rules(license): cap licence findings at :review strategy (neurophone#99 closeout)

[hyperpolymath]

Summary

• Policy header in lib/rules/cicd_rules.ex License Validation section: quotes the verbatim owner directive 2026-06-02 + 5-way classification.
• Cap helpers: license_finding_strategy/0 (always :review), license_finding_severity_cap/1 (always :warn), license_related_finding?/1 (matches the same regex as the gitbot-fleet dispatcher gate), owner_license_classification/0 (canonical 5-way map).
• Scorecard ingestor SC-010 License → auto_fixable: false with remediation text spelling out the 5-way classification.

Why

Owner directive 2026-06-02 forbids automated licence/SPDX edits. Triggered by neurophone#99 — an auto-generated PR by the Claude bot reverting PMPL-1.0-or-later → MPL-2.0 across ~140 files, closed by the owner. The fix gates the dispatcher; this PR ensures hypatia (the rule source) never emits an auto-execute licence finding in the first place.

Five-way classification (verbatim):

"mpl-2.0 is for my sole repos, all rights reserved is for 007, agpl-3.0-or-later is for those shared with my son, and leave other people's forked stuff alone … only palimpsest license for obvious reasons should be talking about palipsest and palimpsest plasma, and consent-aware-http, but in that case prospectively"

Test plan

• Hypatia.Rules.CicdRules.license_finding_strategy() == :review
• Hypatia.Rules.CicdRules.license_finding_severity_cap(:critical) == :warn
• Hypatia.Rules.CicdRules.license_related_finding?("LicenseCompliance") == true
• Hypatia.Rules.CicdRules.license_related_finding?("MissingSPDX") == true
• Hypatia.ScorecardIngestor SC-010 auto_fixable is false.
• mix test passes.

Related: hyperpolymath/gitbot-fleet chore/halt-license-auto-prs, hyperpolymath/standards docs/license-no-auto-policy.

[github-actions]

🔍 Hypatia Security Scan

Findings: 146 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	146

View findings

[
  {
    "reason": "Action urin 21 JRE\n        uses: actions/setup-java@be666c2fcd27 needs attention",
    "type": "unpinned_action",
    "file": "verify-proofs.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in clusterfuzzlite.yml",
    "type": "missing_timeout_minutes",
    "file": "clusterfuzzlite.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence