hyperpolymath · hyperpolymath · Jun 21, 2026 · Jun 5, 2026 · Jun 5, 2026 · Jun 13, 2026
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -6,6 +6,7 @@ labels: 'bug, priority: unset, triage'
 assignees: ''
 
 ---
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 
 **Describe the bug**
 A clear and concise description of what the bug is.

diff --git a/.github/ISSUE_TEMPLATE/custom.md b/.github/ISSUE_TEMPLATE/custom.md
@@ -6,5 +6,6 @@ labels: ''
 assignees: ''
 
 ---
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 
 
diff --git a/.github/ISSUE_TEMPLATE/documentation.md b/.github/ISSUE_TEMPLATE/documentation.md
@@ -6,6 +6,7 @@ labels: 'documentation, priority: unset, triage'
 assignees: ''
 
 ---
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 
 name: Documentation
 description: Report unclear, missing, or incorrect documentation

diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -6,6 +6,7 @@ labels: 'enhancement, priority: unset, triage'
 assignees: ''
 
 ---
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 
 **Is your feature request related to a problem? Please describe.**
 A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

diff --git a/.github/ISSUE_TEMPLATE/question.md b/.github/ISSUE_TEMPLATE/question.md
@@ -6,6 +6,7 @@ labels: question, triage
 assignees: ''
 
 ---
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 
 name: Question
 description: Ask a question about usage or behaviour

diff --git a/.github/copilot/coding-agent.yml b/.github/copilot/coding-agent.yml
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 mcp_servers:
   boj-server:
     command: npx

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e
diff --git a/.machine_readable/anchors/ANCHOR.a2ml b/.machine_readable/anchors/ANCHOR.a2ml
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 # ⚓ ANCHOR: stapeln
 # This is the canonical authority for the stapeln repository.
 

diff --git a/.machine_readable/svc/README.adoc b/.machine_readable/svc/README.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MPL-2.0
 = `.machine_readable/svc/` — Service components for stapeln
 :toc:
 

diff --git a/ABI-FFI-README.md b/ABI-FFI-README.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Stapeln ABI/FFI
 
 Stapeln uses this boundary model:

diff --git a/ACCESSIBILITY.md b/ACCESSIBILITY.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Accessibility Standards for stackur
 
 ## WCAG 2.3 AAA Compliance

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Architecture
 
 ## Overview

diff --git a/ATTACK-SURFACE-GAPS.md b/ATTACK-SURFACE-GAPS.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Attack Surface Gap Analysis: stapeln Ecosystem
 
 **Question**: "Are there any points on the attack surface that we should build to ensure it is super sealed?"

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Code of Conduct
 
 <!-- 

diff --git a/CONTAINER-HATER-TEST.md b/CONTAINER-HATER-TEST.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Converting Container Haters: The Ultimate Test
 
 ## The Challenge

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Clone the repository
 git clone https://github.com/hyperpolymath/stapeln.git
 cd stapeln

diff --git a/DATABASE-AND-DOCS-INTEGRATION.md b/DATABASE-AND-DOCS-INTEGRATION.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Database & Document Integration
 
 ## Three Hyperpolymath Components

diff --git a/FIREWALL-CONFIG.md b/FIREWALL-CONFIG.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Firewall Configuration & Security
 
 **Status**: Design specification for OWASP-compliant firewall with ephemeral pinholes

diff --git a/IMPLEMENTATION-PLAN.md b/IMPLEMENTATION-PLAN.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Legacy Implementation Plan (Archive)
 
 > Status: archival reference only.

diff --git a/LAGO-GREY-INTEGRATION.md b/LAGO-GREY-INTEGRATION.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Lago Grey Integration: Base Image Designer
 
 **Status**: Design specification for integrating lago-grey as base image component

diff --git a/OBVIOUS-VULNERABILITIES.md b/OBVIOUS-VULNERABILITIES.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Obvious Vulnerabilities: Fix These First
 
 **Question**: "Can you see anything obvious though now?"

diff --git a/PAGES.md b/PAGES.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Multi-Page Architecture
 
 ## Overview

diff --git a/PROVEN-LIBRARIES.md b/PROVEN-LIBRARIES.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Proven Libraries (Extracted)
 
 The proven library workstream (Idris2 → Zig → ReScript DOM‑mounter) has been extracted.

diff --git a/README.adoc b/README.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MPL-2.0
 = stapeln
 :toc: left
 :toclevels: 3

diff --git a/RED-TEAM-EXERCISE.md b/RED-TEAM-EXERCISE.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Red Team Exercise: "Destroy stapeln in 2 Seconds"
 
