From 71c8be34beeb23a5ab2e35466482890bf2c48bbf Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 26 Jun 2026 21:41:10 +0000 Subject: [PATCH 1/2] chore(ci): remove temporary print-findings scaffolding from scan wrapper The print-findings job was triage scaffolding (it cat'd the uploaded hypatia-findings.json to the job log to enumerate self-scan findings without artifact download). It was marked "remove before merge" but shipped to main with #545. Restore the wrapper to its thin form: the scan job + secrets: inherit only. Findings remain available via the hypatia-scan-findings artifact uploaded by the reusable. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01V13sGvHnaeCY5A9fF2QsDm --- .github/workflows/hypatia-scan.yml | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 079abaa8..8e5e50d4 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -29,23 +29,3 @@ jobs: hypatia: uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@e2ef79eecdd623ff631fcbf3fe0268ba4f4ce166 secrets: inherit - - # TEMPORARY (triage scaffolding — remove before merge): echo the uploaded - # findings JSON to the job log so the full self-scan finding list is - # retrievable without artifact download. Used to triage the medium-severity - # self-scan findings on claude/hypatia-scan-triage. - print-findings: - needs: hypatia - if: always() - runs-on: ubuntu-latest - timeout-minutes: 5 - steps: - - name: Download findings artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: hypatia-scan-findings - - name: Print findings JSON - run: | - echo "===HYPATIA-FINDINGS-BEGIN===" - cat hypatia-findings.json - echo "===HYPATIA-FINDINGS-END===" From bc42c794cd35003be8c8e91d337607c9b472ccda Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 26 Jun 2026 21:58:39 +0000 Subject: [PATCH 2/2] fix(licence): correct hypatia classification to MPL-2.0 (estate task #417) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hypatia is a sole-owner repo → MPL-2.0 per the estate five-way licence policy, but its manifests declared AGPL-3.0-or-later and the README led with a PMPL-1.0 (Palimpsest) badge. PMPL is reserved for exactly three repos and "NOWHERE ELSE"; AGPL is flagged as a banned anti-pattern in .machine_readable/6a2/AGENTIC.a2ml ("Use AGPL license (this is a MPL-2.0 repo)"). Owner-directed fix (licence changes are owner-only). - Cargo manifests (8): license AGPL-3.0-or-later → MPL-2.0 (root, adapters, data, fixer, integration, scripts/bench-tools, scripts/ci-tools, tools/cii-registrar). - README.adoc: replace the PMPL-1.0 badge with an MPL-2.0 licence badge. - docs/: add the established CC-BY-SA-4.0 SPDX header to 11 documentation files that lacked one (add-only; existing headers untouched). Already correct, unchanged: root LICENSE (verbatim MPL-2.0), LICENSES/{MPL-2.0,CC-BY-SA-4.0}.txt, code SPDX headers (MPL-2.0). Deliberately NOT swept (flagged for owner): PALIMPSEST.adoc, integration/fixtures/test-repo/README.md (fixture), test/soundness/README.adoc (test corpus), .claude/CLAUDE.md, .hypatia-exemptions.md (tooling/config). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01V13sGvHnaeCY5A9fF2QsDm --- Cargo.toml | 2 +- README.adoc | 2 +- adapters/Cargo.toml | 2 +- data/Cargo.toml | 2 +- docs/architecture/system-integration.md | 4 +++- docs/design/DESIGN-NARRATIVE.md | 4 +++- docs/integration/a2ml-k9.md | 4 +++- docs/proofs/gap-analysis.md | 4 +++- docs/proofs/needs.md | 4 +++- docs/quickstart/developer.adoc | 3 ++- docs/quickstart/maintainer.adoc | 3 ++- docs/reports/audit/audit-2026-04-15-post.md | 4 +++- docs/reports/audit/pillar-audit-2026-04-15.md | 4 +++- docs/testing/audit.md | 4 +++- docs/testing/needs.md | 4 +++- fixer/Cargo.toml | 2 +- integration/Cargo.toml | 2 +- scripts/bench-tools/Cargo.toml | 2 +- scripts/ci-tools/Cargo.toml | 2 +- tools/cii-registrar/Cargo.toml | 2 +- 20 files changed, 40 insertions(+), 20 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 399bf149..edc5d904 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -15,7 +15,7 @@ members = [ version = "0.1.0" edition = "2021" authors = ["Jonathan D.A. Jewell "] -license = "AGPL-3.0-or-later" +license = "MPL-2.0" repository = "https://github.com/hyperpolymath/hypatia" homepage = "https://hypatia.reposystem.dev" diff --git a/README.adoc b/README.adoc index 201da57d..d8462dd0 100644 --- a/README.adoc +++ b/README.adoc @@ -1,4 +1,4 @@ -image:https://raw.githubusercontent.com/hyperpolymath/palimpsest-license/main/assets/badges/svg/badge-standard.svg[PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] +image:https://img.shields.io/badge/license-MPL--2.0-blue.svg[MPL-2.0,link="https://www.mozilla.org/en-US/MPL/2.0/"] // SPDX-License-Identifier: CC-BY-SA-4.0 diff --git a/adapters/Cargo.toml b/adapters/Cargo.toml index bd302ed9..3e004e77 100644 --- a/adapters/Cargo.toml +++ b/adapters/Cargo.toml @@ -5,7 +5,7 @@ version = "0.1.0" edition = "2021" authors = ["Jonathan D.A. Jewell "] description = "Multi-forge adapters for Hypatia CI/CD platform" -license = "AGPL-3.0-or-later" +license = "MPL-2.0" repository = "https://github.com/hyperpolymath/hypatia" homepage = "https://hypatia.reposystem.dev" diff --git a/data/Cargo.toml b/data/Cargo.toml index 5e714a9e..69c0731b 100644 --- a/data/Cargo.toml +++ b/data/Cargo.toml @@ -5,7 +5,7 @@ version = "0.1.0" edition = "2021" authors = ["Jonathan D.A. Jewell "] description = "Data layer clients for Hypatia (ArangoDB, Dragonfly)" -license = "AGPL-3.0-or-later" +license = "MPL-2.0" repository = "https://github.com/hyperpolymath/hypatia" homepage = "https://hypatia.reposystem.dev" diff --git a/docs/architecture/system-integration.md b/docs/architecture/system-integration.md index b58f5902..cb16944a 100644 --- a/docs/architecture/system-integration.md +++ b/docs/architecture/system-integration.md @@ -1,3 +1,5 @@ + + # Hypatia System Integration - Complete Flow **Status:** ✅ Fully wired and functional (2026-01-25) @@ -300,4 +302,4 @@ After: --- -**The system is now fully operational and autonomous.** +**The system is now fully operational and autonomous.** \ No newline at end of file diff --git a/docs/design/DESIGN-NARRATIVE.md b/docs/design/DESIGN-NARRATIVE.md index cb558a97..948874f0 100644 --- a/docs/design/DESIGN-NARRATIVE.md +++ b/docs/design/DESIGN-NARRATIVE.md @@ -1,3 +1,5 @@ + + # The Hypatia Story: From Broken Pipeline to Autonomous Security Intelligence *A design narrative for future reference — what we built, why, and what it means.* @@ -219,4 +221,4 @@ the neurosymbolic intelligence layer that ties scanners to fixers to verifiers to learners across 300+ repos with formal proof integration. That's not hubris. It's what happens when you need something that doesn't -exist yet, so you build it. +exist yet, so you build it. \ No newline at end of file diff --git a/docs/integration/a2ml-k9.md b/docs/integration/a2ml-k9.md index 0bb94297..377e545a 100644 --- a/docs/integration/a2ml-k9.md +++ b/docs/integration/a2ml-k9.md @@ -1,3 +1,5 @@ + + # Hypatia a2ml & K9 Integration **Status:** ✅ IMPLEMENTED @@ -484,4 +486,4 @@ cat /tmp/echidna-validation-report-*.md **Last Updated:** 2026-02-06T22:45:00+00:00 **Maintained By:** Hypatia Development Team -**Status:** ✅ Production Ready +**Status:** ✅ Production Ready \ No newline at end of file diff --git a/docs/proofs/gap-analysis.md b/docs/proofs/gap-analysis.md index b5483a09..f05f0f67 100644 --- a/docs/proofs/gap-analysis.md +++ b/docs/proofs/gap-analysis.md @@ -1,3 +1,5 @@ + + # Proofs Gap Analysis **Date:** 2026-04-22 @@ -280,4 +282,4 @@ k-means convergence, federation consistency. Each is its own branch. proofs are now merge-blocking. 11 proof files gated in CI (2 original Lean + 3 new Lean + 7 Idris — awaiting one Idris stamp cycle). Remaining tractable work is mathlib integration for the analytical -halves of PageRank + ESN convergence. +halves of PageRank + ESN convergence. \ No newline at end of file diff --git a/docs/proofs/needs.md b/docs/proofs/needs.md index 6d14eef4..a11821ae 100644 --- a/docs/proofs/needs.md +++ b/docs/proofs/needs.md @@ -1,3 +1,5 @@ + + # PROOF-NEEDS.md — hypatia ## Current State (Updated 2026-06-05) @@ -51,4 +53,4 @@ numerical properties (**+ Mathlib** for the analytic convergence results). ## Priority **MEDIUM** — H1–H9 are complete (H6 as a runtime assertion). The remaining work -is the two neural-convergence theorems, which require pulling in Mathlib. +is the two neural-convergence theorems, which require pulling in Mathlib. \ No newline at end of file diff --git a/docs/quickstart/developer.adoc b/docs/quickstart/developer.adoc index 69634b11..23740bbf 100644 --- a/docs/quickstart/developer.adoc +++ b/docs/quickstart/developer.adoc @@ -1,3 +1,4 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 = Hypatia — Developer Quickstart :toc: preamble @@ -36,4 +37,4 @@ just assail # run panic-attacker security scan == Contributing -See link:CONTRIBUTING.md[CONTRIBUTING.md] for guidelines. +See link:CONTRIBUTING.md[CONTRIBUTING.md] for guidelines. \ No newline at end of file diff --git a/docs/quickstart/maintainer.adoc b/docs/quickstart/maintainer.adoc index 7a9607e6..032551e8 100644 --- a/docs/quickstart/maintainer.adoc +++ b/docs/quickstart/maintainer.adoc @@ -1,3 +1,4 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 = Hypatia — Maintainer Quickstart :toc: preamble @@ -37,4 +38,4 @@ podman build -f Containerfile -t hypatia:latest . == Mirrors This repo is mirrored to GitLab and Bitbucket (hyperpolymath accounts) -via the `mirror.yml` workflow. +via the `mirror.yml` workflow. \ No newline at end of file diff --git a/docs/reports/audit/audit-2026-04-15-post.md b/docs/reports/audit/audit-2026-04-15-post.md index 0776fa07..0a96fa88 100644 --- a/docs/reports/audit/audit-2026-04-15-post.md +++ b/docs/reports/audit/audit-2026-04-15-post.md @@ -1,3 +1,5 @@ + + # Post-audit Status Report: hypatia - **Date:** 2026-04-15 - **Status:** Complete (M5 Sweep) @@ -88,4 +90,4 @@ - Rust project has test infrastructure but no mutation-test configuration (cargo-mutants/.cargo-mutants.toml) — add `cargo mutants` to verify test suite kills mutations ## Final Grade -- **CRG Grade:** D (Promoted from E/X) - CI and lockfiles are in place. +- **CRG Grade:** D (Promoted from E/X) - CI and lockfiles are in place. \ No newline at end of file diff --git a/docs/reports/audit/pillar-audit-2026-04-15.md b/docs/reports/audit/pillar-audit-2026-04-15.md index dab3d54b..a9d0e174 100644 --- a/docs/reports/audit/pillar-audit-2026-04-15.md +++ b/docs/reports/audit/pillar-audit-2026-04-15.md @@ -1,3 +1,5 @@ + + # Gemini Audit Report (M2: Pillar Repo Audits) Date: 2026-04-15 Repository: /var/mnt/eclipse/repos/hypatia @@ -15,4 +17,4 @@ Repository: /var/mnt/eclipse/repos/hypatia ## Verdict - **CRG Grade**: A -- **Publishable?**: YES +- **Publishable?**: YES \ No newline at end of file diff --git a/docs/testing/audit.md b/docs/testing/audit.md index 54c0966f..ef8ee724 100644 --- a/docs/testing/audit.md +++ b/docs/testing/audit.md @@ -1,3 +1,5 @@ + + # Testing-Taxonomy Audit **Date:** 2026-04-22 @@ -194,4 +196,4 @@ Each item estimated in calendar-days assuming one focused contributor. ## 8. Appendix — file inventory by category -Full mapping in `.machine_readable/testing/blitz.a2ml`. +Full mapping in `.machine_readable/testing/blitz.a2ml`. \ No newline at end of file diff --git a/docs/testing/needs.md b/docs/testing/needs.md index 60170fa3..ed318635 100644 --- a/docs/testing/needs.md +++ b/docs/testing/needs.md @@ -1,3 +1,5 @@ + + # TEST-NEEDS.md — hypatia ## CRG Grade: B — ACHIEVED 2026-04-04 @@ -103,4 +105,4 @@ ### Self-Tests - [ ] Rule module self-validation (15 rules, none self-tested) -- [ ] Neural model loading verification +- [ ] Neural model loading verification \ No newline at end of file diff --git a/fixer/Cargo.toml b/fixer/Cargo.toml index 0835fe9c..f1d382d0 100644 --- a/fixer/Cargo.toml +++ b/fixer/Cargo.toml @@ -5,7 +5,7 @@ version = "0.1.0" edition = "2021" authors = ["Jonathan D.A. Jewell "] description = "Programmatic CI/CD workflow fixer for Hypatia" -license = "AGPL-3.0-or-later" +license = "MPL-2.0" repository = "https://github.com/hyperpolymath/hypatia" homepage = "https://hypatia.reposystem.dev" diff --git a/integration/Cargo.toml b/integration/Cargo.toml index 6009a645..c1a20637 100644 --- a/integration/Cargo.toml +++ b/integration/Cargo.toml @@ -5,7 +5,7 @@ version = "0.1.0" edition = "2021" authors = ["Jonathan D.A. Jewell "] description = "Integration test framework for Hypatia" -license = "AGPL-3.0-or-later" +license = "MPL-2.0" repository = "https://github.com/hyperpolymath/hypatia" homepage = "https://hypatia.reposystem.dev" publish = false diff --git a/scripts/bench-tools/Cargo.toml b/scripts/bench-tools/Cargo.toml index 5a71114a..af013a65 100644 --- a/scripts/bench-tools/Cargo.toml +++ b/scripts/bench-tools/Cargo.toml @@ -12,7 +12,7 @@ name = "bench-tools" version = "0.1.0" edition = "2021" -license = "AGPL-3.0-or-later" +license = "MPL-2.0" publish = false [lib] diff --git a/scripts/ci-tools/Cargo.toml b/scripts/ci-tools/Cargo.toml index bd4df1f1..ce06ecc4 100644 --- a/scripts/ci-tools/Cargo.toml +++ b/scripts/ci-tools/Cargo.toml @@ -10,7 +10,7 @@ name = "ci-tools" version = "0.1.0" edition = "2021" -license = "AGPL-3.0-or-later" +license = "MPL-2.0" publish = false [[bin]] diff --git a/tools/cii-registrar/Cargo.toml b/tools/cii-registrar/Cargo.toml index d627f5ca..0839a21a 100644 --- a/tools/cii-registrar/Cargo.toml +++ b/tools/cii-registrar/Cargo.toml @@ -5,7 +5,7 @@ version = "0.1.0" edition = "2021" authors = ["Jonathan D.A. Jewell "] description = "CLI tool for registering projects with OpenSSF Best Practices Badge" -license = "AGPL-3.0-or-later" +license = "MPL-2.0" repository = "https://github.com/hyperpolymath/hypatia" keywords = ["openssf", "cii", "badge", "security", "automation"] categories = ["command-line-utilities", "development-tools"]