fix: repair allTake proof break; MPL-2.0 licensing; Markdown README; reconcile counts (125/68/0.4.7)

.gitattributes

@@ -58,3 +58,12 @@ Containerfile  text eol=lf
 # Lock files
 Cargo.lock  text eol=lf -diff
 flake.lock  text eol=lf -diff
+
+# GitHub Linguist — surface the JS/Deno MCP bridge (mcp-bridge/) as the
+# primary language instead of the bulky Zig FFI / generated cartridge code.
+cartridges/**   linguist-vendored
+ffi/**          linguist-vendored
+generated/**    linguist-generated
+*.adoc          linguist-documentation
+docs/**         linguist-documentation
+proofs/**       linguist-documentation

.github/settings.yml

@@ -11,7 +11,7 @@
 
 repository:
   name: "boj-server"
-  description: "BoJ (Bundle of Joy) — unified MCP server consolidating GitHub, GitLab, Cloudflare, browser automation, and 50+ open-source cartridges"
+  description: "BoJ (Bundle of Joy) — unified MCP server consolidating GitHub, GitLab, Cloudflare, browser automation, and 125 open-source cartridges"
   homepage: "https://github.com/hyperpolymath/boj-server"
   private: false
   has_issues: true

.machine_readable/contractiles/intend/Intentfile.a2ml

@@ -18,7 +18,7 @@ LLM/SLM agents: understand what this repo IS and IS NOT before acting.
 BoJ (Bundle of Joy) is a unified MCP server that consolidates all hyperpolymath
 tooling into a single endpoint. It provides Claude Code integration for GitHub,
 GitLab, Cloudflare, Vercel, Verpex, Gmail, Calendar, browser automation, research,
-ML, and 50+ open-source cartridges. It implements a three-class architecture:
+ML, and 125 open-source cartridges. It implements a three-class architecture:
 - Class 1 (Simple Track): zero-infrastructure CLI/curl workflows
 - Class 2 (Orchestrator Track): HMAC-SHA256 webhooks and real-time MQTT/WS
 - Class 3 (Multiplier Track): Elixir/BEAM mass concurrency

CITATION.cff

@@ -18,7 +18,7 @@ abstract: >-
   gateway. Each cartridge — covering databases, container runtimes, git forges,
   Kubernetes, observability, secrets, IaC, cloud providers, and multi-instance
   AI coordination — is a formally verified Idris2 ABI + Zig FFI + Deno/JS
-  adapter triple. The server exposes 115 cartridges through a unified stdio
+  adapter triple. The server exposes 125 cartridges through a unified stdio
   MCP surface plus a local REST API on port 7700. A local-coord-mcp cartridge
   provides loopback peer discovery, typed envelopes, claim/heartbeat/watchdog,
   and master/journeyman/apprentice supervision for multi-agent AI workflows.
@@ -34,5 +34,5 @@ keywords:
   - multi-agent
   - ai-coordination
 license: MPL-2.0
-version: 0.4.6
+version: 0.4.7
 date-released: "2026-04-27"

README.md

@@ -1,9 +1,9 @@
 <!--
-SPDX-License-Identifier: CC-BY-SA-4.0
+SPDX-License-Identifier: MPL-2.0
 SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 
-[![OpenSSF Best Practices](https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity)](https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/boj-server) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/hyperpolymath/boj-server/badge)](https://scorecard.dev/viewer/?uri=github.com/hyperpolymath/boj-server) [![License: MPL-2.0](https://img.shields.io/badge/License-MPL_2.0--3.0--or--later-blue.svg)](LICENSE)
+[![OpenSSF Best Practices](https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity)](https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/boj-server) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/hyperpolymath/boj-server/badge)](https://scorecard.dev/viewer/?uri=github.com/hyperpolymath/boj-server) [![License: MPL-2.0](https://img.shields.io/badge/License-MPL_2.0-blue.svg)](LICENSE)
 [![Glama MCP Server](https://glama.ai/mcp/servers/hyperpolymath/boj-server/badge)](https://glama.ai/mcp/servers/hyperpolymath/boj-server) [![Green Hosting](https://api.thegreenwebfoundation.org/greencheckimage/boj-server.net)](https://www.thegreenwebfoundation.org/green-web-check/?url=boj-server.net) [![Software Heritage](https://archive.softwareheritage.org/badge/origin/https://github.com/hyperpolymath/boj-server/)](https://archive.softwareheritage.org/browse/origin/?origin_url=https://github.com/hyperpolymath/boj-server)
 
 BoJ (Bundle of Joy) is a unified MCP server that consolidates all

ai-plugin.json

@@ -2,8 +2,8 @@
   "schema_version": "v1",
   "name_for_human": "Bundle of Joy Server",
   "name_for_model": "boj_server",
-  "description_for_human": "Cartridge-based DevOps toolkit with 115 formally verified domain cartridges spanning database, cloud, git, Kubernetes, containers, observability, secrets, IaC, ML, browser automation, communications, and research.",
-  "description_for_model": "A cartridge-based MCP server exposing 115 DevOps domain cartridges via a unified REST API. Each cartridge has a formally verified Idris2 ABI, Zig FFI bridge, and Deno/JS adapter. Domains include: database (VeriSimDB, PostgreSQL, Redis, DuckDB, MongoDB, Neo4j, ClickHouse, Turso, Supabase, Neon, ArangoDB), cloud providers (AWS, GCP, Cloudflare, Vercel, Verpex, DigitalOcean, Hetzner, Fly.io, Railway, Render, Linode), git forges (GitHub, GitLab), Kubernetes, containers, observability, secrets/vault, IaC, ML/AI (HuggingFace), browser automation (Firefox), communications (Gmail, Calendar), queues, SSG, research (academic papers), and language tooling. Use boj_menu to discover available cartridges, boj_cartridge_info to inspect a cartridge, and boj_cartridge_invoke to call operations.",
+  "description_for_human": "Cartridge-based DevOps toolkit with 125 formally verified domain cartridges spanning database, cloud, git, Kubernetes, containers, observability, secrets, IaC, ML, browser automation, communications, and research.",
+  "description_for_model": "A cartridge-based MCP server exposing 125 DevOps domain cartridges via a unified REST API. Each cartridge has a formally verified Idris2 ABI, Zig FFI bridge, and Deno/JS adapter. Domains include: database (VeriSimDB, PostgreSQL, Redis, DuckDB, MongoDB, Neo4j, ClickHouse, Turso, Supabase, Neon, ArangoDB), cloud providers (AWS, GCP, Cloudflare, Vercel, Verpex, DigitalOcean, Hetzner, Fly.io, Railway, Render, Linode), git forges (GitHub, GitLab), Kubernetes, containers, observability, secrets/vault, IaC, ML/AI (HuggingFace), browser automation (Firefox), communications (Gmail, Calendar), queues, SSG, research (academic papers), and language tooling. Use boj_menu to discover available cartridges, boj_cartridge_info to inspect a cartridge, and boj_cartridge_invoke to call operations.",
   "auth": {
     "type": "none"
   },

coord-tui/Cargo.toml

@@ -6,7 +6,7 @@ version = "0.1.0"
 edition = "2021"
 authors = ["Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"]
 description = "Rapid-setup TUI for BoJ local-coord-mcp (AI multi-instance coordination)"
-license = "AGPL-3.0-or-later"
+license = "MPL-2.0"
 
 # Architecture note: pure functions (state transitions, key dispatch) are
 # deliberately isolated so SPARK/Ada formal modules can replace them later

docs/EXPLAINME.adoc

@@ -19,7 +19,7 @@ This is the Model-Controller-Processor pattern: cartridges are pluggable service
 
 **Location**: `elixir/lib/boj_rest/catalog.ex` (Elixir GenServer cartridge discovery and initialization)
 
-**How verified**: `BojRest.Catalog` scans `cartridges/*/cartridge.json` at startup, reads tool schemas from each, and stores them in an ETS table. It validates `name`, `version`, `tools` required fields and prevents duplicate names. 115 cartridges are auto-discovered. This enables the "unified endpoint" claim: a single REST server exposes the union of all cartridges' tools without hardcoding each one.
+**How verified**: `BojRest.Catalog` scans `cartridges/*/cartridge.json` at startup, reads tool schemas from each, and stores them in an ETS table. It validates `name`, `version`, `tools` required fields and prevents duplicate names. 125 cartridges are auto-discovered. This enables the "unified endpoint" claim: a single REST server exposes the union of all cartridges' tools without hardcoding each one.
 
 **Caveat**: Auto-discovery is runtime dynamic; there is no compile-time verification that all cartridge schemas are valid JSON Schema. A malformed `cartridge.json` is silently skipped at startup. The authoritative manifest format is Nickel (closed decision `boj-cartridge-manifest-format-dd.md`); migration from JSON is future work.
 
@@ -42,15 +42,15 @@ This is the Model-Controller-Processor pattern: cartridges are pluggable service
 | gossamer, burble, ephapax, hypatia, verisimdb, typed-wasm — universal ABI/FFI pattern across the estate
 
 | *Pluggable cartridge architecture*
-| 115 cartridge directories (`cartridges/*/`), each with `abi/`, `ffi/`, `mod.js` structure; auto-discovered at startup via manifest scan
+| 125 cartridge directories (`cartridges/*/`), each with `abi/`, `ffi/`, `mod.js` structure; auto-discovered at startup via manifest scan
 | echidna (prover orchestration as cartridges), hypatia (rule composition), gitbot-fleet (bot cartridges per service)
 
 | *PanLL ReScript workspace layer*
 | `panll/` — ReScript/TEA panel framework, autowiring constraint solver, 108 panels for UI
 | idaptik (game UI panels), gossamer-powered SPAs, PanLL monorepo panels estate-wide
 
 | *panic-attack security gate*
-| Pre-commit `panic-attack assail` enforces PA001-PA025 across all 115 cartridges; security module tests cover injection, unicode bypass, SSRF
+| Pre-commit `panic-attack assail` enforces PA001-PA025 across all 125 cartridges; security module tests cover injection, unicode bypass, SSRF
 | Every RSR repo in the estate; panicbot wraps it in CI
 
 | *Elixir/BEAM + Deno runtime*
@@ -70,7 +70,7 @@ This is the Model-Controller-Processor pattern: cartridges are pluggable service
 | `elixir/lib/boj_rest/js_worker.ex` | GenServer wrapping a single Deno port; newline-delimited JSON protocol
 | `elixir/lib/boj_rest/node_key.ex` | X25519 keypair persistence; ChaCha20-Poly1305 credential decryption
 | `elixir/priv/js_pool_worker.js` | Deno-side pool worker; module cache, env isolation per request
-| `cartridges/*/` | 115 cartridge directories, each with abi/, ffi/, mod.js structure
+| `cartridges/*/` | 125 cartridge directories, each with abi/, ffi/, mod.js structure
 | `src/abi/Boj/` | Idris2 ABI definitions (Protocol, Domain, Catalogue, Safety, etc.)
 | `panll/` | ReScript/TEA panel framework for UI workspace layer
 |===

docs/developer/llm-warmup-dev.adoc

@@ -83,7 +83,7 @@ elixir/                     Elixir/BEAM REST server
   test/                     50 ExUnit tests (catalog, router, crypto, JS dispatch)
   config/                   config.exs / test.exs
 
-cartridges/                 115 cartridge directories
+cartridges/                 125 cartridge directories
   database-mcp/             Example cartridge
     abi/database-mcp.ipkg   Idris2 ABI
     abi/Database/Mcp.idr    Idris2 source
@@ -134,7 +134,7 @@ panll/src/                  PanLL panel (ReScript/TEA)
 ----
 just build            # Build all Zig FFI layers (catalogue + cartridges)
 just build-release    # Optimized build (-Doptimize=ReleaseFast)
-just run              # Start Elixir/BEAM server (REST 7700, auto-discovers 115 cartridges)
+just run              # Start Elixir/BEAM server (REST 7700, auto-discovers 125 cartridges)
 just serve            # Server + Cloudflare tunnel
 just test             # Elixir ExUnit test suite (mix test)
 just test-smoke       # Quick: typecheck core ABI + ExUnit smoke
@@ -229,7 +229,7 @@ POST /cartridge/{name}/invoke: { "tool": "...", "args": {...}, "credential_envel
 
 == Cartridge Matrix
 
-115 cartridges organized in a 2D matrix (Protocol x Domain).
+125 cartridges organized in a 2D matrix (Protocol x Domain).
 Each has: `abi/` (Idris2), `ffi/` (Zig), `mod.js` (Deno adapter).
 View status: `just matrix`
 

docs/developer/llm-warmup-user.adoc

@@ -83,7 +83,7 @@ and many more.
 | Elixir REST server (Catalog, Router, JsWorkerPool)
 
 | `cartridges/`
-| 115 cartridge directories
+| 125 cartridge directories
 
 |===
 

docs/glama/CAPABILITIES.md

@@ -13,8 +13,8 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 - **gRPC**: gRPC support for high-performance clients
 
 ### Cartridge System
-- **115 Cartridges**: Covering databases, git, cloud, comms, ML, browser, and more
-- **1041 Tools**: Specialized operations across all domains
+- **125 Cartridges**: Covering databases, git, cloud, comms, ML, browser, and more
+- **68 MCP Tools**: 45 boj_* discovery/domain tools + 23 coord_* tools; per-cartridge operations are reachable via boj_cartridge_invoke across the 125-cartridge catalogue
 - **Hot-Reloading**: Add/remove cartridges without restarting
 - **Isolation**: Each cartridge runs in its own sandbox
 

docs/glama/RESOURCES.md

@@ -44,7 +44,7 @@ Factual statements about entities with temporal validity.
 {
   "id": "obs_456",
   "entity_id": "ent_123",
-  "content": "BoJ Server supports 115 cartridges",
+  "content": "BoJ Server supports 125 cartridges",
   "source": "documentation",
   "valid_from": "2026-01-01T00:00:00Z",
   "valid_to": null,

docs/index.html

@@ -53,7 +53,7 @@ <h2>Install</h2>
 
 <h2>What It Does</h2>
 <p>BoJ (Bundle of Joy) consolidates GitHub, GitLab, Cloudflare, Vercel, Verpex,
-Gmail, Calendar, browser automation, research, ML, and 50+ open-source cartridges
+Gmail, Calendar, browser automation, research, ML, and 125 open-source cartridges
 into a single MCP server endpoint for AI assistants.</p>
 
 <h2>Capabilities</h2>

docs/quickstarts/USER.adoc

@@ -10,7 +10,7 @@ toc::[]
 
 == What is BoJ Server?
 
-Bundle of Joy (BoJ) Server is a cartridge-based MCP protocol gateway. Each cartridge (database-mcp, fleet-mcp, nesy-mcp, etc.) is a formally verified Idris2 ABI + Zig FFI + Deno/JS adapter triple. The server exposes REST (port 7700) via Elixir/BEAM with Zig FFI for `.so` cartridges and a persistent Deno worker pool for JS cartridges. 115 cartridges cover databases, clouds, messaging, CI/CD, git forges, secrets, queues, proofs, and more.
+Bundle of Joy (BoJ) Server is a cartridge-based MCP protocol gateway. Each cartridge (database-mcp, fleet-mcp, nesy-mcp, etc.) is a formally verified Idris2 ABI + Zig FFI + Deno/JS adapter triple. The server exposes REST (port 7700) via Elixir/BEAM with Zig FFI for `.so` cartridges and a persistent Deno worker pool for JS cartridges. 125 cartridges cover databases, clouds, messaging, CI/CD, git forges, secrets, queues, proofs, and more.
 
 Three-class architecture: Class 1 (simple CLI), Class 2 (orchestrator with webhooks/MQTT), Class 3 (BEAM multiplier for global scale).
 
@@ -76,7 +76,7 @@ Start the Elixir/BEAM server:
 just run
 ----
 
-This starts the BEAM application, auto-discovers all 115 cartridges, and launches the Deno worker pool for JS dispatch:
+This starts the BEAM application, auto-discovers all 125 cartridges, and launches the Deno worker pool for JS dispatch:
 
 - REST API on http://localhost:7700
 

docs/specification/openapi.yaml

@@ -11,7 +11,7 @@ openapi: 3.1.0
 
 info:
   title: BoJ Server REST API
-  version: 0.4.6
+  version: 0.4.7
   summary: Formally verified cartridge server for cloud infrastructure, databases, git, containers, and more.
   description: |
     BoJ (Bundle of Joy) Server is a cartridge-based infrastructure management

elixir/mix.exs

@@ -43,7 +43,7 @@ defmodule BojRest.MixProject do
 
   defp package do
     [
-      licenses: ["AGPL-3.0-or-later"],
+      licenses: ["MPL-2.0"],
       links: %{"GitHub" => "https://github.com/hyperpolymath/boj-server"}
     ]
   end

jsr.json

@@ -1,7 +1,7 @@
 {
   "name": "@hyperpolymath/boj-server",
   "version": "0.4.7",
-  "description": "Bundle of Joy — cartridge-based MCP server with 100 domain cartridges, formally verified (Idris2) coord core",
+  "description": "Bundle of Joy — cartridge-based MCP server with 125 domain cartridges, formally verified (Idris2) coord core",
   "license": "MPL-2.0",
   "exports": "./mcp-bridge/main.js",
   "publish": {

mcp-bridge/lib/version.js

@@ -4,4 +4,4 @@
 // Single source of truth for server version and name.
 
 export const SERVER_NAME = "boj-server";
-export const SERVER_VERSION = "0.4.2";
+export const SERVER_VERSION = "0.4.7";

mcp-bridge/main.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env -S deno run --allow-net --allow-env --allow-read
+#!/usr/bin/env node
 // SPDX-License-Identifier: MPL-2.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 //

openapi.yaml

@@ -9,11 +9,11 @@ openapi: "3.1.0"
 info:
   title: Bundle of Joy Server API
   description: |
-    Cartridge-based DevOps toolkit with 115 formally verified domain cartridges.
+    Cartridge-based DevOps toolkit with 125 formally verified domain cartridges.
     Each cartridge has an Idris2 ABI (dependent type proofs), Zig FFI bridge,
     and HTTP adapter. The REST API at port 7700 provides discovery,
     inspection, and invocation of all cartridges.
-  version: "0.4.6"
+  version: "0.4.7"
   contact:
     name: Jonathan D.A. Jewell
     email: j.d.a.jewell@open.ac.uk

package.json

@@ -1,9 +1,15 @@
 {
   "name": "@hyperpolymath/boj-server",
   "version": "0.4.7",
-  "description": "Bundle of Joy (BoJ) MCP Server — cartridge-based DevOps + multi-agent coordination toolkit with 100 domain cartridges (database, container, git, k8s, observability, secrets, IaC, multi-instance AI coord, and more). Formally verified (Idris2) core; MPL-2.0.",
-  "license": "AGPL-3.0-or-later",
+  "description": "Bundle of Joy (BoJ) MCP Server — cartridge-based DevOps + multi-agent coordination toolkit with 125 domain cartridges (database, container, git, k8s, observability, secrets, IaC, multi-instance AI coord, and more). Formally verified (Idris2) core; MPL-2.0.",
+  "license": "MPL-2.0",
   "author": "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
+  "files": [
+    "mcp-bridge/",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
   "repository": {
     "type": "git",
     "url": "https://github.com/hyperpolymath/boj-server.git"

site/.well-known/ai.txt

@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: MPL-2.0
+# ai.txt - AI interaction policy
+# See: https://site.spawning.ai/spawning-ai-txt
+
+User-Agent: *
+Disallow-Training: yes
+Disallow-Summarization: no
+Disallow-Generation: yes
+
+# This project's code is licensed under MPL-2.0.
+# AI agents may read and analyze this code for assisting contributors.
+# AI agents must NOT use this code for model training without explicit consent.
+#
+# For AI agent integration instructions, see:
+#   0-AI-MANIFEST.a2ml (universal AI entry point)
+#   AI.a2ml (Claude-specific instructions)
+#   .machine_readable/ (structured project state)

site/.well-known/humans.txt

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: MPL-2.0
+# humanstxt.org
+
+/* TEAM */
+Maintainer: Jonathan D.A. Jewell (hyperpolymath)
+Contact: j.d.a.jewell@open.ac.uk
+From: United Kingdom
+
+/* SITE */
+Last update: 2026-03-02
+Standards: RSR (Rhodium Standard Repository)
+License: MPL-2.0
+Components: Idris2 ABI, Zig FFI
+Tools: just, Podman, Guix

site/.well-known/security.txt

@@ -3,8 +3,7 @@
 # https://securitytxt.org/
 
 Contact: mailto:j.d.a.jewell@open.ac.uk
-Expires: 2026-12-31T23:59:59.000Z
+Expires: 2027-12-31T23:59:59.000Z
 Preferred-Languages: en
-Canonical: https://github.com/hyperpolymath/boj-server/.well-known/security.txt
+Canonical: https://boj-server.net/.well-known/security.txt
 Policy: https://github.com/hyperpolymath/boj-server/blob/main/SECURITY.md
-Hiring: https://github.com/hyperpolymath/boj-server/careers