 **Attacker Profile**: Government cyberwar officer who loathes containers

diff --git a/REKOR.md b/REKOR.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Rekor Integration in stapeln
 
 ## What is Rekor?

diff --git a/RSR_OUTLINE.adoc b/RSR_OUTLINE.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MPL-2.0
 = RSR Template Repository
 
 image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"]

diff --git a/SECURITY-REASONING-ENGINE.md b/SECURITY-REASONING-ENGINE.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Security Reasoning Engine: miniKanren vs SLM
 
 **Decision**: Use miniKanren for deterministic rule reasoning, NOT an SLM

diff --git a/SECURITY-STACK-AUDIT.md b/SECURITY-STACK-AUDIT.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Security Stack Audit: stapeln Ecosystem Compliance
 
 ## Executive Summary

diff --git a/SECURITY.md b/SECURITY.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Security Policy
 
 <!-- 

diff --git a/SESSION-PICKUP-2026-03-21.md b/SESSION-PICKUP-2026-03-21.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Session Pickup — 2026-03-21
 
 ## What was done today

diff --git a/SESSION-SUMMARY-2026-02-05.md b/SESSION-SUMMARY-2026-02-05.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Development Session Summary
 **Date**: 2026-02-05
 **Session Focus**: Phase 2 Frontend Implementation

diff --git a/SETUP.md b/SETUP.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Setup Guide
 
 ## Installation (No npm/Node.js!)

diff --git a/STATUS.md b/STATUS.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Status (Source of Truth)
 
 **Date:** 2026-03-29

diff --git a/TEST-NEEDS.md b/TEST-NEEDS.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # TEST-NEEDS: stapeln
 
 ## CRG Grade: C — ACHIEVED 2026-04-04

diff --git a/UI-MOCKUPS.md b/UI-MOCKUPS.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Visual UI Mockups: "Spaceship Customizer" Style
 
 **Design Philosophy**: Like customizing a spaceship in a game - choose components, see stats update in real-time, get warnings about vulnerabilities

diff --git a/UX-MANIFESTO.md b/UX-MANIFESTO.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln UX Manifesto: "Containers for People Who Hate Containers"
 
 ## Core Principle

diff --git a/VERIFICATION-SPEC.md b/VERIFICATION-SPEC.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # stapeln Formal Verification Specification
 
 ## Overview

diff --git a/backend/.formatter.exs b/backend/.formatter.exs
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 [
   import_deps: [:phoenix],
   inputs: ["*.{ex,exs}", "{config,lib,test}/**/*.{ex,exs}"]

diff --git a/backend/AGENTS.md b/backend/AGENTS.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 This is a web application written using the Phoenix web framework.
 
 ## Project guidelines

diff --git a/backend/README.md b/backend/README.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 # Stapeln
 
 To start your Phoenix server:

diff --git a/backend/config/dev.exs b/backend/config/dev.exs
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 import Config
 
 # For development, we disable any cache and enable

diff --git a/backend/config/prod.exs b/backend/config/prod.exs
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 import Config
 
 # Force using SSL in production. This also sets the "strict-security-transport" header,

diff --git a/backend/config/runtime.exs b/backend/config/runtime.exs
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 import Config
 
 # config/runtime.exs is executed for all environments, including

diff --git a/backend/lib/stapeln.ex b/backend/lib/stapeln.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule Stapeln do
   @moduledoc """
   Stapeln keeps the contexts that define your domain

diff --git a/backend/lib/stapeln/auth/api_token.ex b/backend/lib/stapeln/auth/api_token.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule Stapeln.Auth.ApiToken do
   @moduledoc false
 

diff --git a/backend/lib/stapeln/security.ex b/backend/lib/stapeln/security.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule Stapeln.Security do
   @moduledoc """
   Entry point for security-specific controllers and helpers.

diff --git a/backend/lib/stapeln/security/panic_attacker.ex b/backend/lib/stapeln/security/panic_attacker.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule Stapeln.Security.PanicAttacker do
   @moduledoc """
   Supervises panic-attack invocations and exposes trace/timeline state to the security UI.

diff --git a/backend/lib/stapeln/stack_store.ex b/backend/lib/stapeln/stack_store.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule Stapeln.StackStore do
   @moduledoc """
   In-memory stack persistence for API operations.

diff --git a/backend/lib/stapeln/stacks.ex b/backend/lib/stapeln/stacks.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule Stapeln.Stacks do
   @moduledoc """
   Stack API context.

