feat(governance): advisory scan for retired-estate SPDX headers (pmpl-sweep runbook alignment)

[hyperpolymath]

Why

check-licence-consistency.sh cross-checks the LICENSE identity against the
first build manifest only. Stray SPDX identifiers in ordinary source files
are invisible to it — that is exactly how
hyperpolymath/ipfs-overlay#134
hid: one .ipkg tripped the gate while three .idr files sat on
PMPL-1.0-or-later unseen (two of them carrying assertions that could never
pass). A tree-wide view of SPDX headers would have surfaced all four at seed
time.

What this adds

A section (6) to check-licence-consistency.sh: a tree-wide scan of
SPDX-License-Identifier: header lines for retired estate identifiers
(PMPL-1.0*, MPL-1.0*, MPL-1.1).

Design follows docs/migrations/pmpl-to-mpl-sweep-runbook.adoc:

• WARN-level only — estate policy is "every licence edit is per-file,
  owner-approval-gated, and NEVER a bulk SPDX sweep." This surfaces drift for
  filing as issues; it never blocks CI. (Same spirit that produced [P2] ephapax: 11 partial + add ABI seam (Rust/SPARK NON-COMPLIANT) #134: a
  surfaced finding becomes an issue with acceptance criteria.)
• Anchored match — a hit must be a comment-line SPDX header (optional
  comment marker, then the identifier). Badges, prose and test fixtures that
  merely quote the string in mid-line cannot match. An ERROR-level, unanchored
  first draft was rejected after testing: it failed palimpsest-license
  (126 legitimate PMPL files) and standards itself (runbook prose + a test
  fixture).
• Carve-out repos skipped — palimpsest-license, palimpsest-plasma,
  007 (via GITHUB_REPOSITORY or git remote): PMPL/ARR is correct there
  (runbook §1, §3).
• Licence-exhibit paths excluded — LICENSES/, legal/, exhibits/,
  PMPL-SPEC* (runbook §3).

Non-invasive by construction

• The ERROR path and all exit codes are untouched. On a passing tree the only
  output change is one added [OK] line.
• shellcheck -S warning: clean (same as the original).
• No test asserts this script's output; it is only invoked from
  governance-reusable.yml.

Proof matrix (all runs 2026-09-20)

Scenario	Result
ipfs-overlay@8176606 (pre-fix)	exit 1 (existing manifest ERROR unchanged) + WARN naming exactly the 4 stray files, incl. the 3 the old check could not see
ipfs-overlay fix branch (merged as #141)	exit 0, No stray retired-estate SPDX headers
standards@main tree	exit 0 — runbook prose & test fixture do not match the anchored pattern; behaviour diff vs original = one added OK line
palimpsest-license	carve-out detected via git remote, advisory skipped, exit 0

Surfaced from hyperpolymath/ipfs-overlay#134.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 837d02db-a0a4-4994-8586-b14f3df320aa

📥 Commits

Reviewing files that changed from the base of the PR and between e13e2ea and 296d270.

📒 Files selected for processing (1)

• scripts/check-licence-consistency.sh

 ________________________________________
< My other transformer is Optimus Prime. >
 ----------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud