licence(#7): normalise PMPL-1.0 -> PMPL-1.0-or-later (owner carve-out, SPDX-only) (#169)

hyperpolymath · claude · web-flow · commit 98b820110314 · 2026-05-19T21:14:36.000+01:00
Not a relicence; owner-sanctioned standards LICENCE-POLICY A8(1);
Refs LICENCE-DEBT-LEDGER-2026-05-18.

Co-authored-by: Claude Opus 4.7 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: CodeQL Security Analysis
 
 on:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: OSSF Scorecard
 on:
   push:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Prevention workflow - scans for hardcoded secrets before they reach main
 name: Secret Scanner
 
diff --git a/bots/echidnabot/CITATION.cff b/bots/echidnabot/CITATION.cff
@@ -1,6 +1,6 @@
 # CITATION.cff - Citation File Format for echidnabot
 # https://citation-file-format.github.io/
-# SPDX-License-Identifier: PMPL-1.0 OR LicenseRef-Palimpsest-0.5
+# SPDX-License-Identifier: PMPL-1.0-or-later OR LicenseRef-Palimpsest-0.5
 
 cff-version: 1.2.0
 title: "echidnabot"
diff --git a/bots/echidnabot/Containerfile b/bots/echidnabot/Containerfile
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Build stage
 FROM docker.io/library/rust:1.83-slim AS builder
 
diff --git a/bots/echidnabot/Mustfile b/bots/echidnabot/Mustfile
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Mustfile - hyperpolymath mandatory checks
 # See: https://github.com/hyperpolymath/mustfile
 
diff --git a/bots/echidnabot/contracts/Token.sol b/bots/echidnabot/contracts/Token.sol
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 // Copyright (C) 2024 Jonathan D.A. Jewell / Hyperpolymath
 
 pragma solidity ^0.8.19;
diff --git a/bots/echidnabot/contracts/TokenEchidnaTest.sol b/bots/echidnabot/contracts/TokenEchidnaTest.sol
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 // Copyright (C) 2024 Jonathan D.A. Jewell / Hyperpolymath
 
 pragma solidity ^0.8.19;
diff --git a/bots/echidnabot/flake.nix b/bots/echidnabot/flake.nix
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # SPDX-FileCopyrightText: 2025 hyperpolymath
 {
   description = "ECHIDNABOT - Proof-aware CI bot for theorem verification";
diff --git a/bots/echidnabot/hooks/pre-commit-tsjs-blocker.sh b/bots/echidnabot/hooks/pre-commit-tsjs-blocker.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Pre-commit hook: block TypeScript/JavaScript and Node configs
 set -euo pipefail
 
diff --git a/bots/echidnabot/hooks/validate-codeql.sh b/bots/echidnabot/hooks/validate-codeql.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Pre-commit hook: Validate CodeQL language matrix matches repo
 set -euo pipefail
 
diff --git a/bots/echidnabot/hooks/validate-permissions.sh b/bots/echidnabot/hooks/validate-permissions.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Pre-commit hook: Validate workflow permissions declarations
 set -euo pipefail
 ERRORS=0
diff --git a/bots/echidnabot/hooks/validate-sha-pins.sh b/bots/echidnabot/hooks/validate-sha-pins.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Pre-commit hook: Validate GitHub Actions are SHA-pinned
 
 set -euo pipefail
diff --git a/bots/echidnabot/hooks/validate-spdx.sh b/bots/echidnabot/hooks/validate-spdx.sh
@@ -1,19 +1,19 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Pre-commit hook: Validate SPDX headers in workflow files
 
 set -euo pipefail
 
 ERRORS=0
-SPDX_PATTERN="^# SPDX-License-Identifier:PMPL-1.0
+SPDX_PATTERN="^# SPDX-License-Identifier:PMPL-1.0-or-later
 
 for workflow in .github/workflows/*.yml .github/workflows/*.yaml; do
     [ -f "$workflow" ] || continue
     
     first_line=$(head -n1 "$workflow")
     if ! echo "$first_line" | grep -qE "$SPDX_PATTERN"; then
         echo "ERROR: Missing SPDX header in $workflow"
-        echo "  First line should be: # SPDX-License-Identifier: PMPL-1.0
+        echo "  First line should be: # SPDX-License-Identifier: PMPL-1.0-or-later
         ERRORS=$((ERRORS + 1))
     fi
 done
diff --git a/bots/echidnabot/packaging/aur/PKGBUILD b/bots/echidnabot/packaging/aur/PKGBUILD
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Maintainer: hyperpolymath <packages@hyperpolymath.dev>
 
 pkgname=echidnabot-bin
diff --git a/bots/echidnabot/packaging/chocolatey/echidnabot.nuspec b/bots/echidnabot/packaging/chocolatey/echidnabot.nuspec
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- SPDX-License-Identifier: PMPL-1.0 -->
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>echidnabot</id>
diff --git a/bots/echidnabot/packaging/debian/rules b/bots/echidnabot/packaging/debian/rules
@@ -1,5 +1,5 @@
 #!/usr/bin/make -f
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 
 %:
 	dh $@
diff --git a/bots/echidnabot/packaging/macports/Portfile b/bots/echidnabot/packaging/macports/Portfile
@@ -1,5 +1,5 @@
 # -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 
 PortSystem          1.0
 PortGroup           cargo 1.0
diff --git a/bots/echidnabot/scripts/echidna-gen.js b/bots/echidnabot/scripts/echidna-gen.js
@@ -1,11 +1,11 @@
 #!/usr/bin/env -S deno run --allow-read --allow-write
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 // Echidna Test Property Generator
 // Generates Echidna test contracts from Solidity source files
 //
 // Usage: deno run --allow-read --allow-write scripts/echidna-gen.js <contract.sol>
 
-const SPDX_HEADER = `// SPDX-License-Identifier: PMPL-1.0
+const SPDX_HEADER = `// SPDX-License-Identifier: PMPL-1.0-or-later
 // Generated by echidnabot - Echidna Test Generator
 // https://github.com/hyperpolymath/echidnabot
 `;
diff --git a/bots/echidnabot/src/adapters/bitbucket.rs b/bots/echidnabot/src/adapters/bitbucket.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Bitbucket platform adapter (minimal clone support)
 
 use async_trait::async_trait;
diff --git a/bots/echidnabot/src/adapters/gitlab.rs b/bots/echidnabot/src/adapters/gitlab.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! GitLab platform adapter (minimal clone support)
 
 use async_trait::async_trait;
diff --git a/bots/echidnabot/src/adapters/mod.rs b/bots/echidnabot/src/adapters/mod.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Platform adapters for GitHub, GitLab, Bitbucket
 
 use serde::{Deserialize, Serialize};
diff --git a/bots/rhodibot/fuzz/Cargo.toml b/bots/rhodibot/fuzz/Cargo.toml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 [package]
 name = "rhodibot-fuzz"
 version = "0.0.0"
diff --git a/bots/rhodibot/fuzz/fuzz_targets/fuzz_input.rs b/bots/rhodibot/fuzz/fuzz_targets/fuzz_input.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Generic fuzz target for arbitrary input processing
 
 #![no_main]
diff --git a/bots/seambot/fuzz/fuzz_targets/fuzz_input.rs b/bots/seambot/fuzz/fuzz_targets/fuzz_input.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Generic fuzz target for arbitrary input processing
 
 #![no_main]
diff --git a/robot-repo-automaton/.github/workflows/codeql.yml b/robot-repo-automaton/.github/workflows/codeql.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: CodeQL Security Analysis
 on:
   push:
diff --git a/robot-repo-automaton/.github/workflows/instant-sync.yml b/robot-repo-automaton/.github/workflows/instant-sync.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 
diff --git a/robot-repo-automaton/.github/workflows/mirror.yml b/robot-repo-automaton/.github/workflows/mirror.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Mirror to GitLab and Bitbucket
 
 on:
diff --git a/robot-repo-automaton/.github/workflows/scorecard.yml b/robot-repo-automaton/.github/workflows/scorecard.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: OSSF Scorecard
 on:
   push:
diff --git a/shared-context/src/context.rs b/shared-context/src/context.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Shared context for coordinating bot executions
 
 use crate::bot::{BotExecution, BotId, BotStatus, Tier};
diff --git a/shared-context/src/finding.rs b/shared-context/src/finding.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Finding representation for cross-bot communication
 
 use crate::bot::BotId;
diff --git a/shared-context/src/lib.rs b/shared-context/src/lib.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Gitbot Fleet Shared Context Layer
 //!
 //! This crate provides the coordination infrastructure for the gitbot-fleet,
diff --git a/shared-context/src/state.rs b/shared-context/src/state.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! State management for session and repository tracking
 
 use crate::bot::BotId;
diff --git a/shared-context/src/storage.rs b/shared-context/src/storage.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Context storage backends
 
 use crate::context::Context;
diff --git a/shared-context/src/triangle.rs b/shared-context/src/triangle.rs
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 //! Safety Triangle types for the gitbot-fleet remediation pipeline.
 //!
 //! The Safety Triangle prioritizes remediation actions:

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-# SPDX-License-Identifier: PMPL-1.0`
	`1`	`+# SPDX-License-Identifier: PMPL-1.0-or-later`
`2`	`2`	`name: CodeQL Security Analysis`
`3`	`3`
`4`	`4`	`on:`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-// SPDX-License-Identifier: PMPL-1.0`
	`1`	`+// SPDX-License-Identifier: PMPL-1.0-or-later`
`2`	`2`	`// Copyright (C) 2024 Jonathan D.A. Jewell / Hyperpolymath`
`3`	`3`
`4`	`4`	`pragma solidity ^0.8.19;`