Merge branch 'main' into chore/license-phase-1-spdx-agpl-3-0-or-later

Author: hyperpolymath

.github/workflows/hypatia-scan-reusable.yml

@@ -81,6 +81,17 @@ permissions:
   # "Resource not accessible by integration" and (absent continue-on-error)
   # hard-fails the scan — exactly what the gate-decoupling design forbids.
   pull-requests: write
+  # actions: read lets `codeql-action/upload-sarif` call
+  # GET /repos/{owner}/{repo}/actions/runs/{run_id} to attach the SARIF
+  # blob to the workflow run. Without it the upload step fails with
+  # "Resource not accessible by integration" AFTER the scan + SARIF
+  # conversion both succeed — symptoms observed across .git-private-farm
+  # and other estate consumers since the SARIF upload was wired in.
+  # Reusable workflow permission blocks OVERRIDE the caller's permission
+  # block, so this MUST live here at source rather than at every
+  # wrapper — adding it only at the wrapper is a no-op.
+  # See .git-private-farm#69 for the reproducing logs.
+  actions: read
 
 jobs:
   scan:

.github/workflows/secret-scanner-reusable.yml

@@ -77,6 +77,21 @@ jobs:
 
   gitleaks:
     runs-on: ${{ inputs.runs-on }}
+    # Job-level permissions (narrower than granting these workflow-wide).
+    # The other jobs (trufflehog / rust-secrets / shell-secrets) only need
+    # `contents: read`, which they get from the workflow-level block.
+    permissions:
+      contents: read
+      # gitleaks-action's `ScanPullRequest` posts a summary comment via
+      # the GitHub Issues/PR API. Without `pull-requests: write` it fails
+      # with "Resource not accessible by integration" AFTER the gitleaks
+      # scan itself succeeds. Reusable-workflow permission blocks
+      # OVERRIDE the caller's, so this MUST live here at source.
+      # See .git-private-farm#69 for the reproducing logs.
+      pull-requests: write
+      # Additional API calls inside `ScanPullRequest` (workflow-run
+      # metadata, PR-files endpoint) require `actions: read`.
+      actions: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

0-ai-gatekeeper-protocol/.gitattributes

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # RSR-compliant .gitattributes
 
 * text=auto eol=lf

0-ai-gatekeeper-protocol/.github/FUNDING.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 

0-ai-gatekeeper-protocol/.github/dependabot.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # Dependabot configuration for RSR-compliant repositories
 # Covers common ecosystems - remove unused ones for your project
 

0-ai-gatekeeper-protocol/.github/workflows/governance.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #

0-ai-gatekeeper-protocol/.github/workflows/hypatia-scan.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
 

0-ai-gatekeeper-protocol/.github/workflows/instant-sync.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 

0-ai-gatekeeper-protocol/.github/workflows/jekyll-gh-pages.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # Sample workflow for building and deploying a Jekyll site to GitHub Pages
 name: Deploy Jekyll with GitHub Pages dependencies preinstalled
 

0-ai-gatekeeper-protocol/.github/workflows/jekyll.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
 # separate terms of service, privacy policy, and support