-level subdirs (iser-tools/, rescript-ecosystem/, asdf-augmenters/, affinescript-ecosystem/, etc.) — separate per-subdir PRs. ## Verification ``` remaining PMPL stamps in Phase 1 scope: 0 new MPL-2.0 stamps in Phase 1 scope: 68 (PALIMPSEST.adoc retains 1 PMPL string in prose body — correct, the doc explains PMPL) ``` Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
🔍 Hypatia Security ScanFindings: 810 issues detected
View findings[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This was referenced Jun 2, 2026
hyperpolymath
added a commit
that referenced
this pull request
Jun 2, 2026
…fe subdirs) (#105) ## Summary Phase 3 of the developer-ecosystem PMPL→MPL-2.0 sweep. Companion to #103 (Phase 1) and #104 (Phase 2 iser-tools). This PR covers **all dev-ecosystem subdirs where only the source SPDX needs flipping** — i.e., subdirs that either have no own LICENSE or already have an MPL-2.0 LICENSE. ## Scope (1,465 files) **No own LICENSE (treated as dev-ecosystem topical content):** - `affinescript-ecosystem/affinescript/` — 1 file - `affinescript-ecosystem/affinescript-deno-test/` — 11 - `rescript-ecosystem/connectors/` — 1 - `rescript-ecosystem/.machine_readable/` — 6 - `rescript-ecosystem/ppx-proven-record/` — 2 - `rescript-ecosystem/rescript-deno-starter/` — 1 - `rescript-ecosystem/rescript-vite-config/` — 1 - `rescript-ecosystem/packages/` — ~1,062 - `coq-ecosystem/`, `zig-ecosystem/`, `ada-ecosystem/`, `zig-api/` — combined ~141 **Own LICENSE already MPL-2.0 (only SPDX needs alignment):** - `affinescript-ecosystem/affinescriptiser/` — 216 - `rescript-ecosystem/rescript-string-power/` — 23 ## Explicitly EXCLUDED from this PR | Path | Reason | |---|---| | `asdf-augmenters/*` | Superseded by `hyperpolymath/odds-and-sods-package-manager` (opsm); skip per owner direction. opsm is already clean (0 PMPL). | | `affinescript-ecosystem/affinescript-vite/` | Possible upstream Vite fork | | `affinescript-ecosystem/rattlescript/` | Check-in copy of `hyperpolymath/rattlescript` standalone | | `rescript-ecosystem/rescript-tea/` | Possible upstream ReScript-Tea fork | | `rescript-ecosystem/idaptik-rescript13-staging/` | AGPL inherit from son-shared idaptik | | `rescript-ecosystem/cadre-router/`, `cadre-tea-router/` | Check-in copies of `hyperpolymath/*` standalones | | `rescript-ecosystem/rescript-evangeliser/` | Listed as submodule (`satellites/developer-ux/rescript-evangeliser`) | | `rescript-ecosystem/rescript/` | LICENSE says "multiple licenses" — needs explicit review | | `rescript-ecosystem/rescript-dom-mounter/`, `rescript-vite/` | Own PMPL LICENSE — Phase 4 (LICENSE+SPDX together) | | All dev-ecosystem subdirs with own PMPL LICENSE | Phase 4 (LICENSE+SPDX together) | | `v-ecosystem/v-*`, `satellites/*`, `julia-ecosystem/`, `scaffoldia/` | Submodules — separate repos | ## Why draft Per-subdir scoping; owner sight on coverage decisions before merge. ## Verification ``` grep -rl 'SPDX-License-Identifier: PMPL-1.0-or-later' <phase-3-paths> # returns: 0 files ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
🔍 Hypatia Security ScanFindings: 860 issues detected
View findings[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
added a commit
that referenced
this pull request
Jun 2, 2026
…ase 4) (#106) ## Summary Phase 4 of the developer-ecosystem PMPL→MPL-2.0 sweep. Companion to #103/#104/#105. This PR covers the **14 dev-ecosystem sub-projects that have their own PMPL-1.0-or-later LICENSE files** (a more invasive change than the SPDX-only flips in earlier phases — LICENSE file content is also replaced). ## Why these sub-projects, not standalone repos Verified via `gh api repos/hyperpolymath/<name>` that **none of these 14 sub-projects have standalone GitHub repos** — they're dev-ecosystem-local (unlike the iser-tools/* or *iser standalones). So fixing them in dev-ecosystem is the right place — no risk of divergence from a parallel standalone. ## Scope **14 subdir