|
| 1 | +<!-- |
| 2 | +SPDX-License-Identifier: AGPL-3.0-or-later |
| 3 | +SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> |
| 4 | +--> |
| 5 | + |
| 6 | +# Estate License Policy — Canonical (2026-06-02) |
| 7 | + |
| 8 | +> Owner directive 2026-06-02: |
| 9 | +> |
| 10 | +> > "mpl-2.0 is for my sole repos, all rights reserved is for 007, agpl-3.0-or-later is for those shared with my son, and leave other people's forked stuff alone … only palimpsest license for obvious reasons should be talking about palimpsest and palimpsest plasma, and consent-aware-http, but in that case prospectively" |
| 11 | +
|
| 12 | +This document is the canonical reference for license classification across the `hyperpolymath/*` estate. It is the source of truth for: |
| 13 | + |
| 14 | +- Repository LICENSE files |
| 15 | +- Source-file `SPDX-License-Identifier:` headers |
| 16 | +- `Cargo.toml` / `package.json` / `deno.json` / `mix.exs` `license` fields |
| 17 | +- Audit tooling exclusions (hypatia recipes, gitbot remediation sweeps) |
| 18 | + |
| 19 | +## The five-way classification |
| 20 | + |
| 21 | +The classification is **mutually exclusive and exhaustive** — every repo in the estate falls into exactly one row. |
| 22 | + |
| 23 | +| # | Category | License | Applies to | |
| 24 | +|---|---|---|---| |
| 25 | +| **1** | **Sole owner repos (default)** | `MPL-2.0` | Every repo authored by the owner alone. Default for ~all of `hyperpolymath/*` unless one of the other rows applies. | |
| 26 | +| **2** | **All Rights Reserved** | ARR | `hyperpolymath/007` specifically (dual-use classified). Out of scope for any normalisation, scanning, or labelling. Surface to owner only. | |
| 27 | +| **3** | **Shared with son (Joshua)** | `AGPL-3.0-or-later` | Repos with son as co-author/maintainer. **Confirmed**: `idaptik`, `burble`, `standards`, `rattlescript`, `vcl-ut`. Permanent. | |
| 28 | +| **4** | **Third-party / forks / not yours** | LEAVE ALONE | Whatever upstream chose. Never sweep, never normalise. Flag as out-of-scope if it surfaces in an audit. | |
| 29 | +| **5** | **Palimpsest carve-out (extremely narrow)** | `PMPL-1.0-or-later` (palimpsest-license + palimpsest-plasma) / **hybrid** (consent-aware-http) | TWO repos as `PMPL-1.0-or-later`: `palimpsest-license` + `palimpsest-plasma`. `consent-aware-http` (currently subdir of `standards/consent-aware-http/`, possibly future standalone) has **hybrid** licensing — see below. NOWHERE ELSE PMPL. | |
| 30 | + |
| 31 | +## consent-aware-http hybrid licensing |
| 32 | + |
| 33 | +`consent-aware-http` is **not** licensed under `PMPL-1.0-or-later`. The newer design (owner directive 2026-06-02) is: |
| 34 | + |
| 35 | +| Aspect | License | |
| 36 | +|---|---| |
| 37 | +| Source files (`.rs`, `.ml`, etc.) | `MPL-2.0` | |
| 38 | +| Doc/spec files (`.md`, `.adoc`, RFC drafts) | `CC-BY-4.0` (IETF-compatible) | |
| 39 | +| In-text reference | Spec text **references** `PMPL-2.0-or-later` for cultural/ethical/post-quantum framing. PMPL is referenced as a sibling framework, NOT applied as the file SPDX. | |
| 40 | + |
| 41 | +Rationale: no existing licence covers both IETF tooling-compatibility AND cultural/ethical/post-quantum scaffolding. The hybrid gives both. |
| 42 | + |
| 43 | +## How the policy is enforced |
| 44 | + |
| 45 | +### Memory layer |
| 46 | +Canonical source for agents: `~/.claude/projects/-home-hyperpolymath-developer-repos/memory/feedback_estate_license_policy_umbrella.md` and the per-repo sibling memories (`feedback_burble_agpl_intentional.md`, `feedback_standards_agpl_intentional.md`, etc.). |
| 47 | + |
| 48 | +### Hypatia recipes |
| 49 | +- `data/verisim/recipes/recipe-fix-pmpl-drift.json` — detects legacy `PMPL-1.0-or-later` SPDX stamps that drift from each repo's category target; auto-classifies via LICENSE file; sweeps PMPL→target (MPL or AGPL). |
| 50 | +- `data/verisim/recipes/recipe-fix-spdx-license.json` — older AGPL→MPL recipe, now scoped via `exclude_repos` to skip the confirmed AGPL category-3 repos. |
| 51 | +- `scripts/fix-scripts/fix-pmpl-drift.sh` — category-aware fix script with submodule and sub-path exclusions. |
| 52 | + |
| 53 | +### Validation |
| 54 | +- `scripts/fix-scripts/fix-pmpl-drift.sh --dry-run <repo>` lists drift without changes. |
| 55 | +- `hooks/validate-spdx.sh` blocks committing workflow files without an SPDX header. |
| 56 | + |
| 57 | +### Hard exclusions (never sweep) |
