chore(license): consent-aware-http hybrid (MPL-2.0 source + CC-BY-4.0 prose)

[hyperpolymath]

Summary

Implements the hybrid licensing for consent-aware-http per the 2026-06-02 owner directive (memory: feedback_consent_aware_http_hybrid_licensing.md).

This is a follow-on to standards#344/#345 which left consent-aware-http/ excluded pending design.

Hybrid licensing model

Aspect	License	Rationale
Source files (.zig, .yml, .a2ml, Mustfile, etc.)	MPL-2.0	Estate sole-owner default; standards parent's AGPL does NOT inherit here
Prose / spec / docs (.adoc, .md)	CC-BY-4.0	IETF-compatible; aligns with how standards bodies license specs
In-text reference	PMPL-2.0-or-later	Spec text REFERENCES PMPL-2.0-or-later for cultural/ethical/post-quantum framing. NOT applied as SPDX.
LICENSE file	MPL-2.0 (canonical)	Code is the operative source-level license; CC-BY-4.0 docs are handled via per-file SPDX

Scope (39 files + LICENSE)

10 prose files flipped PMPL-1.0-or-later → CC-BY-4.0:

• consent-aware-http/SECURITY.md
• consent-aware-http/GOVERNANCE.adoc
• consent-aware-http/ROADMAP.adoc
• consent-aware-http/MAINTAINERS.adoc
• consent-aware-http/RSR_OUTLINE.adoc
• consent-aware-http/.migration/PYTHON_TO_RUST_AFFINESCRIPT.adoc
• consent-aware-http/PALIMPSEST.adoc
• consent-aware-http/CONTRIBUTING.adoc
• consent-aware-http/SCOPE.adoc
• consent-aware-http/CHANGELOG.adoc

29 source/infra files flipped PMPL-1.0-or-later → MPL-2.0:

• 3 .zig source files (ffi/zig/)
• 14 .yml workflows (.github/workflows/)
• 6 .a2ml manifests (.machine_readable/6a2/)
• 2 Mustfile + 1 Dustfile + 2 .gitattributes/.gitignore + 1 .github/FUNDING.yml

1 LICENSE replacement: consent-aware-http/LICENSE → canonical MPL-2.0 text (was PMPL-1.0-or-later).

Why draft

Hybrid model is a first-of-kind shape; owner sight before merge. Test plan below.

Test plan

• CI green (no new SPDX violations)
• CC-BY-4.0 on prose verifiable: grep -rl 'SPDX-License-Identifier: CC-BY-4.0' consent-aware-http/ returns 10 files
• MPL-2.0 on source/infra verifiable: grep -rl 'SPDX-License-Identifier: MPL-2.0$' consent-aware-http/ returns 28+ files
• LICENSE file is canonical MPL-2.0
• Confirm spec text body in drafts/*.xml references PMPL-2.0-or-later (no SPDX applied — that's intentional)

Related

• standards#344/chore(license): replace 7 subdir LICENSEs + flip 2717 SPDX → AGPL-3.0-or-later (Phase 2) #345 — left consent-aware-http excluded pending this design
• docs/LICENSE-POLICY.md (standards#349) — captures the hybrid model in the canonical estate policy doc
• Memory: feedback_consent_aware_http_hybrid_licensing.md

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 201 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	94

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🔍 Hypatia Security Scan

Findings: 201 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	94

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence