diff --git a/.gitattributes b/.gitattributes
index bb56184..e860a85 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # RSR-compliant .gitattributes
 
 * text=auto eol=lf
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
index fd9bb96..688a442 100644
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index ddeab5d..712beb3 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: BoJ Server Build Trigger
 on:
   push:
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index ba70625..71c6334 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
 
 on:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index be5c67f..ca86baa 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
 # Dependabot pull requests that match a declared severity / ecosystem
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 3535c7e..582f3ee 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
index 4125b33..65751cd 100644
--- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml
+++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
 # separate terms of service, privacy policy, and support
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index f5a4ce3..698d7e2 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #
diff --git a/.github/workflows/haskell.yml b/.github/workflows/haskell.yml
index fabb135..639f26d 100644
--- a/.github/workflows/haskell.yml
+++ b/.github/workflows/haskell.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Haskell CI
 
 on:
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index e900c7e..228dc43 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index a91c5ec..2083ca6 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Mirror to Git Forges
 
 on:
diff --git a/.github/workflows/php-security.yml b/.github/workflows/php-security.yml
index 813cb54..cd274fc 100644
--- a/.github/workflows/php-security.yml
+++ b/.github/workflows/php-security.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: PHP Security Check
 
 on: [push, pull_request]
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
index af0bef8..295e009 100644
--- a/.github/workflows/scorecard-enforcer.yml
+++ b/.github/workflows/scorecard-enforcer.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores
 name: OpenSSF Scorecard Enforcer
 
diff --git a/.gitignore b/.gitignore
index ca5fcaf..79fa485 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # RSR-compliant .gitignore
 
 # OS & Editor
diff --git a/.machine_readable/6a2/AGENTIC.a2ml b/.machine_readable/6a2/AGENTIC.a2ml
index 09aa2c2..4a98976 100644
--- a/.machine_readable/6a2/AGENTIC.a2ml
+++ b/.machine_readable/6a2/AGENTIC.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # AGENTIC.a2ml — AI agent constraints and capabilities
diff --git a/.machine_readable/6a2/ECOSYSTEM.a2ml b/.machine_readable/6a2/ECOSYSTEM.a2ml
index 13acf48..cecc60a 100644
--- a/.machine_readable/6a2/ECOSYSTEM.a2ml
+++ b/.machine_readable/6a2/ECOSYSTEM.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # ECOSYSTEM.a2ml — Ecosystem position
 # Converted from ECOSYSTEM.scm on 2026-03-15
 
diff --git a/.machine_readable/6a2/META.a2ml b/.machine_readable/6a2/META.a2ml
index a099388..ac68313 100644
--- a/.machine_readable/6a2/META.a2ml
+++ b/.machine_readable/6a2/META.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # META.a2ml — Project meta-information
 # Converted from META.scm on 2026-03-15
 
diff --git a/.machine_readable/6a2/NEUROSYM.a2ml b/.machine_readable/6a2/NEUROSYM.a2ml
index ce0c930..767d7dd 100644
--- a/.machine_readable/6a2/NEUROSYM.a2ml
+++ b/.machine_readable/6a2/NEUROSYM.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # NEUROSYM.a2ml — Neurosymbolic integration metadata
diff --git a/.machine_readable/6a2/PLAYBOOK.a2ml b/.machine_readable/6a2/PLAYBOOK.a2ml
index 02c3acb..a961250 100644
--- a/.machine_readable/6a2/PLAYBOOK.a2ml
+++ b/.machine_readable/6a2/PLAYBOOK.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # PLAYBOOK.a2ml — Operational playbook
diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/6a2/STATE.a2ml
index 2d62eb9..d0ab3fe 100644
--- a/.machine_readable/6a2/STATE.a2ml
+++ b/.machine_readable/6a2/STATE.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # STATE.a2ml — Project state checkpoint
 # Converted from STATE.scm on 2026-03-15
 
diff --git a/.machine_readable/ADJUST.contractile b/.machine_readable/ADJUST.contractile
index cc5deaa..5238f88 100644
--- a/.machine_readable/ADJUST.contractile
+++ b/.machine_readable/ADJUST.contractile
@@ -1,4 +1,4 @@
-; SPDX-License-Identifier: PMPL-1.0-or-later
+; SPDX-License-Identifier: MPL-2.0
 ; ADJUST.contractile — Accessibility invariants for sanctify-php
 ; "ADJUST" = Accessibility & Digital Justice for Universal Software & Technology
 ;
diff --git a/.machine_readable/CLADE.a2ml b/.machine_readable/CLADE.a2ml
index 6580961..cb6780b 100644
--- a/.machine_readable/CLADE.a2ml
+++ b/.machine_readable/CLADE.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Clade declaration — part of the gv-clade-index registry
 # See: https://github.com/hyperpolymath/gv-clade-index
 
diff --git a/.machine_readable/INTENT.contractile b/.machine_readable/INTENT.contractile
index 50b8919..d76397a 100644
--- a/.machine_readable/INTENT.contractile
+++ b/.machine_readable/INTENT.contractile
@@ -1,4 +1,4 @@
-; SPDX-License-Identifier: PMPL-1.0-or-later
+; SPDX-License-Identifier: MPL-2.0
 ; INTENT.contractile — Purpose and scope for sanctify-php
 ; Helps LLM/SLM agents understand what this repo IS and IS NOT.
 ;
diff --git a/.machine_readable/MUST.contractile b/.machine_readable/MUST.contractile
index 70c6abb..f0979c8 100644
--- a/.machine_readable/MUST.contractile
+++ b/.machine_readable/MUST.contractile
@@ -1,4 +1,4 @@
-; SPDX-License-Identifier: PMPL-1.0-or-later
+; SPDX-License-Identifier: MPL-2.0
 ; MUST.contractile — Baseline invariants for sanctify-php
 ; These constraints MUST NOT be violated. K9 validators enforce them.
 ;
diff --git a/.machine_readable/TRUST.contractile b/.machine_readable/TRUST.contractile
index 84f12ea..23bf6bd 100644
--- a/.machine_readable/TRUST.contractile
+++ b/.machine_readable/TRUST.contractile
@@ -1,4 +1,4 @@
-; SPDX-License-Identifier: PMPL-1.0-or-later
+; SPDX-License-Identifier: MPL-2.0
 ; TRUST.contractile — Trust boundaries for sanctify-php
 ; Defines what LLM/SLM agents are trusted to do without asking.
 ;
diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/agent_instructions/README.adoc
index 0ed360b..9bc2e24 100644
--- a/.machine_readable/agent_instructions/README.adoc
+++ b/.machine_readable/agent_instructions/README.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 = Agent Instructions
 :toc: preamble
diff --git a/.machine_readable/agent_instructions/coverage.a2ml b/.machine_readable/agent_instructions/coverage.a2ml
index 3d720dc..6979664 100644
--- a/.machine_readable/agent_instructions/coverage.a2ml
+++ b/.machine_readable/agent_instructions/coverage.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # coverage.a2ml — Session coverage tracking
diff --git a/.machine_readable/agent_instructions/debt.a2ml b/.machine_readable/agent_instructions/debt.a2ml
index f46451a..c0238c5 100644
--- a/.machine_readable/agent_instructions/debt.a2ml
+++ b/.machine_readable/agent_instructions/debt.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # debt.a2ml — Meander debt list
diff --git a/.machine_readable/agent_instructions/methodology.a2ml b/.machine_readable/agent_instructions/methodology.a2ml
index 9bf1439..754f357 100644
--- a/.machine_readable/agent_instructions/methodology.a2ml
+++ b/.machine_readable/agent_instructions/methodology.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # methodology.a2ml — AI agent methodology configuration
diff --git a/.machine_readable/contractiles/bust/Bustfile.a2ml b/.machine_readable/contractiles/bust/Bustfile.a2ml
index d8bf036..ad76c22 100644
--- a/.machine_readable/contractiles/bust/Bustfile.a2ml
+++ b/.machine_readable/contractiles/bust/Bustfile.a2ml
@@ -1,5 +1,5 @@
 // Bustfile.a2ml — meta-repo bust contractile (breakage / rollback)
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 
 Bust {
     name: "sanctify-php"
diff --git a/.machine_readable/contractiles/bust/bust.ncl b/.machine_readable/contractiles/bust/bust.ncl
index 3d9ab8b..fc8cb8c 100644
--- a/.machine_readable/contractiles/bust/bust.ncl
+++ b/.machine_readable/contractiles/bust/bust.ncl
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Bust — error-handling / failure-recovery runner
 #
 # Pairs with: Bustfile.a2ml (same directory)
diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml
index d7dfc19..0d619ee 100644
--- a/.machine_readable/contractiles/dust/Dustfile.a2ml
+++ b/.machine_readable/contractiles/dust/Dustfile.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Dustfile — Cleanup and Hygiene Contract
 
 [dustfile]
diff --git a/.machine_readable/contractiles/trust/Trustfile.a2ml b/.machine_readable/contractiles/trust/Trustfile.a2ml
index 0b27189..f2a4f95 100644
--- a/.machine_readable/contractiles/trust/Trustfile.a2ml
+++ b/.machine_readable/contractiles/trust/Trustfile.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Trustfile — Integrity and provenance verification
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 
diff --git a/.machine_readable/integrations/feedback-o-tron.a2ml b/.machine_readable/integrations/feedback-o-tron.a2ml
index 1c473ae..5381604 100644
--- a/.machine_readable/integrations/feedback-o-tron.a2ml
+++ b/.machine_readable/integrations/feedback-o-tron.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Feedback-o-Tron Integration — Autonomous Bug Reporting
 
 [integration]
diff --git a/.machine_readable/integrations/proven.a2ml b/.machine_readable/integrations/proven.a2ml
index 6b3e805..9af33ff 100644
--- a/.machine_readable/integrations/proven.a2ml
+++ b/.machine_readable/integrations/proven.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Proven Integration — Formally Verified Safety Library
 
 [integration]
diff --git a/.machine_readable/integrations/verisimdb.a2ml b/.machine_readable/integrations/verisimdb.a2ml
index 2c8f8f5..164c522 100644
--- a/.machine_readable/integrations/verisimdb.a2ml
+++ b/.machine_readable/integrations/verisimdb.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # VeriSimDB Feed — Cross-Repo Analytics Data Store
 
 [integration]
diff --git a/.machine_readable/integrations/vexometer.a2ml b/.machine_readable/integrations/vexometer.a2ml
index bb7fc43..238b3d2 100644
--- a/.machine_readable/integrations/vexometer.a2ml
+++ b/.machine_readable/integrations/vexometer.a2ml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Vexometer Integration — Irritation Surface Analysis
 
 [integration]
diff --git a/.machine_readable/svc/k9/README.adoc b/.machine_readable/svc/k9/README.adoc
index 137c184..9c3099f 100644
--- a/.machine_readable/svc/k9/README.adoc
+++ b/.machine_readable/svc/k9/README.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 = K9 Contractiles
 :toc: left
 :icons: font
diff --git a/.machine_readable/svc/k9/examples/ci-config.k9.ncl b/.machine_readable/svc/k9/examples/ci-config.k9.ncl
index 11fe019..9fe314e 100644
--- a/.machine_readable/svc/k9/examples/ci-config.k9.ncl
+++ b/.machine_readable/svc/k9/examples/ci-config.k9.ncl
@@ -1,5 +1,5 @@
 K9!
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Example Yard-level K9 component: CI/CD configuration with validation
 # Security Level: Yard (Nickel evaluation, contract validation)
 # Signature recommended but not required
diff --git a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl b/.machine_readable/svc/k9/examples/project-metadata.k9.ncl
index 64d5f66..14e0627 100644
--- a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl
+++ b/.machine_readable/svc/k9/examples/project-metadata.k9.ncl
@@ -1,5 +1,5 @@
 K9!
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Example Kennel-level K9 component: Project metadata
 # Security Level: Kennel (pure data, no execution)
 # No signature required
diff --git a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl b/.machine_readable/svc/k9/examples/setup-repo.k9.ncl
index 66b046b..b635d5b 100644
--- a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl
+++ b/.machine_readable/svc/k9/examples/setup-repo.k9.ncl
@@ -1,5 +1,5 @@
 K9!
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Example Hunt-level K9 component: Repository setup automation
 # Security Level: Hunt (full execution with Just recipes)
 # ⚠️ SIGNATURE REQUIRED - DO NOT RUN WITHOUT VERIFICATION
diff --git a/.machine_readable/svc/k9/template-hunt.k9.ncl b/.machine_readable/svc/k9/template-hunt.k9.ncl
index 0814c8d..b3fcb47 100644
--- a/.machine_readable/svc/k9/template-hunt.k9.ncl
+++ b/.machine_readable/svc/k9/template-hunt.k9.ncl
@@ -1,5 +1,5 @@
 K9!
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # K9 Hunt-level template: Full execution with Just recipes
 # Security Level: Hunt (full system access)
 # ⚠️ SIGNATURE REQUIRED - Review carefully before use
diff --git a/.machine_readable/svc/k9/template-kennel.k9.ncl b/.machine_readable/svc/k9/template-kennel.k9.ncl
index c78e27d..4228b26 100644
--- a/.machine_readable/svc/k9/template-kennel.k9.ncl
+++ b/.machine_readable/svc/k9/template-kennel.k9.ncl
@@ -1,5 +1,5 @@
 K9!
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # K9 Kennel-level template: Pure data configuration
 # Security Level: Kennel (data-only, no execution)
 # No signature required - safe for any use
diff --git a/.machine_readable/svc/k9/template-yard.k9.ncl b/.machine_readable/svc/k9/template-yard.k9.ncl
index 75e5d89..a723f5a 100644
--- a/.machine_readable/svc/k9/template-yard.k9.ncl
+++ b/.machine_readable/svc/k9/template-yard.k9.ncl
@@ -1,5 +1,5 @@
 K9!
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # K9 Yard-level template: Configuration with validation
 # Security Level: Yard (Nickel evaluation with contracts)
 # Signature recommended but not required
diff --git a/.well-known/ai.txt b/.well-known/ai.txt
index 6668d66..cc7cbc3 100644
--- a/.well-known/ai.txt
+++ b/.well-known/ai.txt
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # ai.txt - AI interaction policy
 # See: https://site.spawning.ai/spawning-ai-txt
 
diff --git a/.well-known/humans.txt b/.well-known/humans.txt
index a558f15..5423d9e 100644
--- a/.well-known/humans.txt
+++ b/.well-known/humans.txt
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # humanstxt.org
 
 /* TEAM */
diff --git a/.well-known/security.txt b/.well-known/security.txt
index 850820a..23cf9b9 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # RFC 9116 - security.txt
 # https://securitytxt.org/
 
diff --git a/CITATION.cff b/CITATION.cff
index 185f7f9..ac22aa3 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 cff-version: 1.2.0
 title: sanctify-php
 message: "If you use this software, please cite it as below."
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index c32021a..1f1548c 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Contributor Covenant Code of Conduct
 
 ## Our Pledge
diff --git a/DUBLINCORE.rdf b/DUBLINCORE.rdf
index 1074e5f..9d353ff 100644
--- a/DUBLINCORE.rdf
+++ b/DUBLINCORE.rdf
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
          xmlns:dc="http://purl.org/dc/elements/1.1/"
          xmlns:dcterms="http://purl.org/dc/terms/">
diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc
index 695c4b4..d3078f8 100644
--- a/EXPLAINME.adoc
+++ b/EXPLAINME.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Sanctify-PHP — Show Me The Receipts
 :toc:
diff --git a/Justfile b/Justfile
index 7269ef7..1e7df3b 100644
--- a/Justfile
+++ b/Justfile
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Justfile - hyperpolymath standard task runner
 
 set shell := ["bash", "-uc"]
diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc
index ac120fa..a1c6544 100644
--- a/MAINTAINERS.adoc
+++ b/MAINTAINERS.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 = Maintainers
 :toc: preamble
 
diff --git a/Mustfile b/Mustfile
index bd54bd5..2516d22 100644
--- a/Mustfile
+++ b/Mustfile
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Mustfile - hyperpolymath mandatory checks
 # See: https://github.com/hyperpolymath/mustfile
 
diff --git a/PALIMPSEST.adoc b/PALIMPSEST.adoc
index e40e76c..84c8482 100644
--- a/PALIMPSEST.adoc
+++ b/PALIMPSEST.adoc
@@ -26,7 +26,7 @@ ethical-use, provenance, and lineage requirements.
 
 1. Include the PMPL-1.0 license text in `LICENSE`.
 2. Add SPDX headers to source files:
-   `SPDX-License-Identifier: PMPL-1.0-or-later`
+   `SPDX-License-Identifier: MPL-2.0`
 3. Add a Palimpsest badge to your README (see `assets/badges/` and `embed/license-blocks/`).
 
 == Versioning
diff --git a/PRIORITY.adoc b/PRIORITY.adoc
index 08d0b0e..1ec7724 100644
--- a/PRIORITY.adoc
+++ b/PRIORITY.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 = sanctify-php Priority List
 :toc:
 
diff --git a/PROOF-NEEDS.md b/PROOF-NEEDS.md
index 91c6b88..c0082e8 100644
--- a/PROOF-NEEDS.md
+++ b/PROOF-NEEDS.md
@@ -1,5 +1,5 @@
 # PROOF-NEEDS.md
-<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 
 ## Current State
 
diff --git a/QUICKSTART-DEV.adoc b/QUICKSTART-DEV.adoc
index 4172654..32cde2e 100644
--- a/QUICKSTART-DEV.adoc
+++ b/QUICKSTART-DEV.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Template: QUICKSTART-DEV.adoc — clone → build → test → PR
 // Replace sanctify-php, {{BUILD_CMD}}, {{TEST_CMD}}, {{LANG_STACK}} with actuals
 = sanctify-php — Quick Start for Developers
diff --git a/QUICKSTART-MAINTAINER.adoc b/QUICKSTART-MAINTAINER.adoc
index 6f85e81..861599c 100644
--- a/QUICKSTART-MAINTAINER.adoc
+++ b/QUICKSTART-MAINTAINER.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Template: QUICKSTART-MAINTAINER.adoc — packaging, deploying, and maintaining
 // Replace sanctify-php, {{PACKAGE_NAME}}, {{DEPS}} with actuals
 = sanctify-php — Quick Start for Platform Maintainers
diff --git a/QUICKSTART-USER.adoc b/QUICKSTART-USER.adoc
index ac66386..7f09652 100644
--- a/QUICKSTART-USER.adoc
+++ b/QUICKSTART-USER.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Template: QUICKSTART-USER.adoc — 5-minute path to working software
 // Replace sanctify-php, Sanctify Php — See README.adoc for details., just run, Sanctify Php started successfully. with actuals
 = sanctify-php — Quick Start for Users
diff --git a/QUICKSTART.adoc b/QUICKSTART.adoc
index 101aa34..612572f 100644
--- a/QUICKSTART.adoc
+++ b/QUICKSTART.adoc
@@ -160,7 +160,7 @@ Create `.sanctify.yaml` in your project root:
 [source,yaml]
 ----
 # Sanctify-PHP Configuration
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 
 # Analysis options
 analysis:
diff --git a/ROADMAP.adoc b/ROADMAP.adoc
index 06619a7..8de59fb 100644
--- a/ROADMAP.adoc
+++ b/ROADMAP.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 = Sanctify Php Roadmap
 
 == Current Status
diff --git a/TOPOLOGY.md b/TOPOLOGY.md
index 241c4db..5ce704c 100644
--- a/TOPOLOGY.md
+++ b/TOPOLOGY.md
@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 <!-- TOPOLOGY.md — Project architecture map and completion dashboard -->
 <!-- Last updated: 2026-02-19 -->
 
diff --git a/app/Main.hs b/app/Main.hs
index 2c38ade..8da2470 100644
--- a/app/Main.hs
+++ b/app/Main.hs
@@ -1,5 +1,5 @@
 -- | Sanctify-PHP CLI entry point
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Main where
 
 import System.Environment (getArgs)
diff --git a/bench/Main.hs b/bench/Main.hs
index 7343612..973a0ff 100644
--- a/bench/Main.hs
+++ b/bench/Main.hs
@@ -1,5 +1,5 @@
 -- | Benchmark suite for sanctify-php
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Main where
 
 import Criterion.Main
@@ -169,6 +169,6 @@ generatePhp :: Int -> T.Text
 generatePhp lineCount =
     T.pack $ unlines $
         [ "<?php"
-        , "// SPDX-License-Identifier: PMPL-1.0-or-later"
+        , "// SPDX-License-Identifier: MPL-2.0"
         , "// Generated benchmark fixture"
         ] ++ replicate (lineCount - 3) "echo 'line';"
diff --git a/contractile.just b/contractile.just
index 8f99137..9a5827b 100644
--- a/contractile.just
+++ b/contractile.just
@@ -2,7 +2,7 @@
 # Source directory: contractiles
 # Re-generate with: contractile gen-just --dir contractiles
 #
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 
 # === DUST (Recovery & Rollback) ===
 # Source: Dustfile.a2ml
diff --git a/docs/IMPLEMENTATION-TRACKER.md b/docs/IMPLEMENTATION-TRACKER.md
index ce982a5..cd86619 100644
--- a/docs/IMPLEMENTATION-TRACKER.md
+++ b/docs/IMPLEMENTATION-TRACKER.md
@@ -197,5 +197,5 @@ See `docs/ROADMAP.md` Phase 1 for details.
 
 ---
 
-*SPDX-License-Identifier: PMPL-1.0-or-later
+*SPDX-License-Identifier: MPL-2.0
 *SPDX-FileCopyrightText: 2024-2025 hyperpolymath*
diff --git a/docs/INDIEWEB-COLLABORATION.md b/docs/INDIEWEB-COLLABORATION.md
index ed37065..041e160 100644
--- a/docs/INDIEWEB-COLLABORATION.md
+++ b/docs/INDIEWEB-COLLABORATION.md
@@ -284,7 +284,7 @@ X-Bastion-Request-ID: uuid-for-provenance
 ```php
 <?php
 declare(strict_types=1);
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 
 namespace Aegis\IndieWeb;
 
@@ -351,7 +351,7 @@ sanctify-php detects missing IndieWeb security patterns:
 
 ```haskell
 -- src/Sanctify/IndieWeb/Analysis.hs
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 
 module Sanctify.IndieWeb.Analysis
   ( detectIndieWebEndpoints
@@ -469,5 +469,5 @@ See: hyperpolymath/sanctify-php/docs/INDIEWEB-COLLABORATION.md
 
 ---
 
-*SPDX-License-Identifier: PMPL-1.0-or-later
+*SPDX-License-Identifier: MPL-2.0
 *SPDX-FileCopyrightText: 2024-2025 hyperpolymath*
diff --git a/docs/INTEGRATION-SUMMARY.md b/docs/INTEGRATION-SUMMARY.md
index 8505e5b..4caa2ca 100644
--- a/docs/INTEGRATION-SUMMARY.md
+++ b/docs/INTEGRATION-SUMMARY.md
@@ -213,5 +213,5 @@ The complete Sinople integration found a **real security vulnerability**:
 
 ---
 
-*SPDX-License-Identifier: PMPL-1.0-or-later
+*SPDX-License-Identifier: MPL-2.0
 *SPDX-FileCopyrightText: 2024-2025 hyperpolymath*
diff --git a/docs/PHP-AEGIS-HANDOVER.md b/docs/PHP-AEGIS-HANDOVER.md
index 6d7141b..20d9304 100644
--- a/docs/PHP-AEGIS-HANDOVER.md
+++ b/docs/PHP-AEGIS-HANDOVER.md
@@ -107,7 +107,7 @@ php-aegis (PHP 8.1+)           ← Modern API with enums, union types
 
 ```php
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // php-aegis-compat/src/Escape.php
 
 namespace Aegis;
@@ -176,7 +176,7 @@ if (PHP_VERSION_ID >= 80100) {
 
 ```php
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // php-aegis/src/WordPress/functions.php
 
 namespace Aegis\WordPress;
@@ -258,7 +258,7 @@ if (defined('ABSPATH')) {
 
 ```php
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 
 namespace Aegis;
 
@@ -346,7 +346,7 @@ Aegis\IndieWeb\Micropub::sanitizeContent($content, $context);
 ```php
 <?php
 declare(strict_types=1);
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 
 namespace Aegis\Semantic;
 
@@ -409,7 +409,7 @@ final class Turtle
 ```php
 <?php
 declare(strict_types=1);
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // SPDX-FileCopyrightText: 2024-2025 hyperpolymath
 
 namespace Aegis;
@@ -424,7 +424,7 @@ namespace Aegis;
 ```php
 <?php
 declare(strict_types=1);
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 
 namespace Aegis;
 
@@ -603,5 +603,5 @@ For questions about this handover or sanctify-php integration:
 
 ---
 
-*SPDX-License-Identifier: PMPL-1.0-or-later
+*SPDX-License-Identifier: MPL-2.0
 *SPDX-FileCopyrightText: 2024-2025 hyperpolymath*
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 98aff04..6a603e9 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -185,7 +185,7 @@ sanctify-php-composer/
 ```php
 <?php
 declare(strict_types=1);
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 
 namespace Sanctify\Composer;
 
@@ -328,7 +328,7 @@ Cache analysis results and only rescan changed files:
 
 ```haskell
 -- src/Sanctify/Cache.hs
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 
 module Sanctify.Cache
   ( AnalysisCache(..)
@@ -406,7 +406,7 @@ Add detection for semantic web output patterns:
 
 ```haskell
 -- src/Sanctify/Analysis/Semantic.hs
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 
 module Sanctify.Analysis.Semantic
   ( SemanticContext(..)
@@ -762,5 +762,5 @@ See [CONTRIBUTING.md](./CONTRIBUTING.md) for guidelines.
 
 ---
 
-*SPDX-License-Identifier: PMPL-1.0-or-later
+*SPDX-License-Identifier: MPL-2.0
 *SPDX-FileCopyrightText: 2024-2025 hyperpolymath*
diff --git a/docs/STANDALONE.md b/docs/STANDALONE.md
index e695c44..8f7fefa 100644
--- a/docs/STANDALONE.md
+++ b/docs/STANDALONE.md
@@ -288,5 +288,5 @@ vendor/bin/sanctify-php fix src/ --use-aegis
 
 ---
 
-*SPDX-License-Identifier: PMPL-1.0-or-later
+*SPDX-License-Identifier: MPL-2.0
 *SPDX-FileCopyrightText: 2024-2025 hyperpolymath*
diff --git a/docs/TARGET-AUDIENCE.md b/docs/TARGET-AUDIENCE.md
index bf5bca1..24bd513 100644
--- a/docs/TARGET-AUDIENCE.md
+++ b/docs/TARGET-AUDIENCE.md
@@ -227,5 +227,5 @@ The tools complement each other best when:
 
 ---
 
-*SPDX-License-Identifier: PMPL-1.0-or-later
+*SPDX-License-Identifier: MPL-2.0
 *SPDX-FileCopyrightText: 2024-2025 hyperpolymath*
diff --git a/docs/UPSTREAM-ISSUES.md b/docs/UPSTREAM-ISSUES.md
index 9d3c7a0..4a9c03d 100644
--- a/docs/UPSTREAM-ISSUES.md
+++ b/docs/UPSTREAM-ISSUES.md
@@ -330,5 +330,5 @@ WordPress REST API endpoints have specific sanitization patterns that sanctify-p
 
 ---
 
-*SPDX-License-Identifier: PMPL-1.0-or-later
+*SPDX-License-Identifier: MPL-2.0
 *SPDX-FileCopyrightText: 2024-2025 hyperpolymath*
diff --git a/docs/accessibility/README.adoc b/docs/accessibility/README.adoc
index 864845b..cc5d539 100644
--- a/docs/accessibility/README.adoc
+++ b/docs/accessibility/README.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 = Burble Accessibility
 :toc: auto
 :icons: font
diff --git a/docs/governance/CRG-AUDIT-2026-04-18.adoc b/docs/governance/CRG-AUDIT-2026-04-18.adoc
index 87db319..3023884 100644
--- a/docs/governance/CRG-AUDIT-2026-04-18.adoc
+++ b/docs/governance/CRG-AUDIT-2026-04-18.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 
 = Sanctify-PHP — CRG Audit (2026-04-18)
 Codex
diff --git a/docs/governance/CRG-LIFT-PLAN-2026-04-18.adoc b/docs/governance/CRG-LIFT-PLAN-2026-04-18.adoc
index 06d7338..3e7c8df 100644
--- a/docs/governance/CRG-LIFT-PLAN-2026-04-18.adoc
+++ b/docs/governance/CRG-LIFT-PLAN-2026-04-18.adoc
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 
 = Sanctify-PHP — CRG Lift Plan (E -> D -> C)
 Codex
diff --git a/docs/user/USER-GUIDE-PART2.adoc b/docs/user/USER-GUIDE-PART2.adoc
index 7f9f2c3..0759485 100644
--- a/docs/user/USER-GUIDE-PART2.adoc
+++ b/docs/user/USER-GUIDE-PART2.adoc
@@ -406,7 +406,7 @@ Integrate Sanctify-PHP into your Git workflow:
 ----
 # .git/hooks/pre-commit
 #!/bin/bash
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 
 echo "Running Sanctify-PHP security checks..."
 
diff --git a/docs/user/USER-GUIDE.adoc b/docs/user/USER-GUIDE.adoc
index 1a30732..4efe7ca 100644
--- a/docs/user/USER-GUIDE.adoc
+++ b/docs/user/USER-GUIDE.adoc
@@ -307,7 +307,7 @@ Create `.sanctify.yaml` in your project root:
 [source,yaml]
 ----
 # Sanctify-PHP Configuration
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 
 analysis:
   min-severity: medium
diff --git a/guix.scm b/guix.scm
index 1494bec..67643ae 100644
--- a/guix.scm
+++ b/guix.scm
@@ -1,4 +1,4 @@
-; SPDX-License-Identifier: PMPL-1.0-or-later
+; SPDX-License-Identifier: MPL-2.0
 ;; guix.scm — GNU Guix package definition for sanctify-php
 ;; Usage: guix shell -f guix.scm
 
diff --git a/guix/wordpress-container.scm b/guix/wordpress-container.scm
index 82779fc..f213835 100644
--- a/guix/wordpress-container.scm
+++ b/guix/wordpress-container.scm
@@ -1,5 +1,5 @@
 ;;; Sanctify-PHP Hardened WordPress Container
-;;; SPDX-License-Identifier: PMPL-1.0-or-later
+;;; SPDX-License-Identifier: MPL-2.0
 ;;;
 ;;; This Guix manifest provides infrastructure-level hardening that
 ;;; complements the code-level analysis from sanctify-php.
diff --git a/setup.sh b/setup.sh
index 0338544..0fe327a 100755
--- a/setup.sh
+++ b/setup.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # setup.sh — Universal setup script for sanctify-php
 #
 # Detects your shell, platform, and installs prerequisites.
@@ -252,7 +252,7 @@ main() {
     # Write report
     REPORT_FILE="INSTALL-SECURITY-REPORT.adoc"
     {
-        printf "// SPDX-License-Identifier: PMPL-1.0-or-later\n"
+        printf "// SPDX-License-Identifier: MPL-2.0\n"
         printf "= Install Security Report\n"
         printf ":date: %s\n\n" "$(date -Iseconds 2>/dev/null || date)"
         printf "== Platform\n"
diff --git a/src/Sanctify/AST.hs b/src/Sanctify/AST.hs
index e3b88fe..56cb9a3 100644
--- a/src/Sanctify/AST.hs
+++ b/src/Sanctify/AST.hs
@@ -1,6 +1,6 @@
 {-# LANGUAGE StrictData #-}
 -- | PHP Abstract Syntax Tree
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.AST
     ( -- * Top-level structures
       PhpFile(..)
diff --git a/src/Sanctify/Analysis/Advanced.hs b/src/Sanctify/Analysis/Advanced.hs
index 0df617b..b8c2fa3 100644
--- a/src/Sanctify/Analysis/Advanced.hs
+++ b/src/Sanctify/Analysis/Advanced.hs
@@ -1,6 +1,6 @@
 {-# LANGUAGE OverloadedStrings #-}
 -- | Advanced Security Analysis - Beyond OWASP Top 10
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Analysis.Advanced
     ( -- * Advanced vulnerability detection
       checkReDoS
diff --git a/src/Sanctify/Analysis/DeadCode.hs b/src/Sanctify/Analysis/DeadCode.hs
index 3339a5d..0a01cd4 100644
--- a/src/Sanctify/Analysis/DeadCode.hs
+++ b/src/Sanctify/Analysis/DeadCode.hs
@@ -1,6 +1,6 @@
 -- | Dead code analysis for PHP
 -- Detects unused variables and unreachable code
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Analysis.DeadCode
     ( -- * Main analysis
       analyzeDeadCode
diff --git a/src/Sanctify/Analysis/Security.hs b/src/Sanctify/Analysis/Security.hs
index 40fcc61..806e07c 100644
--- a/src/Sanctify/Analysis/Security.hs
+++ b/src/Sanctify/Analysis/Security.hs
@@ -1,5 +1,5 @@
 -- | Security analysis for PHP code
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Analysis.Security
     ( -- * Main analysis
       analyzeSecurityIssues
diff --git a/src/Sanctify/Analysis/Taint.hs b/src/Sanctify/Analysis/Taint.hs
index c8ec971..6fde188 100644
--- a/src/Sanctify/Analysis/Taint.hs
+++ b/src/Sanctify/Analysis/Taint.hs
@@ -1,5 +1,5 @@
 -- | Taint tracking analysis for PHP code
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Analysis.Taint
     ( -- * Taint analysis
       TaintAnalysis(..)
diff --git a/src/Sanctify/Analysis/Types.hs b/src/Sanctify/Analysis/Types.hs
index c11ca30..db0faa4 100644
--- a/src/Sanctify/Analysis/Types.hs
+++ b/src/Sanctify/Analysis/Types.hs
@@ -1,5 +1,5 @@
 {-# LANGUAGE StrictData #-}
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Analysis.Types
   ( -- * Context
     TypeContext(..)
diff --git a/src/Sanctify/Config.hs b/src/Sanctify/Config.hs
index ea9f52a..5e86820 100644
--- a/src/Sanctify/Config.hs
+++ b/src/Sanctify/Config.hs
@@ -1,5 +1,5 @@
 -- | Configuration for sanctify-php
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Config
     ( -- * Configuration types
       Config(..)
diff --git a/src/Sanctify/Emit.hs b/src/Sanctify/Emit.hs
index eb51163..52f0dbe 100644
--- a/src/Sanctify/Emit.hs
+++ b/src/Sanctify/Emit.hs
@@ -1,5 +1,5 @@
 -- | PHP code emission / pretty printing
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Emit
     ( -- * Main emission
       emitPhp
diff --git a/src/Sanctify/Parser.hs b/src/Sanctify/Parser.hs
index 422e5df..593c725 100644
--- a/src/Sanctify/Parser.hs
+++ b/src/Sanctify/Parser.hs
@@ -5,7 +5,7 @@
 -- allowing for the transformation of untrusted PHP code into safe, 
 //! verified alternatives.
 --
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 
 module Sanctify.Parser
     ( -- * Primary API: High-level parsing functions
diff --git a/src/Sanctify/Parser/Lexer.hs b/src/Sanctify/Parser/Lexer.hs
index 27e529e..5b963a4 100644
--- a/src/Sanctify/Parser/Lexer.hs
+++ b/src/Sanctify/Parser/Lexer.hs
@@ -1,4 +1,4 @@
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Parser.Lexer where
 
 -- | Placeholder lexing utilities.
diff --git a/src/Sanctify/Parser/Token.hs b/src/Sanctify/Parser/Token.hs
index 30f4594..995b946 100644
--- a/src/Sanctify/Parser/Token.hs
+++ b/src/Sanctify/Parser/Token.hs
@@ -1,4 +1,4 @@
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Parser.Token where
 
 -- | Placeholder token utilities.
diff --git a/src/Sanctify/Report.hs b/src/Sanctify/Report.hs
index c6bfa26..f6d6ceb 100644
--- a/src/Sanctify/Report.hs
+++ b/src/Sanctify/Report.hs
@@ -1,5 +1,5 @@
 -- | Report generation for sanctify-php
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Report
     ( -- * Report types
       Report(..)
diff --git a/src/Sanctify/Ruleset.hs b/src/Sanctify/Ruleset.hs
index 84381d2..6899035 100644
--- a/src/Sanctify/Ruleset.hs
+++ b/src/Sanctify/Ruleset.hs
@@ -1,6 +1,6 @@
 -- | Ruleset management for sanctify-php
 -- Provides configurable rule collections for static analysis
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Ruleset
     ( -- * Core types
       Ruleset(..)
diff --git a/src/Sanctify/Transform/Sanitize.hs b/src/Sanctify/Transform/Sanitize.hs
index 7b67d06..7bc29af 100644
--- a/src/Sanctify/Transform/Sanitize.hs
+++ b/src/Sanctify/Transform/Sanitize.hs
@@ -1,5 +1,5 @@
 -- | Transform PHP code to add sanitization and escaping
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Transform.Sanitize
     ( -- * Output escaping
       wrapWithEscape
diff --git a/src/Sanctify/Transform/Strict.hs b/src/Sanctify/Transform/Strict.hs
index ca99daa..705fb3d 100644
--- a/src/Sanctify/Transform/Strict.hs
+++ b/src/Sanctify/Transform/Strict.hs
@@ -1,5 +1,5 @@
 {-# LANGUAGE StrictData #-}
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Transform.Strict
     ( transformStrict
     , transformWordPressSecurity
diff --git a/src/Sanctify/Transform/StrictTypes.hs b/src/Sanctify/Transform/StrictTypes.hs
index 0d981ef..209ceca 100644
--- a/src/Sanctify/Transform/StrictTypes.hs
+++ b/src/Sanctify/Transform/StrictTypes.hs
@@ -1,5 +1,5 @@
 -- | Transform PHP code to add strict types
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Transform.StrictTypes
     ( -- * Transformations
       addStrictTypes
diff --git a/src/Sanctify/Transform/TypeHints.hs b/src/Sanctify/Transform/TypeHints.hs
index 9dc320b..6107ebc 100644
--- a/src/Sanctify/Transform/TypeHints.hs
+++ b/src/Sanctify/Transform/TypeHints.hs
@@ -1,5 +1,5 @@
 -- | Transform PHP code to add type hints
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.Transform.TypeHints
     ( -- * Adding type hints
       addParameterTypeHints
diff --git a/src/Sanctify/WordPress/Constraints.hs b/src/Sanctify/WordPress/Constraints.hs
index f26361e..b84b31d 100644
--- a/src/Sanctify/WordPress/Constraints.hs
+++ b/src/Sanctify/WordPress/Constraints.hs
@@ -1,5 +1,5 @@
 -- | WordPress-specific constraints and best practices
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.WordPress.Constraints
     ( -- * Constraint checking
       WordPressIssue(..)
diff --git a/src/Sanctify/WordPress/Hooks.hs b/src/Sanctify/WordPress/Hooks.hs
index d94bb85..e611348 100644
--- a/src/Sanctify/WordPress/Hooks.hs
+++ b/src/Sanctify/WordPress/Hooks.hs
@@ -1,5 +1,5 @@
 -- | WordPress hooks analysis and transformation
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.WordPress.Hooks
     ( -- * Hook analysis
       HookUsage(..)
diff --git a/src/Sanctify/WordPress/Security.hs b/src/Sanctify/WordPress/Security.hs
index c969ca0..92162ce 100644
--- a/src/Sanctify/WordPress/Security.hs
+++ b/src/Sanctify/WordPress/Security.hs
@@ -1,6 +1,6 @@
 {-# LANGUAGE OverloadedStrings #-}
 -- | WordPress-Specific Security Deep Analysis
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Sanctify.WordPress.Security
     ( -- * WordPress security analysis
       analyzeWordPressSecurity
diff --git a/stapeln.toml b/stapeln.toml
index c0b9f17..dd0f4de 100644
--- a/stapeln.toml
+++ b/stapeln.toml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # stapeln.toml — Layer-based container build for sanctify-php
 #
 # stapeln builds containers as composable layers (German: "to stack").
diff --git a/test-plugins/secure-contact-form.php b/test-plugins/secure-contact-form.php
index d61303d..dfb8e9a 100644
--- a/test-plugins/secure-contact-form.php
+++ b/test-plugins/secure-contact-form.php
@@ -3,7 +3,7 @@
  * Plugin Name: Secure Contact Form
  * Description: Properly secured example
  * Version: 1.0.0
- * SPDX-License-Identifier: PMPL-1.0-or-later
+ * SPDX-License-Identifier: MPL-2.0
  */
 
 declare(strict_types=1);
diff --git a/test-plugins/vulnerable-contact-form.php b/test-plugins/vulnerable-contact-form.php
index a2c63f9..f642ad9 100644
--- a/test-plugins/vulnerable-contact-form.php
+++ b/test-plugins/vulnerable-contact-form.php
@@ -3,7 +3,7 @@
  * Plugin Name: Vulnerable Contact Form
  * Description: Simplified example with security issues
  * Version: 1.0.0
- * SPDX-License-Identifier: PMPL-1.0-or-later
+ * SPDX-License-Identifier: MPL-2.0
  */
 
 // Missing ABSPATH check
diff --git a/test/AspectSpec.hs b/test/AspectSpec.hs
index d278995..8b1501f 100644
--- a/test/AspectSpec.hs
+++ b/test/AspectSpec.hs
@@ -1,5 +1,5 @@
 -- | Aspect Tests - Security, robustness, and error handling for the analyzer itself
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module AspectSpec (spec) where
 
 import Test.Hspec
diff --git a/test/E2ESpec.hs b/test/E2ESpec.hs
index 44e39ba..6377267 100644
--- a/test/E2ESpec.hs
+++ b/test/E2ESpec.hs
@@ -1,5 +1,5 @@
 -- | End-to-End test suite - Full pipeline validation
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module E2ESpec (spec) where
 
 import Test.Hspec
diff --git a/test/Main.hs b/test/Main.hs
index 22ff1fe..2e50dec 100644
--- a/test/Main.hs
+++ b/test/Main.hs
@@ -1,5 +1,5 @@
 -- | Test suite for Sanctify PHP
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module Main (main) where
 
 import Test.Hspec
diff --git a/test/ParserSpec.hs b/test/ParserSpec.hs
index 02a8c18..397bf55 100644
--- a/test/ParserSpec.hs
+++ b/test/ParserSpec.hs
@@ -1,5 +1,5 @@
 -- | Parser test suite - Golden file tests
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module ParserSpec (spec) where
 
 import Test.Hspec
diff --git a/test/PropertySpec.hs b/test/PropertySpec.hs
index 7e77977..052feac 100644
--- a/test/PropertySpec.hs
+++ b/test/PropertySpec.hs
@@ -1,5 +1,5 @@
 -- | Property-Based Tests - QuickCheck validation
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module PropertySpec (spec) where
 
 import Test.Hspec
diff --git a/test/SecuritySpec.hs b/test/SecuritySpec.hs
index 7d207d0..1337eb5 100644
--- a/test/SecuritySpec.hs
+++ b/test/SecuritySpec.hs
@@ -1,5 +1,5 @@
 -- | Security analysis test suite - Vulnerability detection
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module SecuritySpec (spec) where
 
 import Test.Hspec
diff --git a/test/Spec.hs b/test/Spec.hs
index 0417fd6..e88a2e9 100644
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -1,4 +1,4 @@
 -- | Main test suite runner
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 
 {-# OPTIONS_GHC -F -pgmF hspec-discover #-}
diff --git a/test/TransformSpec.hs b/test/TransformSpec.hs
index c7ae632..0ff8257 100644
--- a/test/TransformSpec.hs
+++ b/test/TransformSpec.hs
@@ -1,5 +1,5 @@
 -- | Transformation test suite - Sanitization and hardening
--- SPDX-License-Identifier: PMPL-1.0-or-later
+-- SPDX-License-Identifier: MPL-2.0
 module TransformSpec (spec) where
 
 import Test.Hspec
diff --git a/test/fixtures/clean_code.php b/test/fixtures/clean_code.php
index 6c2ac2a..10a55f0 100644
--- a/test/fixtures/clean_code.php
+++ b/test/fixtures/clean_code.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Fixture: Clean code with no dead code issues
 
 declare(strict_types=1);
diff --git a/test/fixtures/php82-features.php b/test/fixtures/php82-features.php
index 36977d3..8485b9c 100644
--- a/test/fixtures/php82-features.php
+++ b/test/fixtures/php82-features.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Test fixture: PHP 8.2+ features
 
 declare(strict_types=1);
diff --git a/test/fixtures/unreachable_code.php b/test/fixtures/unreachable_code.php
index adc8c45..68dfaa1 100644
--- a/test/fixtures/unreachable_code.php
+++ b/test/fixtures/unreachable_code.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Fixture: Unreachable code test case
 
 declare(strict_types=1);
diff --git a/test/fixtures/unused_parameters.php b/test/fixtures/unused_parameters.php
index 1a8a708..f72d3df 100644
--- a/test/fixtures/unused_parameters.php
+++ b/test/fixtures/unused_parameters.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Fixture: Unused function parameters test case
 
 declare(strict_types=1);
diff --git a/test/fixtures/unused_variables.php b/test/fixtures/unused_variables.php
index 7bec945..7a5f439 100644
--- a/test/fixtures/unused_variables.php
+++ b/test/fixtures/unused_variables.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Fixture: Unused variables test case
 
 declare(strict_types=1);
diff --git a/test/fixtures/vulnerable-sql.php b/test/fixtures/vulnerable-sql.php
index 6a4308b..78d2339 100644
--- a/test/fixtures/vulnerable-sql.php
+++ b/test/fixtures/vulnerable-sql.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Test fixture: SQL injection vulnerability
 
 function get_user_by_id($id) {
diff --git a/test/fixtures/vulnerable-xss.php b/test/fixtures/vulnerable-xss.php
index 5902227..fd7c6ef 100644
--- a/test/fixtures/vulnerable-xss.php
+++ b/test/fixtures/vulnerable-xss.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Test fixture: XSS vulnerabilities
 
 function display_welcome() {
diff --git a/test/fixtures/wordpress-safe.php b/test/fixtures/wordpress-safe.php
index 929d46d..0f3604a 100644
--- a/test/fixtures/wordpress-safe.php
+++ b/test/fixtures/wordpress-safe.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Test fixture: Safe WordPress code
 
 declare(strict_types=1);
diff --git a/test/fixtures/wordpress-unsafe.php b/test/fixtures/wordpress-unsafe.php
index 8bd6108..ed1679c 100644
--- a/test/fixtures/wordpress-unsafe.php
+++ b/test/fixtures/wordpress-unsafe.php
@@ -1,5 +1,5 @@
 <?php
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Test fixture: WordPress security issues
 
 // Missing nonce verification
diff --git a/void.ttl b/void.ttl
index 0798f0d..d4b19db 100644
--- a/void.ttl
+++ b/void.ttl
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 @prefix void: <http://rdfs.org/ns/void#> .
 @prefix dcterms: <http://purl.org/dc/terms/> .
 @prefix foaf: <http://xmlns.com/foaf/0.1/> .