chore(dispatch): refuse auto licence/SPDX fixes (neurophone#99 closeout) (#247)

## Summary

- **Refusal gate** in `scripts/dispatch-runner.sh` `execute_entry()`:
any dispatch whose `recipe_id` or `category` matches
`{license,spdx,pmpl,mpl-2,agpl,palimpsest}` is refused before any fix
script can run. Records outcome `refused_license_policy`.
- **Refusal banner** in `scripts/fix-license-hygiene.sh`,
`scripts/fix-license-file.sh`, `scripts/fix-missing-spdx.sh`: prepend
`exit 1` so any direct invocation also refuses.

## Why

Owner directive 2026-06-02 forbids automated licence/SPDX edits.
Triggered by
[neurophone#99](hyperpolymath/neurophone#99) —
an auto-generated PR by the Claude bot reverting PMPL-1.0-or-later →
MPL-2.0 across ~140 files, closed by the owner. The underlying pipeline
kept being able to fire because the dispatcher had no licence-category
early-exit and the fix scripts had no self-refusal.

Five-way classification (verbatim owner directive):
> "mpl-2.0 is for my sole repos, all rights reserved is for 007,
agpl-3.0-or-later is for those shared with my son, and leave other
people's forked stuff alone … only palimpsest license for obvious
reasons should be talking about palipsest and palimpsest plasma, and
consent-aware-http, but in that case prospectively"

## Test plan

- [ ] Smoke-test `dispatch-runner.sh --dry-run` against a synthetic
manifest entry with `category: LicenseCompliance` — should print
`REFUSED` and not call any fix script.
- [ ] Direct invocation `./scripts/fix-license-file.sh /tmp/repo
/tmp/finding.json` exits 1 with the refusal banner.
- [ ] Direct invocation `./scripts/fix-license-hygiene.sh
/tmp/finding.json` exits 1 with the refusal banner.
- [ ] Direct invocation `./scripts/fix-missing-spdx.sh /tmp/repo
/tmp/finding.json` exits 1 with the refusal banner.

Related: hyperpolymath/hypatia rules/license-no-auto-fix,
hyperpolymath/standards docs/license-no-auto-policy.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

scripts/dispatch-runner.sh

@@ -223,6 +223,36 @@ execute_entry() {
         fi
     done
 
+    # --- License/SPDX auto-fix refusal gate (owner directive 2026-06-02) ---
+    #
+    # Estate policy forbids automated licence/SPDX edits. Licence remediation
+    # is manual, file-by-file, owner-only (see canonical memory
+    # `feedback_no_automated_licence_edits.md` and
+    # `feedback_estate_license_policy_umbrella.md`).
+    #
+    # Triggered by neurophone#99 (auto-PR reverting PMPL → MPL-2.0 across
+    # ~140 files, closed by owner). This gate refuses any auto_execute
+    # dispatch whose recipe_id or category looks license/SPDX-related,
+    # regardless of confidence score.
+    #
+    # Carve-out: the three palimpsest carve-out repos may still receive
+    # licence-related work — but only with manual owner approval, NOT
+    # auto-execute. So even those repos are gated here.
+    local category lower_recipe lower_category
+    category=$(echo "$entry" | jq -r '.category // ""')
+    lower_recipe=$(echo "$recipe_id" | tr '[:upper:]' '[:lower:]')
+    lower_category=$(echo "$category" | tr '[:upper:]' '[:lower:]')
+    case "$lower_recipe$lower_category" in
+        *license*|*spdx*|*pmpl*|*mpl-2*|*agpl*|*palimpsest*)
+            echo "  REFUSED: $pattern_id → $repo (license/SPDX auto-edits forbidden per estate policy 2026-06-02)"
+            echo "           recipe_id=$recipe_id category=$category"
+            echo "           Owner must approve and apply licence changes manually, per-file."
+            ((SKIPPED++)) || true
+            record_outcome "$pattern_id" "$recipe_id" "$repo" "" "refused_license_policy"
+            return
+            ;;
+    esac
+
     # Skip if repo doesn't exist locally
     if [[ ! -d "$repo_path" ]]; then
         echo "  SKIP: $repo (not found at $repo_path)"