LICENSE files replaced** (PMPL-1.0-or-later → MPL-2.0 canonical text, sourced from the dev-ecosystem root `LICENSE`): - `devkit-risc-v/`, `synapse/`, `bridge-nginx-zig/`, `techstack-enforcer/`, `riscv-guix-buildsys/`, `idris2-ecosystem/`, `packages/`, `opm-canonicalizer/`, `czech-file-knife/`, `dnfinition/`, `well-known-ecosystem/`, `aggregate-library/`, `deno-ecosystem/`, `rescript-ecosystem/rescript-dom-mounter/` **Source SPDX flips** (count below — see verification). ## Explicitly EXCLUDED from this PR - `rescript-ecosystem/rescript-vite/` — **EXCLUDED** as potential upstream ReScript-Vite fork (same precautionary stance as `rescript-tea/` and `affinescript-vite/`). Owner-flagged 2026-06-02. Will be revisited separately after fork-vs-local classification. ## Verification ```sh # All 14 Phase 4 subdir LICENSEs now MPL-2.0: for d in <14 phase-4 subdirs>; do head -1 "$d/LICENSE"; done # all return: SPDX-License-Identifier: MPL-2.0 # Source SPDX in Phase 4 scope: grep -rl 'SPDX-License-Identifier: PMPL-1.0-or-later' <14 phase-4 subdirs> # returns: 0 files ``` ## Why draft LICENSE file replacements are more invasive than SPDX flips. Owner sight before merge. ## Pattern this PR follows - `neurophone#102` for the SPDX-flip mechanics - Same care-bracketing as `iser-tools/` (#104), but with the additional LICENSE-file step - `rescript-vite/` deliberately deferred for fork-vs-local classification 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
🔍 Hypatia Security ScanFindings: 860 issues detected
View findings[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
added a commit
to hyperpolymath/standards
that referenced
this pull request
Jun 2, 2026
…#344) ## Summary First in a per-subdir series for standards PMPL→**AGPL-3.0-or-later** source-SPDX alignment. **Note the direction**: standards is category 3 (son-shared per [[standards-agpl-intentional]]), so source SPDX flips to `AGPL-3.0-or-later`, **not** MPL-2.0 (which is the sole-owner default for repos like dev-ecosystem and neurophone). ## Repo state confirmed - Root LICENSE: AGPL-3.0-or-later ✓ - Source SPDX: 3,553 files carry `PMPL-1.0-or-later` from legacy carve-out era - consent-aware-http subdir has its own special hybrid (MPL-2.0 source + CC-BY-4.0 spec + PMPL-2.0-or-later reference) — EXCLUDED from this PR ## Phase 1 scope (this PR) **700 files** flipped `PMPL-1.0-or-later` → `AGPL-3.0-or-later`: | Area | Files | |---|---| | Repo root | 28 | | `docs/` | 319 | | `.machine_readable/` | 57 | | ~30 small subdirs with no own LICENSE (meta-a2ml, session-management-standards, agentic-a2ml, anchor-a2ml, k9-coordination-protocol, standards-update, scripts, state-a2ml, ecosystem-a2ml, playbook-a2ml, neurosym-a2ml, toolchain-readiness-grades, overlay-protocol, a2ml-templates, .verisimdb, inline-annotations, hooks, launcher, contractiles, adoption-readiness-grades, panll-panels, hypatia-rules, foundations-readiness-grades, component-readiness-grades, publication-pre-flight, ensaid-config, ai-instruction, tasks, standards, release-pre-flight, tools, testing-and-benchmarking, .meta, immaculate-guide, .github, accessibility) | ~296 | ## Explicitly EXCLUDED | Path | Reason | Files | |---|---|---| | `a2ml/` | Own PMPL LICENSE — Phase 2 (LICENSE+SPDX to AGPL combined) | 1,171 | | `k9-svc/` | Own PMPL LICENSE — Phase 2 | 1,160 | | `rhodium-standard-repositories/` | Own PMPL LICENSE — Phase 2 | 122 | | `0-ai-gatekeeper-protocol/` | Own PMPL LICENSE — Phase 2 | 107 | | `lol/` | Own PMPL LICENSE — Phase 2 | 105 | | `avow-protocol/` | Own PMPL LICENSE + check-in copy of standalone `hyperpolymath/avow-protocol` — skip (fix in standalone) | 90 | | `axel-protocol/` | Own PMPL LICENSE — Phase 2 | 49 | | `consent-aware-http/` | **Special hybrid** licensing (MPL-2.0 src + CC-BY-4.0 spec + PMPL-2.0-or-later ref) per owner directive 2026-06-02 | 39 | | `outreach/` | Own LICENSE — Phase 2 review | 10 | ## Pattern this PR follows - `hyperpolymath/neurophone#102` for SPDX-flip mechanics - `hyperpolymath/developer-ecosystem#103/#105` for per-subdir scoping - **First time** the destination is AGPL not MPL — be aware ## Verification ```sh grep -rl 'SPDX-License-Identifier: PMPL-1.0-or-later' <phase-1-paths> # returns: 0 files ``` ## Why draft License sweep + first-of-kind AGPL destination; owner sight before merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jun 2, 2026
#104) ## Summary Phase 2 of the developer-ecosystem PMPL→MPL-2.0 sweep (Phase 1 = #103). This PR covers the `iser-tools/` subtree as a single batch per the per-subdir scoping plan. ## Scope **5,039 files** flipped `SPDX-License-Identifier: PMPL-1.0-or-later` → `MPL-2.0` across 23 `*iser/` subdirs: | Subdir | Files | |---|---| | `iser-tools/nimiser/` | 225 | | `iser-tools/ponyiser/`, `iser-tools/otpiser/`, `iser-tools/oblibeniser/`, `iser-tools/iseriser/`, `iser-tools/idrisiser/` | 222 each | | `iser-tools/wokelangiser/`, `iser-tools/mylangiser/`, `iser-tools/lustreiser/`, `iser-tools/julianiser/` | 221 each | | `iser-tools/tlaiser/`, `iser-tools/halideiser/` | 220 each | | `iser-tools/phronesiser/` | 219 | | `iser-tools/ephapaxiser/`, `iser-tools/chapeliser/`, `iser-tools/bqniser/` | 217 each | | `iser-tools/eclexiaiser/`, `iser-tools/dafniser/`, `iser-tools/betlangiser/`, `iser-tools/atsiser/`, `iser-tools/anvomidaviser/` | 216 each | | `iser-tools/futharkiser/`, `iser-tools/alloyiser/` | 215 each | ## Verification - Each `iser-tools/*/LICENSE` is already MPL-2.0 ✓ — only the source-file SPDX stamps were drifting. - These are check-in copies (NOT git submodules — verified, no `.gitmodules` entries for `iser-tools/`). - `grep -rl 'SPDX-License-Identifier: PMPL-1.0-or-later' iser-tools/` returns **0 files** post-sweep. ## Coordination note The standalone `hyperpolymath/*iser` repos (`nimiser`, `ponyiser`, `idrisiser`, `iseriser`, `anvomidaviser`, `otpiser`, etc.) exist as separate repos in the org and **all still have PMPL source SPDX drift today**. Each will need its own equivalent flip PR (separate work). If `iser-tools/` is auto-regenerated from those, the changes here will revert on next sync — flag for owner: which is the source of truth? ## Why draft Single PR with 5,039 files changed (uniform SPDX header flip); owner sight on diff size before merge. ## Same pattern as - `hyperpolymath/neurophone#102` (canonical PMPL→MPL fix) - `#103` (Phase 1: root + small infra) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First in a series of per-subdir PRs to bring developer-ecosystem source SPDX into alignment with the canonical 2026-06-02 estate license policy (sole-owner repos default
MPL-2.0).Repo state today:
license: "MPL-2.0"✓PMPL-1.0-or-laterSPDX stamps from the pre-licence(A5/#7): normalise malformed PMPL SPDX values (owner carve-out, SPDX-only) #77 owner-carve-out era — that policy was superseded by the 2026-06-02 directive.Phase 1 scope (this PR)
69 files flipped
PMPL-1.0-or-later→MPL-2.0:.github/.machine_readable/docs/,tests/,hooks/,contractiles/,ffi/,.well-known/,shellstate/Explicitly EXCLUDED from this PR
To stay scoped + reviewable, this PR does NOT touch:
v-ecosystem/v-{graphql,grpc,rest}/,satellites/*,julia-ecosystem/,scaffoldia/— separate repos, get their own PRs.rescript-ecosystem/rescript-tea/— possible upstream ReScript-Tea fork. Estate policy: leave third-party alone.rescript-ecosystem/idaptik-rescript13-staging/— AGPL inheritance from son-shared idaptik repo.affinescript-ecosystem/affinescript-vite/— possible upstream fork.iser-tools/,rescript-ecosystem/,asdf-augmenters/,affinescript-ecosystem/, and ~20 smaller sub-ecosystems — each gets its own per-subdir PR.Pattern this PR follows
Same shape as
hyperpolymath/neurophone#102(the canonical PMPL→MPL fix), just narrower scope.Verification
Why draft
License sweep aftermath; owner sight on the per-subdir approach before extending to Phase 2/3 PRs.
🤖 Generated with Claude Code