| 58 | +- Submodule paths (per `.gitmodules`) |
| 59 | +- Sub-paths: `rescript-tea/`, `rescript-vite/`, `affinescript-vite/` (possible upstream forks) |
| 60 | +- Sub-paths: `idaptik-rescript13-staging/` (AGPL inheritance from son-shared idaptik) |
| 61 | +- Sub-paths: `consent-aware-http/` (hybrid licensing per above) |
| 62 | +- Check-in copies of standalone repos (e.g. `dev-ecosystem/affinescript-ecosystem/rattlescript/` → fix in `hyperpolymath/rattlescript` standalone) |
| 63 | + |
| 64 | +## Process rules |
| 65 | + |
| 66 | +1. **License/SPDX changes are MANUAL, file-by-file, owner-only, third-party untouchable.** Never auto-PR a licence change even if policy-correct without explicit owner approval. |
| 67 | +2. **Per-repo scoping required.** Bulk-sweep PRs across multiple repos are blocked by classifier; each repo gets its own PR with explicit scope description. |
| 68 | +3. **Per-subdir scoping for monorepos.** For repos like `developer-ecosystem`, `standards`, file separate PRs per top-level subtree, not one giant PR. |
| 69 | +4. **LICENSE replacement is more invasive than SPDX flip.** Where a sub-project has its own PMPL LICENSE file (not just source SPDX drift), the LICENSE replacement gets its own phase/PR with explicit notice. |
| 70 | +5. **Discovered category-3 repos go in memory immediately.** Always update `feedback_estate_license_policy_umbrella.md` (the five-way table) plus a new `feedback_<repo>_agpl_intentional.md` sibling file when a new AGPL category-3 repo is confirmed. |
| 71 | + |
| 72 | +## 2026-06-02 initial sweep — reference PRs |
| 73 | + |
| 74 | +The PMPL→target sweep that surfaced this canonical policy landed via these PRs across 25 repos (≈14k files swept): |
| 75 | + |
| 76 | +| Repo | PR(s) | Files | Target | |
| 77 | +|---|---|---|---| |
| 78 | +| neurophone | #102 (canonical revert), #120 (docs reintro) | 100 + 8 | MPL-2.0 | |
| 79 | +| developer-ecosystem | #103/#104/#105/#106 | 7,033 | MPL-2.0 | |
| 80 | +| nextgen-databases | #29 / #30 | 226 | MPL-2.0 | |
| 81 | +| standards | #344 / #345 | 3,417 | **AGPL-3.0-or-later** | |
| 82 | +| stapeln | #86 / #87 | 875 | MPL-2.0 | |
| 83 | +| reposystem | #90 (Phase 1) | 401 | MPL-2.0 | |
| 84 | +| ephapax | #285 | 343 | MPL-2.0 | |
| 85 | +| sanctify-php | #47 | 123 | MPL-2.0 | |
| 86 | +| ubicity | #73 | 131 | MPL-2.0 | |
| 87 | +| zerotier-k8s-link | #63 | 110 | MPL-2.0 | |
| 88 | +| verisimiser | #156 | 274 | MPL-2.0 | |
| 89 | +| squisher-corpus | #26 | 126 | MPL-2.0 | |
| 90 | +| rattlescript | #29 | 240 | **AGPL-3.0-or-later** | |
| 91 | +| pimcore-fortress | #22 | 87 | MPL-2.0 | |
| 92 | +| tree-navigator | #41 | 75 | MPL-2.0 | |
| 93 | +| snapcreate | #29 | 65 | MPL-2.0 | |
| 94 | +| php-aegis | #43 | 92 | MPL-2.0 | |
| 95 | +| nafa-app | #26 | 103 | MPL-2.0 | |
| 96 | +| vscode-k9 | #22 | 219 | MPL-2.0 | |
| 97 | +| supernorma | #38 | 72 | MPL-2.0 | |
| 98 | +| sdp-hkdf-deployment | #26 | 81 | MPL-2.0 | |
| 99 | +| robot-vacuum-cleaner | #64 | 81 | MPL-2.0 | |
| 100 | +| gitbot-fleet | #250 | 148 | MPL-2.0 | |
| 101 | +| vcl-ut | #46 | 32 | **AGPL-3.0-or-later** | |
| 102 | +| resource-record-fluctuator | #38 | 55 | MPL-2.0 | |
| 103 | +| proof-of-work | #83 | 118 | MPL-2.0 | |
| 104 | +| project-wharf | #49 | 68 | MPL-2.0 | |
| 105 | +| julia-professional-registry | #25 | 16 | MPL-2.0 | |
| 106 | +| hypatia | #423 (governance recipe) | 3 (recipe+script+exclude_repos update) | – | |
| 107 | + |
| 108 | +## Known deferred work |
| 109 | + |
| 110 | +- `consent-aware-http` hybrid handling — 39 files in `standards/consent-aware-http/` need file-type-aware sweep (source vs spec vs reference) |
| 111 | +- `reposystem` Phase 2 — 7 sub-projects with own PMPL LICENSE pending standalone-vs-local classification |
| 112 | +- `panll` — owner-managed, never sweep without explicit per-touch greenlight |
| 113 | +- Tail repos with 1-2 PMPL stamps each that didn't make the original audit cap |
| 114 | + |
| 115 | +## Related memory references |
| 116 | + |
| 117 | +- `feedback_estate_license_policy_umbrella.md` — canonical 5-way table |
| 118 | +- `feedback_no_automated_licence_edits.md` — meta-rule against bulk auto-PR |
| 119 | +- `feedback_pr_sweep_title_keyword_exclusion.md` — guardrail against sweeping license PRs |
| 120 | +- Per-repo: `feedback_{burble,standards,rattlescript,vcl_ut,idaptik}_agpl_intentional.md` |
| 121 | +- Carve-out specifics: `feedback_consent_aware_http_hybrid_licensing.md` |
0 commit comments