diff --git a/backend/lib/stapeln_grpc/create_stack_request.ex b/backend/lib/stapeln_grpc/create_stack_request.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.CreateStackRequest do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/endpoint.ex b/backend/lib/stapeln_grpc/endpoint.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.Endpoint do
   @moduledoc false
   use GRPC.Endpoint

diff --git a/backend/lib/stapeln_grpc/finding_payload.ex b/backend/lib/stapeln_grpc/finding_payload.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.FindingPayload do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/get_stack_request.ex b/backend/lib/stapeln_grpc/get_stack_request.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.GetStackRequest do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/list_stacks_request.ex b/backend/lib/stapeln_grpc/list_stacks_request.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.ListStacksRequest do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/list_stacks_response.ex b/backend/lib/stapeln_grpc/list_stacks_response.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.ListStacksResponse do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/service_payload.ex b/backend/lib/stapeln_grpc/service_payload.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.ServicePayload do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/stack_payload.ex b/backend/lib/stapeln_grpc/stack_payload.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.StackPayload do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/stack_response.ex b/backend/lib/stapeln_grpc/stack_response.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.StackResponse do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/stack_service/server.ex b/backend/lib/stapeln_grpc/stack_service/server.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.StackService.Server do
   @moduledoc false
   use GRPC.Server, service: StapelnGrpc.StackService.Service

diff --git a/backend/lib/stapeln_grpc/stack_service/service.ex b/backend/lib/stapeln_grpc/stack_service/service.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.StackService.Service do
   @moduledoc false
   use GRPC.Service, name: "stapeln.StackService"

diff --git a/backend/lib/stapeln_grpc/stack_service/stub.ex b/backend/lib/stapeln_grpc/stack_service/stub.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.StackService.Stub do
   @moduledoc false
   use GRPC.Stub, service: StapelnGrpc.StackService.Service

diff --git a/backend/lib/stapeln_grpc/update_stack_request.ex b/backend/lib/stapeln_grpc/update_stack_request.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.UpdateStackRequest do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/validate_stack_request.ex b/backend/lib/stapeln_grpc/validate_stack_request.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.ValidateStackRequest do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_grpc/validate_stack_response.ex b/backend/lib/stapeln_grpc/validate_stack_response.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnGrpc.ValidateStackResponse do
   @moduledoc false
   use Protobuf, syntax: :proto3

diff --git a/backend/lib/stapeln_web.ex b/backend/lib/stapeln_web.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb do
   @moduledoc """
   The entrypoint for defining your web interface, such

diff --git a/backend/lib/stapeln_web/controllers/error_json.ex b/backend/lib/stapeln_web/controllers/error_json.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb.ErrorJSON do
   @moduledoc """
   This module is invoked by your endpoint in case of errors on JSON requests.

diff --git a/backend/lib/stapeln_web/controllers/health_controller.ex b/backend/lib/stapeln_web/controllers/health_controller.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb.HealthController do
   use StapelnWeb, :controller
 

diff --git a/backend/lib/stapeln_web/controllers/security_controller.ex b/backend/lib/stapeln_web/controllers/security_controller.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb.SecurityController do
   use StapelnWeb, :controller
 

diff --git a/backend/lib/stapeln_web/controllers/stack_controller.ex b/backend/lib/stapeln_web/controllers/stack_controller.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb.StackController do
   use StapelnWeb, :controller
 

diff --git a/backend/lib/stapeln_web/endpoint.ex b/backend/lib/stapeln_web/endpoint.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb.Endpoint do
   use Phoenix.Endpoint, otp_app: :stapeln
 

diff --git a/backend/lib/stapeln_web/gettext.ex b/backend/lib/stapeln_web/gettext.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb.Gettext do
   @moduledoc """
   A module providing Internationalization with a gettext-based API.

diff --git a/backend/lib/stapeln_web/plugs/require_api_token.ex b/backend/lib/stapeln_web/plugs/require_api_token.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb.Plugs.RequireApiToken do
   @moduledoc false
 

diff --git a/backend/lib/stapeln_web/router.ex b/backend/lib/stapeln_web/router.ex
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 defmodule StapelnWeb.Router do
   use StapelnWeb, :router
Original file line number	Diff line number	Diff line change
Expand Up		@@ -6,5 +6,6 @@ labels: ''
		assignees: ''

		---
		<!-- SPDX-License-Identifier: MPL-2.0 -->
-Original file line number
+Diff line change
@@ Expand Up / @@ -16,4 +16,4 @@ permissions: @@
     jobs:
       scan:
-        uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20
+        uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e