scripts/fix-license-file.sh

@@ -3,6 +3,12 @@
 #
 # fix-license-file.sh — Auto-create LICENSE with MPL-2.0 text
 #
+# DISABLED 2026-06-02 per owner directive on licence policy.
+# See `feedback_no_automated_licence_edits.md` and
+# `feedback_estate_license_policy_umbrella.md`. Licence remediation is
+# manual, file-by-file, owner-only. Triggered by neurophone#99 (auto-PR
+# reverting PMPL → MPL-2.0 across ~140 files, closed by owner).
+#
 # Category: LicenseCompliance
 # Usage: fix-license-file.sh <repo-path> <finding-json>
 #
@@ -11,6 +17,11 @@
 
 set -euo pipefail
 
+echo "REFUSED: fix-license-file.sh is disabled per estate policy 2026-06-02." >&2
+echo "        Licence/SPDX edits MUST be manual, per-file, owner-approved." >&2
+echo "        See feedback_no_automated_licence_edits.md." >&2
+exit 1
+
 REPO_PATH="${1:?Usage: fix-license-file.sh <repo-path> <finding-json>}"
 FINDING_JSON="${2:?Usage: fix-license-file.sh <repo-path> <finding-json>}"
 

scripts/fix-license-hygiene.sh

@@ -2,6 +2,12 @@
 # SPDX-License-Identifier: MPL-2.0
 # fix-license-hygiene.sh — Ensure REUSE-compliant dual-license setup
 #
+# DISABLED 2026-06-02 per owner directive on licence policy.
+# See `feedback_no_automated_licence_edits.md` and
+# `feedback_estate_license_policy_umbrella.md`. Licence remediation is
+# manual, file-by-file, owner-only. Triggered by neurophone#99 (auto-PR
+# reverting PMPL → MPL-2.0 across ~140 files, closed by owner).
+#
 # Applies: LICENSE (MPL-2.0), LICENSES/ dir, NOTICE file
 # Idempotent: only modifies what's missing or incorrect.
 #
@@ -10,6 +16,11 @@
 #   /var$REPOS_DIR/palimpsest-license/legal/PALIMPSEST-MPL-1.0.txt
 set -euo pipefail
 
+echo "REFUSED: fix-license-hygiene.sh is disabled per estate policy 2026-06-02." >&2
+echo "        Licence/SPDX edits MUST be manual, per-file, owner-approved." >&2
+echo "        See feedback_no_automated_licence_edits.md." >&2
+exit 1
+
 FINDING_FILE="${1:?Usage: fix-license-hygiene.sh <finding.json>}"
 
 if [[ ! -f "$FINDING_FILE" ]]; then

scripts/fix-missing-spdx.sh

@@ -1,9 +1,22 @@
 #!/bin/bash
 # SPDX-License-Identifier: MPL-2.0
 # Add SPDX license identifier to files missing it
+#
+# DISABLED 2026-06-02 per owner directive on licence policy.
+# See `feedback_no_automated_licence_edits.md` and
+# `feedback_estate_license_policy_umbrella.md`. Licence remediation is
+# manual, file-by-file, owner-only. Triggered by neurophone#99 (auto-PR
+# reverting PMPL → MPL-2.0 across ~140 files, closed by owner).
 
 set -euo pipefail
 
+echo "REFUSED: fix-missing-spdx.sh is disabled per estate policy 2026-06-02." >&2
+echo "        Licence/SPDX edits MUST be manual, per-file, owner-approved." >&2
+echo "        SPDX choice depends on the five-way owner classification" >&2
+echo "        (sole-repo / 007 / son-shared / fork / palimpsest carve-out)." >&2
+echo "        See feedback_estate_license_policy_umbrella.md." >&2
+exit 1
+
 REPO_PATH="$1"
 FINDING_FILE="$2"