fix(licence): correct hypatia classification to MPL-2.0 (estate task #417) - #552
Merged
Conversation
The print-findings job was triage scaffolding (it cat'd the uploaded hypatia-findings.json to the job log to enumerate self-scan findings without artifact download). It was marked "remove before merge" but shipped to main with #545. Restore the wrapper to its thin form: the scan job + secrets: inherit only. Findings remain available via the hypatia-scan-findings artifact uploaded by the reusable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V13sGvHnaeCY5A9fF2QsDm
…417) hypatia is a sole-owner repo → MPL-2.0 per the estate five-way licence policy, but its manifests declared AGPL-3.0-or-later and the README led with a PMPL-1.0 (Palimpsest) badge. PMPL is reserved for exactly three repos and "NOWHERE ELSE"; AGPL is flagged as a banned anti-pattern in .machine_readable/6a2/AGENTIC.a2ml ("Use AGPL license (this is a MPL-2.0 repo)"). Owner-directed fix (licence changes are owner-only). - Cargo manifests (8): license AGPL-3.0-or-later → MPL-2.0 (root, adapters, data, fixer, integration, scripts/bench-tools, scripts/ci-tools, tools/cii-registrar). - README.adoc: replace the PMPL-1.0 badge with an MPL-2.0 licence badge. - docs/: add the established CC-BY-SA-4.0 SPDX header to 11 documentation files that lacked one (add-only; existing headers untouched). Already correct, unchanged: root LICENSE (verbatim MPL-2.0), LICENSES/{MPL-2.0,CC-BY-SA-4.0}.txt, code SPDX headers (MPL-2.0). Deliberately NOT swept (flagged for owner): PALIMPSEST.adoc, integration/fixtures/test-repo/README.md (fixture), test/soundness/README.adoc (test corpus), .claude/CLAUDE.md, .hypatia-exemptions.md (tooling/config). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V13sGvHnaeCY5A9fF2QsDm
hyperpolymath
marked this pull request as ready for review
June 26, 2026 22:01
This was referenced Jun 27, 2026
hyperpolymath
added a commit
that referenced
this pull request
Jun 27, 2026
…iles (#559) ## Summary Two follow-ups to the merged scanner-cache + licence work. ### 1. Refresh remaining standards reusable pins → `e9c8888` `hypatia-scan.yml` was bumped in #558; this brings the other four standards reusable pins to current standards `main` (`e9c8888`): | Workflow | was | now | |---|---|---| | `governance.yml` | `d7c2271` | `e9c8888` | | `secret-scanner.yml` | `d135b05` | `e9c8888` | | `scorecard.yml` | `d7c2271` | `e9c8888` | | `mirror.yml` | `d135b05` | `e9c8888` | This **wires the source-pinned scanner cache fix (standards#441) into the `Validate Hypatia Baseline` governance job** — previously it ran on the static `hypatia-scanner-v2-Linux-build` cache key (stale binary). Now the governance reusable rebuilds the scanner when hypatia `main` advances. ### 2. Add `CC-BY-SA-4.0` SPDX to 4 docs files (owner-approved) Follow-up to #552, which added the doc SPDX to 11 `docs/` files but left these four untouched pending explicit owner sign-off (no bulk-sweep). Same first-line `<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->` style as `SECURITY.md` and the #552 docs: - `integration/README.md` - `tools/invariant-path/README.md` - `.machine_readable/benchmarks/README.md` - `src/ui/gossamer/BURBLE-DEFERRAL.md` No LICENSE text or per-file licence reclassification — only doc SPDX headers. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- _Generated by [Claude Code](https://claude.ai/code/session_017wGTeLwiBGJ5rETC3QT4Pm)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jun 27, 2026
#560) ## Summary Completes the prose-SPDX authoring deliberately left out of #552 under the no-bulk-sweep guardrail. Owner-approved 2026-06-27. Adds the estate prose licence header `<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->` to four hypatia-authored prose files that were missing it: - `integration/README.md` - `tools/invariant-path/README.md` - `.machine_readable/benchmarks/README.md` - `src/ui/gossamer/BURBLE-DEFERRAL.md` ## Guardrail compliance - hypatia is a **sole-owner MPL-2.0** repo; CC-BY-SA-4.0 is the estate licence for **prose** (the established code/prose split, same as the 11 files in #552). - This is **authoring a correct-from-birth header, not relicensing** — no existing licence identity is changed, no third-party/vendored file is touched, and it is per-file (4 named files), not a bulk sweep. - Markdown HTML-comment header style, matching `SECURITY.md` and the other `.md` files in the repo that already carry it. ## Verification - All 4 files now begin with the SPDX header on line 1 (confirmed). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- _Generated by [Claude Code](https://claude.ai/code/session_01MJdfXv5E5gwGD2yaJq8jRM)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
hypatia is a sole-owner repo →
MPL-2.0per the estate five-way licence policy, but it was misclassified:AGPL-3.0-or-laterREADME.adocled with aPMPL-1.0(Palimpsest) badge — and PMPL is reserved for exactly three repos, "NOWHERE ELSE.".machine_readable/6a2/AGENTIC.a2mleven lists "Use AGPL license (this is a MPL-2.0 repo)" as a banned anti-pattern.This is the documented owner-only task #417 ("8 manifests AGPL → MPL"). Owner-directed.
Changes
Cargo.toml×8 —licenseAGPL-3.0-or-later→MPL-2.0(root,adapters,data,fixer,integration,scripts/bench-tools,scripts/ci-tools,tools/cii-registrar).README.adoc— PMPL-1.0 badge → MPL-2.0 licence badge (matching thePALIMPSEST.adocpattern).docs/×11 — added the establishedCC-BY-SA-4.0SPDX header to documentation files that lacked one (add-only; no existing header touched).Already correct (unchanged)
Root
LICENSE(verbatim MPL-2.0),LICENSES/{MPL-2.0,CC-BY-SA-4.0}.txt, all code SPDX headers (MPL-2.0).Deliberately NOT swept (flagged for owner judgement)
Per the "never bulk-sweep SPDX" guardrail, these were left untouched:
PALIMPSEST.adoc(palimpsest-sensitive),integration/fixtures/test-repo/README.md(fixture),test/soundness/README.adoc(test corpus),.claude/CLAUDE.md,.hypatia-exemptions.md(tooling/config).🤖 Generated with Claude Code
Generated by Claude Code