License: comprehensive PMPL residue scrub

[hyperpolymath]

Final, comprehensive pass over the remaining PMPL mentions (the "item 2" you asked me to deal with thoroughly). boj-server is MPL-2.0 (code) / CC-BY-SA-4.0 (docs). 4 files.

Scrubbed (residual PMPL on an MPL-2.0 repo)

• src/abi/Boj/Federation.idr — reworded the module doc-comment: "PMPL provenance metadata is the legal expression of attestation" → "Signed provenance metadata complements the hash attestation." Comment only — no code/logic change.
• .machine_readable/svc/self-validating/examples/setup-repo.k9.ncl — the generic repo-setup example added PMPL-1.0 to any repo (misleading, since estate default is MPL-2.0 and PMPL is only for 3 specific repos). Changed to add MPL-2.0 from the canonical mozilla.org text.
• .machine_readable/servers/menu.a2ml — attestation format = "PMPL-provenance-v1" → "boj-provenance-v1".
• .machine_readable/servers/order-ticket.a2ml — dropped "PMPL" from the provenance comment; renamed the (pmpl-provenance #t) security field to (provenance #t).

⚠️ Machine-readable identifiers — eyeball these two

menu.a2ml's format string and order-ticket.a2ml's field are protocol identifiers. Nothing else in the repo references them by name (verified), but if an external/downstream consumer keys on the old strings, revert those two hunks.

Kept on purpose (legitimate — not a licence declaration)

The pmpl-mcp cartridge + its catalogue/abi-drift entries (product about the licence), the LICENSES/README carve-out note, contractile.just's generic license-keyword grep, and the consent-aware-http "PMPL applies prospectively" note (correct estate policy).

After this, the only PMPL strings left in the tree are those legitimate references.

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

🏁 path-claims bench

Commit e96836b

Numbers

path-claims bench  (node v22.22.3)

  scenario                                              iters       ms        ns/op          ops/s
  --------------------------------------------------------------------------------------------------------------
  register: 10 active claims, 3 new paths               50000 iters    193 ms      3.87 µs/op    258.1k ops/s
  register: 100 active claims, 3 new paths              20000 iters    339 ms     16.98 µs/op     58.9k ops/s
  register: 1000 active claims, 3 new paths              5000 iters    952 ms    190.59 µs/op      5.2k ops/s
  register: 100 active claims, 20 new paths              5000 iters    362 ms     72.48 µs/op     13.8k ops/s

  pathsOverlap: deep diverge at segment 4             1000000 iters    157 ms     157.4 ns/op     6.35M ops/s
  pathsOverlap: short prefix match                    1000000 iters    135 ms     135.5 ns/op     7.38M ops/s

  refresh (existing claim)                             100000 iters     11 ms     112.0 ns/op     8.93M ops/s
  list (100 active claims)                              50000 iters    280 ms      5.61 µs/op    178.3k ops/s

  (Bench numbers depend on host; use deltas across commits, not absolute values.)

Host-dependent — compare deltas across commits, not absolute values.

[github-actions]

🔍 Hypatia Security Scan

Findings: 214 issues detected

Severity	Count
🔴 Critical	15
🟠 High	130
🟡 Medium	69

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard-enforcer.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence