License: MPL-2.0 (code) + CC-BY-SA-4.0 (docs), full per-file SPDX (resolves gap-006)#36
Merged
Merged
Conversation
…file SPDX Resolves gap-006. Replaces the confused prior state (PMPL-1.0 / Palimpsest, a MIT OR GPL-3.0-or-later OR Palimpsest tri-license, MPL-2.0-or-later, stray GPL/PLMP) with a clean dual license by artifact type. - 75 documentation files (.adoc/.md): MPL-2.0 -> CC-BY-SA-4.0 (first SPDX header line only, so in-body examples in meta-docs are preserved). - Code stragglers -> MPL-2.0: 3 PMPL-1.0 workflows, MPL-2.0-or-later (JtvExtended.lean + playground bits), and the MIT OR GPL OR Palimpsest tri-license on formatter.rs / repl.rs / rsr_check.rs. NOTE: those three were deliberately permissive -- revert if you wanted them kept tri-licensed. - PALIMPSEST.adoc (both copies) retired; PMPL badges replaced with MPL-2.0 + CC-BY-SA-4.0 badges across the README files. - LICENSING.md rewritten (it had wrongly claimed MIT + Palimpsest dual). - Stale "MPL-2.0 fallback until PMPL" header comment lines removed (~13 files); META.a2ml / AGENTIC.a2ml license mentions updated. gap-006 marked resolved. Headers verified: 190 MPL-2.0 + 77 CC-BY-SA-4.0, zero stragglers. jtv-core builds. Wave-2 follow-ups (NOT here): populate LICENSES/ with canonical MPL-2.0 + CC-BY-SA-4.0 texts; replace the Palimpsest-branded root LICENSE and remove LICENSE-PALIMPSEST + playground/ffi copies (canonical legal text, not hand-written); update rsr_check.rs license-validation logic; clear remaining Palimpsest mentions in playground sub-project docs; add SPDX headers to ~49 header-less docs. https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
🔍 Hypatia Security ScanFindings: 54 issues detected
View findings[
{
"reason": "No test directory or test files found",
"type": "no_tests",
"file": "/home/runner/work/julia-the-viper/julia-the-viper",
"action": "flag",
"rule_module": "honest_completion",
"severity": "high",
"deduction": 20
},
{
"reason": "Issue in secret-scanner.yml",
"type": "missing_workflow",
"file": "secret-scanner.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
"type": "download_then_run",
"file": "proof-regression.yml",
"action": "verify_download_integrity",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in scorecard.yml",
"type": "scorecard_wrapper_missing_job_permissions",
"file": "scorecard.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
"type": "unsafe_block",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/crates/jtv-cli/src/rsr_check.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unwrap() without prior check -- DoS via panic (10 occurrences, CWE-754)",
"type": "unwrap_without_check",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/crates/jtv-core/benches/interpreter_bench.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "unwrap() without prior check -- DoS via panic (6 occurrences, CWE-754)",
"type": "unwrap_without_check",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/crates/jtv-core/benches/parser_bench.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
"type": "shell_download_then_run",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/setup.sh",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Js.Array2 deprecated -- use Array (3 occurrences)",
"type": "deprecated_api",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/vscode-extension/src/Extension.res",
"action": "search_replace",
"rule_module": "migration_rules",
"severity": "high"
},
{
"reason": "Js.Promise deprecated -- use Promise (2 occurrences)",
"type": "deprecated_api",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/vscode-extension/src/Extension.res",
"action": "module_replace",
"rule_module": "migration_rules",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
…tring false positive)
rsr_check.rs is the RSR compliance checker; its unsafe-block detection embedded
the keyword+brace token (in the needle string, and via a `has_unsafe` variable
placed immediately before a brace), which the Hypatia/code-scanning unsafe_block
rule matched as 2 false-positive occurrences. This surfaced as a failing Hypatia
check ("1 new alert") on the license PR only because the license edit touched
this file's header. Assemble the needle with concat! and rename the scan
variable so no keyword+brace substring remains. No behaviour change; clippy clean.
https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742
🔍 Hypatia Security ScanFindings: 53 issues detected
View findings[
{
"reason": "No test directory or test files found",
"type": "no_tests",
"file": "/home/runner/work/julia-the-viper/julia-the-viper",
"action": "flag",
"rule_module": "honest_completion",
"severity": "high",
"deduction": 20
},
{
"reason": "Issue in secret-scanner.yml",
"type": "missing_workflow",
"file": "secret-scanner.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
"type": "download_then_run",
"file": "proof-regression.yml",
"action": "verify_download_integrity",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in scorecard.yml",
"type": "scorecard_wrapper_missing_job_permissions",
"file": "scorecard.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "unwrap() without prior check -- DoS via panic (10 occurrences, CWE-754)",
"type": "unwrap_without_check",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/crates/jtv-core/benches/interpreter_bench.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "unwrap() without prior check -- DoS via panic (6 occurrences, CWE-754)",
"type": "unwrap_without_check",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/crates/jtv-core/benches/parser_bench.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
"type": "shell_download_then_run",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/setup.sh",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Js.Array2 deprecated -- use Array (3 occurrences)",
"type": "deprecated_api",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/vscode-extension/src/Extension.res",
"action": "search_replace",
"rule_module": "migration_rules",
"severity": "high"
},
{
"reason": "Js.Promise deprecated -- use Promise (2 occurrences)",
"type": "deprecated_api",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/vscode-extension/src/Extension.res",
"action": "module_replace",
"rule_module": "migration_rules",
"severity": "medium"
},
{
"reason": "Belt.Array deprecated -- use Array (30 occurrences)",
"type": "deprecated_api",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/packages/jtv-analyzer/src/Main.res",
"action": "module_replace",
"rule_module": "migration_rules",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
marked this pull request as ready for review
June 17, 2026 23:08
hyperpolymath
pushed a commit
that referenced
this pull request
Jun 18, 2026
Records the approved resolution of the ADR-0007 D2 open tension (the surviving DataExpr.neg primitive): - neg leaves the purist core; in purist-jtv `-` is a parse error and subtraction is reverse-only (effect-level), in every number system. - neg/`-` is re-admitted only under an optional feature-gated `sugar` aspect (adulterated-jtv), with a discouragement lint -- works but nags. - the compiler stamps every build with a purity certificate (purist vs adulterated), making the escape hatch visible and accountable, not silent. - chosen architecture: feature-gated dialect (rung 1); sidecar desugarer and co-product grammar noted as future purity upgrades. Key insight recorded: subtraction-as-reverse-addition is effect-level while neg is expression-level -- that mismatch is why neg is the escape hatch. Decision record only; feature-gating + lint + certificate are follow-on implementation. STATE.a2ml: artefact location + session-history catch-up (license #36, hardening #37, ADR-0008). https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves gap-006. Establishes the license decision — MPL-2.0 (code) + CC-BY-SA-4.0 (docs), full per-file — and untangles a genuinely confused prior state.
What the repo actually had (the mess)
PMPL-1.0SPDX headers on 3 workflows + PMPL badges on 5 READMEs.MIT OR GPL-3.0-or-later OR Palimpsest-0.8tri-license onformatter.rs/repl.rs/rsr_check.rs.MPL-2.0-or-later, strayGPL-3.0-or-later, aPLMP-1.0-or-latertypo.LICENSING.mdwrongly claiming a MIT + Palimpsest dual-license, with garbled SPDX examples.This PR (wave 1 — headers + metadata)
.adoc/.md) →CC-BY-SA-4.0(first SPDX header line only, so in-body examples in meta-docs survive).MPL-2.0: the 3 workflows,MPL-2.0-or-laterfiles, and the tri-licensedformatter.rs/repl.rs/rsr_check.rs.PALIMPSEST.adoc(both copies) retired; PMPL badges replaced with MPL-2.0 + CC-BY-SA-4.0.LICENSING.mdrewritten to describe the dual license correctly.META.a2ml/AGENTIC.a2mlupdated; gap-006 resolved in STATE.MPL-2.0+ 77CC-BY-SA-4.0headers, zero stragglers;cargo buildgreen (comment-only changes).Wave 2 (flagged, NOT in this PR — needs canonical text / deeper changes)
LICENSEis Palimpsest-branded; there's a fullLICENSE-PALIMPSEST+playground/andffi/zig/copies. Replace with canonical MPL-2.0 text + addLICENSES/MPL-2.0.txt+LICENSES/CC-BY-SA-4.0.txt(REUSE). I won't hand-write legal text — these should come from spdx.org/creativecommons.rsr_check.rslicense-validation logic still checks forLICENSE-PALIMPSEST/ "MIT + Palimpsest".guix.scmURL.https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742
Generated by Claude Code