fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

[hyperpolymath]

Closes #134

Owner ruling

Arm 1 — the repository's licence identity is MPL-2.0; the
PMPL-1.0-or-later SPDX identifiers were seeding artefacts from the estate
port 7/11 session and are the outliers. Evidence:

Declaration	Value
LICENSE body (verbatim, header-less canonical shape)	Mozilla Public License 2.0
GitHub repo licence metadata	MPL-2.0
Existing SPDX headers in the repo	89 × MPL-2.0 vs 4 × PMPL-1.0-or-later
PALIMPSEST.adoc (estate policy, shipped in every repo)	"For SPDX and tooling, use MPL-2.0."
NOTICE (binding terms section)	"Source files: governed by MPL-2.0 (per SPDX headers)"
Estate-wide audit (366 repos, all root .ipkg + Idris harness copies)	every sibling port declares MPL-2.0; ipfs-overlay is the only repo with PMPL-1.0-or-later
LICENSES/	contains MPL-2.0 + CC-BY-SA-4.0 text, no PMPL text → the PMPL headers were also REUSE-invalid

What changed (licence identity only, one commit)

• ipfs-overlay-tests.ipkg — SPDX header PMPL-1.0-or-later → MPL-2.0
  (this is what the governance / Licence consistency gate reads).
• tests/idris2/ConfigContractsTest.idr, tests/idris2/ConfigStructureTest.idr,
  tests/idris2/Test/Spec.idr — SPDX headers → MPL-2.0.
• ConfigContractsTest (INVARIANT 3 + INVARIANT 9) and ConfigStructureTest
  (SPDX-header unit test) contained stale assertion strings expecting
  SPDX-License-Identifier: PMPL-1.0-or-later inside configs/*.ncl and
  scripts/*.sh — all of which declare MPL-2.0. Those assertions could only
  fail; they now assert the true header. (Latent test bug found while
  satisfying the acceptance criterion "no other file claims PMPL-1.0-or-later".)

After this commit, zero files in the repo contain the string
PMPL-1.0-or-later (verified by grep -r). PMPL survives only as policy
prose in PALIMPSEST.adoc / NOTICE / badges — identical to every sibling
repo, and not an SPDX identity claim.

Verification

$ bash standards/scripts/check-licence-consistency.sh .   # exact script the gate runs
[OK] LICENSE file found: LICENSE
[OK] LICENSE has no SPDX header, but its body is verbatim MPL-2.0 text — accepted as a canonical licence file.
[OK] Manifest licence (./ipfs-overlay-tests.ipkg): MPL-2.0
[OK] Licence identity matches manifest declaration.
[OK] Licence consistency check passed.
$ echo $?
0

• Script taken from hyperpolymath/standards@main, the same ref the
  licence-consistency job checks out.
• Diff is 4 files / 7 lines, all SPDX identity strings; no logic changes.
• grep -rn "PMPL-1.0-or-later" --exclude-dir=.git . → zero hits.
• Idris2 0.8.0 (chez) differential run of the test suite — it is not wired
  into CI, run here as extra proof:
  • pre-fix tree: 16 passed, 3 failed (the three SPDX assertions, which
    expected PMPL in files that declare MPL-2.0);
  • this branch: 19 passed, 0 failed.
• REUSE lint: no new findings vs main (the pre-existing string-literal and
  missing-copyright notes are identical in kind on both trees; no REUSE job
  exists in CI).
• Not in scope (per the issue): Validate A2ML manifests — separate
  pre-existing failure, deliberately untouched.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5cbe299e-b7bb-4eb2-9a77-d540ba4ba47e

📥 Commits

Reviewing files that changed from the base of the PR and between 8176606 and 6adaede.

📒 Files selected for processing (4)

• ipfs-overlay-tests.ipkg
• tests/idris2/ConfigContractsTest.idr
• tests/idris2/ConfigStructureTest.idr
• tests/idris2/Test/Spec.idr

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⚠️ CI failures not shown inline (22)

GitHub Actions: Dogfood Gate / 1_Groove manifest check.txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

---

GitHub Actions: Dogfood Gate / Groove manifest check: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

---

GitHub Actions: Dogfood Gate / 4_Validate A2ML manifests.txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `hyperpolymath/a2ml-ecosystem`: the repository has been renamed or transferred. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

---

GitHub Actions: Dogfood Gate / Validate A2ML manifests: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `hyperpolymath/a2ml-ecosystem`: the repository has been renamed or transferred. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

---

GitHub Actions: Governance / 1_governance _ Code quality + docs.txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run # Split gate (standards#505): README + LICENSE block immediately —
 �[36;1m# Split gate (standards#505): README + LICENSE block immediately —�[0m
 �[36;1m# measured 0/412 callers missing either, so arming them reds nobody.�[0m
 �[36;1m# CONTRIBUTING (54/412 missing) warns until the cutoff baked into the�[0m
 �[36;1m# script, then blocks. See scripts/check-docs-presence.sh.�[0m
 �[36;1mcp .standards-checkout/scripts/check-docs-presence.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-docs-presence.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Missing required documentation: CONTRIBUTING

---

GitHub Actions: Governance / governance _ Code quality + docs: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run # Split gate (standards#505): README + LICENSE block immediately —
 �[36;1m# Split gate (standards#505): README + LICENSE block immediately —�[0m
 �[36;1m# measured 0/412 callers missing either, so arming them reds nobody.�[0m
 �[36;1m# CONTRIBUTING (54/412 missing) warns until the cutoff baked into the�[0m
 �[36;1m# script, then blocks. See scripts/check-docs-presence.sh.�[0m
 �[36;1mcp .standards-checkout/scripts/check-docs-presence.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-docs-presence.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Missing required documentation: CONTRIBUTING

---

GitHub Actions: Governance / 2_governance _ Well-Known (RFC 9116 + RSR).txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

---

GitHub Actions: Governance / 3_governance _ Actions lockfile verify.txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at the explicit helper pin failed?)"�[0m

---

GitHub Actions: Governance / governance _ Actions lockfile verify: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at the explicit helper pin failed?)"�[0m

---

GitHub Actions: Governance / 6_governance _ Security policy checks.txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

---

GitHub Actions: Governance / governance _ Security policy checks: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

---

GitHub Actions: Governance / governance _ Security policy checks: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

---

GitHub Actions: Governance / 8_governance _ Workflow security linter.txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
 �[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
 �[36;1m# Standards revision.�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

---

GitHub Actions: Governance / 12_governance _ Language _ package anti-pattern policy.txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / 13_governance _ Guix packaging policy (Nix retired).txt: fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run # Move the checker OUT of the scanned tree and delete the standards
 �[36;1m# Move the checker OUT of the scanned tree and delete the standards�[0m
 �[36;1m# checkout before scanning: the gate walks the whole caller tree, so�[0m
 �[36;1m# a packaging file shipped inside .standards-checkout/ would satisfy�[0m
 �[36;1m# the policy on the caller's behalf (same trap as the baseline job).�[0m
 �[36;1mcp .standards-checkout/scripts/check-package-policy.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-package-policy.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Package policy violation: no packaging found.

---

GitHub Actions: Governance / governance _ Guix packaging policy (Nix retired): fix(licensing): align stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0

Conclusion: failure

View job details

##[group]Run # Move the checker OUT of the scanned tree and delete the standards
 �[36;1m# Move the checker OUT of the scanned tree and delete the standards�[0m
 �[36;1m# checkout before scanning: the gate walks the whole caller tree, so�[0m
 �[36;1m# a packaging file shipped inside .standards-checkout/ would satisfy�[0m
 �[36;1m# the policy on the caller's behalf (same trap as the baseline job).�[0m
 �[36;1mcp .standards-checkout/scripts/check-package-policy.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-package-policy.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Package policy violation: no packaging found.

🔇 Additional comments (4)

ipfs-overlay-tests.ipkg (1)

1-1: LGTM!

tests/idris2/ConfigContractsTest.idr (1)

1-1: LGTM!

Also applies to: 54-54, 115-115

tests/idris2/ConfigStructureTest.idr (1)

1-1: LGTM!

Also applies to: 41-41

tests/idris2/Test/Spec.idr (1)

1-1: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Documentation
  • Updated SPDX licence identifiers from PMPL-1.0-or-later to MPL-2.0 across the package and associated test files.
  • Updated licence expectations in configuration validation tests to reflect the new identifier.

Walkthrough

The pull request changes SPDX identifiers from PMPL-1.0-or-later to MPL-2.0 in the package and Idris2 test files. Related test expectations now require the MPL-2.0 identifier.

Changes

Licence alignment

Layer / File(s)	Summary
Update licence identifiers and assertions ipfs-overlay-tests.ipkg, tests/idris2/*.idr, tests/idris2/Test/Spec.idr	Header comments and SPDX assertion strings now use MPL-2.0. Test coverage and behaviour remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: metadatastician

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing stray PMPL-1.0-or-later SPDX identifiers with MPL-2.0.
Description check	✅ Passed	The description directly explains the licensing mismatch, the files changed, the acceptance criteria, and the verification results.
Linked Issues check	✅ Passed	Issue #134 selects arm 1: retain MPL-2.0 and remove PMPL-1.0-or-later claims. The diff changes the package manifest and three Idris2 file headers to MPL-2.0. It also updates the related test expectati…
Out of Scope Changes check	✅ Passed	All changed lines support Issue #134. They update licence identifiers or test expectations that encode those identifiers. The diff shows no functional or unrelated configuration changes. The separate …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the licence line
MPL-2.0 now aligns
Tests repeat the same clear sign
Headers match in neat design
No hopping logic changed this time}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud