chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair)

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:

.github/workflows/governance.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Governance
 
 on:

.github/workflows/hypatia-scan.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Hypatia Security Scan
 
 on:

.github/workflows/scorecard.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: OSSF Scorecard
 
 on:

.machine_readable/agent_instructions/README.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 = Agent Instructions
 :toc: preamble

.machine_readable/svc/README.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 = `.machine_readable/svc/` — Service components for stapeln
 :toc:
 

.machine_readable/svc/k9/README.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 = K9 Contractiles
 :toc: left
 :icons: font

ABI-FFI-README.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Stapeln ABI/FFI
 
 Stapeln uses this boundary model:

ACCESSIBILITY.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Accessibility Standards for stackur
 
 ## WCAG 2.3 AAA Compliance

ARCHITECTURE.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # stapeln Architecture
 
 ## Overview

ATTACK-SURFACE-GAPS.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Attack Surface Gap Analysis: stapeln Ecosystem
 
 **Question**: "Are there any points on the attack surface that we should build to ensure it is super sealed?"

CHANGELOG.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-License-Identifier: MPL-2.0
+SPDX-License-Identifier: CC-BY-SA-4.0
 SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 -->
 

CODE_OF_CONDUCT.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Code of Conduct
 
 <!-- 

CONTAINER-HATER-TEST.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Converting Container Haters: The Ultimate Test
 
 ## The Challenge

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Clone the repository
 git clone https://github.com/hyperpolymath/stapeln.git
 cd stapeln

DATABASE-AND-DOCS-INTEGRATION.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # stapeln Database & Document Integration
 
 ## Three Hyperpolymath Components
@@ -472,7 +472,7 @@ let renderA2MLDoc = (doc: a2mlDocument, isDark: bool) => {
 
 ```nickel
 K9!
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 # Component: nginx verified container
 # Security Level: Kennel (pure data)
 
@@ -549,7 +549,7 @@ K9!
 
 ```nickel
 K9!
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 # Stack: LAMP deployment
 # Security Level: Hunt (requires signature)
 

EXPLAINME.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 = stapeln — Show Me The Receipts
 :toc:
 :icons: font

FIREWALL-CONFIG.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # stapeln Firewall Configuration & Security
 
 **Status**: Design specification for OWASP-compliant firewall with ephemeral pinholes
@@ -29,7 +29,7 @@ stapeln implements defense-in-depth security with:
 
 ```nginx
 # svalinn/modsecurity.conf
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 SecRuleEngine On
 SecRequestBodyAccess On
@@ -106,7 +106,7 @@ SecRule ARGS "@rx \\.\\./|/proc/|/sys/|/dev/" \
 
 ```bash
 # stapeln-firewall-setup.sh
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 #!/bin/bash
 set -euo pipefail
@@ -147,7 +147,7 @@ firewall-cmd --reload
 
 ```nft
 # /etc/nftables/stapeln.nft
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 table inet stapeln {
   # Default-deny policy
@@ -232,7 +232,7 @@ curl -v http://localhost:8000  # Should succeed (with auth)
 
 ```elixir
 # backend/lib/stapeln/ephemeral_pinhole.ex
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 defmodule Stapeln.EphemeralPinhole do
   @moduledoc """
@@ -488,7 +488,7 @@ end
 
 ```elixir
 # backend/lib/stapeln/schema/pinhole.ex
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 defmodule Stapeln.Schema.Pinhole do
   use Ecto.Schema
@@ -511,7 +511,7 @@ end
 
 ```elixir
 # backend/priv/repo/migrations/20260205000001_create_ephemeral_pinholes.exs
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 defmodule Stapeln.Repo.Migrations.CreateEphemeralPinholes do
   use Ecto.Migration
@@ -539,7 +539,7 @@ end
 
 ```graphql
 # backend/schema/firewall.graphql
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 type EphemeralPinhole {
   id: ID!
@@ -584,7 +584,7 @@ type Query {
 
 ```elixir
 # backend/lib/stapeln/auth.ex
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 defmodule Stapeln.Auth do
   @moduledoc """
@@ -646,7 +646,7 @@ end
 
 ```
 # /etc/pam.d/stapeln
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 auth    required    pam_unix.so
 account required    pam_unix.so
@@ -656,7 +656,7 @@ account required    pam_unix.so
 
 ```rescript
 // frontend/src/Auth.res
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 
 type authState =
   | NotAuthenticated
@@ -813,7 +813,7 @@ let renderLogin = (state: authState, dispatch: loginMsg => unit) => {
 
 ```rescript
 // frontend/src/PortConfigPanel.res
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 
 type portState = Closed | Open | Ephemeral({duration: int, expiresAt: DateTime.t})
 
@@ -971,7 +971,7 @@ let useCountdownEffect = (ports: array<port>) => {
 
 ```rescript
 // frontend/src/SecurityInspector.res
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 
 type securityLevel = Critical | High | Medium | Low | Safe
 
@@ -1123,7 +1123,7 @@ let renderRiskBadge = (level: securityLevel) => {
 
 ```elixir
 # backend/lib/stapeln/security_scanner.ex
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 defmodule Stapeln.SecurityScanner do
   @moduledoc """
@@ -1340,7 +1340,7 @@ docker stop myapp
 
 ```elixir
 # backend/lib/stapeln/audit_log.ex
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 defmodule Stapeln.AuditLog do
   @moduledoc """
@@ -1389,7 +1389,7 @@ end
 
 ```rescript
 // frontend/src/AuditTrail.res
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 
 let renderAuditTrail = (entries: array<auditEntry>) => {
   <section className="audit-trail" role="region" ariaLabel="Security audit trail">
@@ -1429,7 +1429,7 @@ let renderAuditTrail = (entries: array<auditEntry>) => {
 
 ```bash
 # tests/firewall-test.sh
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 #!/bin/bash
 set -euo pipefail

IMPLEMENTATION-PLAN.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # stapeln Legacy Implementation Plan (Archive)
 
 > Status: archival reference only.

LAGO-GREY-INTEGRATION.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Lago Grey Integration: Base Image Designer
 
 **Status**: Design specification for integrating lago-grey as base image component
@@ -315,7 +315,7 @@ extend type Mutation {
 
 ```elixir
 # backend/lib/stapeln/lago_grey.ex
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 defmodule Stapeln.LagoGrey do
   @moduledoc """
@@ -378,7 +378,7 @@ Add base image security rules:
 
 ```scheme
 ;; security-rules/base-image.scm
-;; SPDX-License-Identifier: MPL-2.0
+;; SPDX-License-Identifier: CC-BY-SA-4.0
 
 (define (insecure-base-imageo component)
   "Rule: Components should use minimal, secure base images"

LICENSE

@@ -1,5 +1,3 @@
-SPDX-License-Identifier: MPL-2.0
-
 Mozilla Public License Version 2.0
 ==================================