chore: relicense to MPL-2.0, add README.md, bump 0.4.1

npm rejected 0.4.0 for missing README (it only recognises .md, not .adoc).
Added README.md as a direct Markdown conversion of README.adoc, switched
SPDX identifier in package.json to MPL-2.0, added README.md to the
published files array, bumped version.

Note: LICENSE file replacement and scattered SPDX-in-source-headers
cleanup still needed for full MPL-2.0 consistency.

https://claude.ai/code/session_01AQeaZPrDneQqFYxwxVTJqm

Author: claude

README.md

@@ -0,0 +1,73 @@
+# boj-server
+
+[![OpenSSF Best Practices](https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity)](https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/boj-server)
+[![Glama MCP Server](https://glama.ai/mcp/servers/hyperpolymath/boj-server/badge)](https://glama.ai/mcp/servers/hyperpolymath/boj-server)
+[![Green Hosting](https://api.thegreenwebfoundation.org/greencheckimage/boj-server.net)](https://www.thegreenwebfoundation.org/green-web-check/?url=boj-server.net)
+
+BoJ (Bundle of Joy) is a unified MCP server that consolidates all hyperpolymath tooling into a single endpoint — GitHub, GitLab, Cloudflare, Vercel, Verpex, Gmail, Calendar, browser automation, research, ML, and 50+ open-source cartridges.
+
+## Install
+
+Add to Claude Code:
+
+```bash
+claude mcp add boj-server -- npx -y @hyperpolymath/boj-server@latest
+```
+
+Or clone and configure:
+
+```bash
+git clone https://github.com/hyperpolymath/boj-server
+cd boj-server/mcp-bridge && npm install
+# Start the BoJ REST API first (port 7700), then:
+claude mcp add boj-server -- node mcp-bridge/main.js
+```
+
+Glama listing: <https://glama.ai/mcp/servers/hyperpolymath/boj-server>
+
+## Features
+
+- **GitHub/GitLab** — repos, issues, PRs, code search, mirroring (22 tools)
+- **Cloud** — Cloudflare (DNS, Workers, KV, R2, D1), Vercel (deployments, projects), Verpex (cPanel)
+- **Communication** — Gmail, Google Calendar
+- **Browser** — Firefox automation: navigate, click, type, screenshot, arbitrary JS (7 tools)
+- **Code Intelligence** — CodeSeeker hybrid search + graph RAG
+- **Research** — Semantic Scholar papers, citations, authors
+- **ML** — Hugging Face model / dataset / inference
+- **Local coordination** — `local-coord-mcp` (24 tools): multi-instance AI peer discovery, typed envelopes, claim/heartbeat/watchdog, quarantine + master/journeyman/apprentice supervision, track-record affinity, capability advertisement
+- **Cartridges** — 100 pluggable cartridges across Teranga / Shield / Ayo trust tiers
+
+## Local-coord-mcp at a glance
+
+Localhost multi-agent bus on `127.0.0.1:7745`. Lets multiple Claude / Gemini / Codex / Vibe sessions on the same machine discover each other, claim tasks without collision, and operate under a supervision model (master approves; journeyman executes; apprentice stays gated).
+
+Highlights:
+
+- **Peer registration** with `client_kind`, `variant` (model id — `opus-4.7`, `flash-2.5`, `leanstral`), capability class/tier/prover-strengths — `coord_register`, `coord_set_variant`, `coord_set_capabilities`, `coord_get_peer_capabilities`.
+- **Typed envelopes** validated at the bridge via Nickel contracts (`coord-messages.ncl`) — `coord_send`, `coord_send_gated`.
+- **Task claims** with role-based watchdog TTL (apprentice 30s / journeyman 5m / master none), heartbeats via `coord_progress`, auto-release + explicit `coord_sweep_watchdog`.
+- **Track-record + reassignment** — `coord_report_outcome`, `coord_get_affinities`, `coord_scan_suggestions` (emits `overclaim` fyi + `drift` warn envelopes on confidence/affinity divergence).
+- **Supervision** — `coord_review`, `coord_approve`, `coord_reject`, `coord_promote_to_master`, `coord_transfer_master`.
+- **Observability** — `coord_health` snapshot of peer/quarantine/claim/reject state.
+
+Formally verified core in Idris2 (`cartridges/local-coord-mcp/abi/LocalCoord/`); Zig FFI; Deno/Node MCP bridge with input hardening (rate limiting, prompt-injection detection with unicode-normalisation, error sanitisation).
+
+## Glama AAA posture
+
+This server targets Glama's AAA tier. Posture:
+
+- **Inspectable** — `.mcp.json` + root `package.json` `bin` entry + shebang; offline manifest fallback so cloud inspection works without the REST backend (see `mcp-bridge/lib/offline-menu.js`).
+- **Tool Definition Quality** — every tool carries purpose, usage guidance, behavioural transparency (side effects, returns, errors), and parameter semantics with enums, ranges, and patterns. A coherence test enforces a minimum description floor so the server-level score (60% mean + 40% *min*) cannot regress — see `mcp-bridge/tests/dispatch_test.js`.
+- **Server Coherence** — one tool ↔ one verb; consistent `boj_<domain>_<action>` and `coord_<action>` naming; the same test asserts the bridge tool list matches the cartridge manifest so nothing advertised is un-dispatched (or vice versa).
+- **Security** — PR #27 hardening: rate limiting, size caps, prompt-injection detection with unicode-confusable normalisation, error sanitisation (strips paths, stack traces, env vars). SHA-pinned workflow actions.
+- **Formal** — `cartridges/local-coord-mcp/abi/LocalCoord/*.idr` Idris2 ABI + proof obligations (P-01..P-07).
+
+Run the coherence tests:
+
+```bash
+npm test
+```
+
+## License
+
+MPL-2.0 — see [LICENSE](./LICENSE).

package.json

@@ -1,8 +1,8 @@
 {
   "name": "@hyperpolymath/boj-server",
-  "version": "0.4.0",
-  "description": "Bundle of Joy (BoJ) MCP Server — cartridge-based DevOps + multi-agent coordination toolkit with 100 domain cartridges (database, container, git, k8s, observability, secrets, IaC, multi-instance AI coord, and more). Formally verified (Idris2) core; PMPL-1.0-or-later.",
-  "license": "PMPL-1.0-or-later",
+  "version": "0.4.1",
+  "description": "Bundle of Joy (BoJ) MCP Server — cartridge-based DevOps + multi-agent coordination toolkit with 100 domain cartridges (database, container, git, k8s, observability, secrets, IaC, multi-instance AI coord, and more). Formally verified (Idris2) core; MPL-2.0.",
+  "license": "MPL-2.0",
   "author": "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
   "repository": {
     "type": "git",
@@ -42,7 +42,7 @@
   "files": [
     "mcp-bridge/",
     "LICENSE",
-    "README.adoc"
+    "README.md"
   ],
   "publishConfig": {
     "access": "public",