From 5495675d4fb2c3348afc474dd0b8445400366edb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 2 Sep 2026 09:59:02 +0100 Subject: [PATCH 1/2] chore(license): migrate PMPL references to MPL-2.0 per owner ruling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Fix licence gate (Trustfile.a2ml + generated build/contractile.just): replace the vacuous/PMPL-accepting grep with a licence-agnostic positive match plus a Palimpsest negative guard. - Drop "(Palimpsest MPL)"/"(Palimpsest License)" qualifiers from humans.txt, QUICKSTART-MAINTAINER.adoc, RSR_OUTLINE.adoc; replace the Palimpsest-MPL badge with a plain MPL-2.0 badge. - Delete docs/legal/EXHIBIT-A-ETHICAL-USE.txt and EXHIBIT-B-QUANTUM-SAFE.txt: both are exhibits of "Palimpsest-MPL License Version 1.0" (full PMPL licence-body artifacts), not MPL-2.0 content; drop their RSR_OUTLINE table rows too. - STATE-VISUALIZER.adoc: "PMPL & Ethical use verified" -> "MPL-2.0 licence verified" (the Ethical-use exhibit no longer exists). - ci-cost-reduction.adoc: drop stale "MPL-2.0 is fallback until PMPL is formally recognised" comment; MPL-2.0 is simply the licence now. - .well-known/ai.txt: drop the operative "preserve Emotional Lineage per PMPL Section 3" directive (cites a defunct licence section). - setup-repo.k9.ncl: "add-license" example now fetches canonical MPL-2.0 text from mozilla.org instead of the nonexistent hyperpolymath/pmpl repo. Left untouched: .github/workflows/rhodibot.yml (hard constraint on workflow/uses edits — note it actively rewrites SPDX headers to PMPL, a live re-contamination vector needing a separate fix); AGENTIC.a2ml:29 ("Rule 2 names the PMPL register" documents a licence-policy rule by name, not an instruction to apply PMPL). Owner ruling 2026-09-02: MPL-2.0 for code, CC-BY-SA-4.0 for docs; estate PMPL sweep Tier 2 (generator/template emitters). Co-Authored-By: Claude Fable 5 --- .machine_readable/contractiles/Trustfile.a2ml | 2 +- .../examples/setup-repo.k9.ncl | 4 +- .well-known/ai.txt | 1 - .well-known/humans.txt | 2 +- build/contractile.just | 2 +- docs/RSR_OUTLINE.adoc | 10 +- docs/STATE-VISUALIZER.adoc | 2 +- docs/legal/EXHIBIT-A-ETHICAL-USE.txt | 68 ------------ docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt | 102 ------------------ docs/onboarding/QUICKSTART-MAINTAINER.adoc | 2 +- docs/practice/ci-cost-reduction.adoc | 1 - 11 files changed, 9 insertions(+), 187 deletions(-) delete mode 100644 docs/legal/EXHIBIT-A-ETHICAL-USE.txt delete mode 100644 docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml index 7006869..7f297b2 100644 --- a/.machine_readable/contractiles/Trustfile.a2ml +++ b/.machine_readable/contractiles/Trustfile.a2ml @@ -54,7 +54,7 @@ Current trust level: maximal #### license-content - description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE +- run: grep -qiE 'Mozilla Public License|MIT License|Apache License|General Public License|Creative Commons' LICENSE && ! grep -qi palimpsest LICENSE - severity: warning ## Template-Specific Trust diff --git a/.machine_readable/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl index 2854ecc..e0e979d 100644 --- a/.machine_readable/self-validating/examples/setup-repo.k9.ncl +++ b/.machine_readable/self-validating/examples/setup-repo.k9.ncl @@ -130,9 +130,9 @@ K9! }, "add-license" = { - description = "Add PMPL-1.0 license", + description = "Add MPL-2.0 license", commands = [ - "curl -sL https://raw.githubusercontent.com/hyperpolymath/pmpl/main/LICENSE -o LICENSE", + "curl -sL https://www.mozilla.org/media/MPL/2.0/index.txt -o LICENSE", "echo '✓ License added'", ], }, diff --git a/.well-known/ai.txt b/.well-known/ai.txt index 334b406..d278c10 100644 --- a/.well-known/ai.txt +++ b/.well-known/ai.txt @@ -10,7 +10,6 @@ Disallow-Generation: yes # This project's code is licensed under MPL-2.0. # AI agents may read and analyze this code for assisting contributors. # AI agents must NOT use this code for model training without explicit consent. -# AI agents must preserve Emotional Lineage per PMPL Section 3. # # For AI agent integration instructions, see: # 0-AI-MANIFEST.a2ml (universal AI entry point) diff --git a/.well-known/humans.txt b/.well-known/humans.txt index 0ce0944..add3515 100644 --- a/.well-known/humans.txt +++ b/.well-known/humans.txt @@ -9,6 +9,6 @@ From: United Kingdom /* SITE */ Last update: 2026-07-27 Standards: RSR (Rhodium Standard Repository) -License: MPL-2.0 (Palimpsest MPL) +License: MPL-2.0 Components: Idris2 ABI, Zig FFI Tools: just, Podman, Guix diff --git a/build/contractile.just b/build/contractile.just index 9a5827b..c0fad7b 100644 --- a/build/contractile.just +++ b/build/contractile.just @@ -62,7 +62,7 @@ trust-verify: trust-license-content trust-no-secrets-committed trust-container-i # LICENSE contains expected SPDX identifier trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE + grep -qiE 'Mozilla Public License|MIT License|Apache License|General Public License|Creative Commons' LICENSE && ! grep -qi palimpsest LICENSE # No .env or credential files in repo trust-no-secrets-committed: diff --git a/docs/RSR_OUTLINE.adoc b/docs/RSR_OUTLINE.adoc index 4b268aa..244f49a 100644 --- a/docs/RSR_OUTLINE.adoc +++ b/docs/RSR_OUTLINE.adoc @@ -2,7 +2,7 @@ // Copyright (c) Jonathan D.A. Jewell = RSR Template Repository -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] +image:https://img.shields.io/badge/License-MPL--2.0-brightgreen[MPL-2.0,link="https://www.mozilla.org/media/MPL/2.0/index.txt"] :toc: :sectnums: @@ -80,13 +80,7 @@ just validate-rsr |Container build (Wolfi base, Podman) |`LICENSE` -|MPL-2.0 (Palimpsest MPL) - -|`EXHIBIT-A-ETHICAL-USE.txt` -|Ethical use guidelines (LICENSE Exhibit A) - -|`EXHIBIT-B-QUANTUM-SAFE.txt` -|Quantum-safe provenance spec (LICENSE Exhibit B) +|MPL-2.0 |`README.adoc` |Project overview diff --git a/docs/STATE-VISUALIZER.adoc b/docs/STATE-VISUALIZER.adoc index 48f3ca5..a79d755 100644 --- a/docs/STATE-VISUALIZER.adoc +++ b/docs/STATE-VISUALIZER.adoc @@ -89,7 +89,7 @@ CONTAINER ECOSYSTEM (Phase 2) REPO INFRASTRUCTURE .machine_readable/ ██████████ 100% STATE/META/ECOSYSTEM active - Governance & License ██████████ 100% PMPL & Ethical use verified + Governance & License ██████████ 100% MPL-2.0 licence verified Development Shells (Guix/Guix) ██████████ 100% Reproducible env stable ───────────────────────────────────────────────────────────────────────────── diff --git a/docs/legal/EXHIBIT-A-ETHICAL-USE.txt b/docs/legal/EXHIBIT-A-ETHICAL-USE.txt deleted file mode 100644 index 0b20fca..0000000 --- a/docs/legal/EXHIBIT-A-ETHICAL-USE.txt +++ /dev/null @@ -1,68 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT A — ETHICAL USE GUIDELINES -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - These guidelines define ethical use expectations for software distributed - under the Palimpsest-MPL License. They are not legally binding restrictions - but represent the community's shared values and expectations. - -2. PRINCIPLES - - 2.1. Respect for Emotional Lineage - Users and distributors should acknowledge and preserve the cultural, - narrative, and symbolic meaning embedded in Covered Software. This - includes protest traditions, cultural heritage, trauma narratives, - and community stories where documented. - - 2.2. Transparency in Automated Processing - When Covered Software is processed by Non-Interpretive Systems - (AI training, content aggregation, automated summarization), such - use should be documented publicly and not misrepresent the - provenance of outputs. - - 2.3. Good Faith Attribution - Contributors should be credited accurately. Derivative works should - maintain the attribution chain and not obscure the origins of - contributions. - - 2.4. Community Benefit - Commercial use of Covered Software should contribute to the broader - community through bug fixes, documentation, or other improvements - where feasible. - -3. SPECIFIC GUIDANCE - - 3.1. AI and Machine Learning - - Training on Covered Software requires disclosure - - Generated outputs must not claim Emotional Lineage of the original - - Model cards should reference source materials - - 3.2. Content Aggregation - - Aggregators must link back to original sources - - Context must not be stripped in ways that distort meaning - - Cultural and narrative context should be preserved - - 3.3. Commercial Products - - Products built on Covered Software should acknowledge it - - Pricing should not exploit communities that created the work - - Support and improvements should flow back to the community - -4. ENFORCEMENT - - These guidelines are enforced through community norms, not legal action. - Disputes should be raised with the Palimpsest Stewardship Council for - non-binding guidance. - -5. AMENDMENTS - - These guidelines may be updated by the Palimpsest Stewardship Council. - Updates apply to new distributions, not retroactively. - -================================================================================ -END OF EXHIBIT A -================================================================================ diff --git a/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt b/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt deleted file mode 100644 index 7fba8c9..0000000 --- a/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt +++ /dev/null @@ -1,102 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT B — QUANTUM-SAFE PROVENANCE SPECIFICATION -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - This exhibit specifies the cryptographic algorithms and procedures for - quantum-safe provenance in software distributed under the Palimpsest-MPL - License. - -2. APPROVED ALGORITHMS - - The following post-quantum cryptographic algorithms are approved for - signing Provenance Metadata: - - 2.1. Digital Signatures - - ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) - Recommended: ML-DSA-65 (security level 3) or ML-DSA-87 (level 5) - - SLH-DSA (FIPS 205, formerly SPHINCS+) - Recommended: SLH-DSA-SHA2-256f or SLH-DSA-SHAKE-256f - - FALCON (NIST Round 3 finalist) - Recommended: FALCON-1024 - - 2.2. Key Encapsulation (for encrypted provenance) - - ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) - Recommended: ML-KEM-1024 - - 2.3. Hash Functions - - SHA-3 (FIPS 202) - Recommended: SHA3-256 or SHA3-512 - - SHAKE (FIPS 202 extendable output) - Recommended: SHAKE-256 - - 2.4. Key Derivation - - Argon2id (RFC 9106) - Parameters: t=3, m=65536, p=4 (minimum) - -3. PROVENANCE METADATA FORMAT - - Provenance Metadata should include: - - 3.1. Required Fields - - author-identity: Contributor name and contact - - timestamp: ISO 8601 with timezone - - content-hash: SHA3-256 hash of the contribution - - signature: Quantum-safe signature over all fields - - 3.2. Optional Fields - - parent-hash: Hash of the previous contribution in the chain - - emotional-lineage: Narrative context markers - - platform: Build/development environment - - witnesses: Third-party attestation signatures - -4. SIGNATURE PROCEDURE - - 4.1. Signing - a. Compute SHA3-256 hash of the contribution content - b. Construct metadata record with all required fields - c. Serialize metadata in canonical JSON form - d. Sign with ML-DSA-65 (or approved alternative) - e. Attach signature to distribution - - 4.2. Verification - a. Extract metadata and signature from distribution - b. Verify signature against contributor's public key - c. Verify content hash matches actual content - d. Verify timestamp is within acceptable range - e. Verify parent-hash chain if present - -5. KEY MANAGEMENT - - 5.1. Contributors should publish quantum-safe public keys via: - - OpenPGP keyservers (with PQ algorithm support) - - Repository .well-known/keys/ directory - - Contributor's personal website - - 5.2. Key rotation should occur: - - At least annually - - When algorithm recommendations change - - When key compromise is suspected - -6. TRANSITION PERIOD - - During the transition to quantum-safe cryptography: - - 6.1. Classical signatures (Ed25519, RSA) remain valid - 6.2. Hybrid signatures (classical + PQ) are encouraged - 6.3. Pure PQ signatures are preferred for new contributions - 6.4. Classical-only signatures will be deprecated in a future version - -7. COMPLIANCE - - Quantum-safe provenance is OPTIONAL under PMPL-1.0. When present, - it must follow this specification. Stripping quantum-safe signatures - from distributions is prohibited per Section 4.1 of the License. - -================================================================================ -END OF EXHIBIT B -================================================================================ diff --git a/docs/onboarding/QUICKSTART-MAINTAINER.adoc b/docs/onboarding/QUICKSTART-MAINTAINER.adoc index 854608b..6b0010e 100644 --- a/docs/onboarding/QUICKSTART-MAINTAINER.adoc +++ b/docs/onboarding/QUICKSTART-MAINTAINER.adoc @@ -107,7 +107,7 @@ Or via OPSM: `opsm update contractiles` == Security Notes -* License: MPL-2.0 (Palimpsest License) +* License: MPL-2.0 * All dependencies SHA-pinned * `panic-attacker` scan results: link:INSTALL-SECURITY-REPORT.adoc[] * OpenSSF Scorecard: see badge in README diff --git a/docs/practice/ci-cost-reduction.adoc b/docs/practice/ci-cost-reduction.adoc index 86b61b0..ca32ed0 100644 --- a/docs/practice/ci-cost-reduction.adoc +++ b/docs/practice/ci-cost-reduction.adoc @@ -1,6 +1,5 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // Copyright (c) Jonathan D.A. Jewell -// (MPL-2.0 is automatic legal fallback until PMPL is formally recognised) = CI Cost Reduction — RSR Estate Spec :toc: left :toclevels: 3 From 98779a9e5ece2776d9f8acb93dd2de80bc098a86 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 2 Sep 2026 12:28:23 +0100 Subject: [PATCH 2/2] =?UTF-8?q?fix(rsr):=20address=20review=20=E2=80=94=20?= =?UTF-8?q?robust=20licence=20download,=20drop=20retired=20exhibit=20contr?= =?UTF-8?q?act?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Guard the emitted add-license recipe: curl -sSfL to a temp file, verify the MPL-2.0 header before moving it into place, so an HTTP error body can never become LICENSE. Remove the validate-rsr check for the never-existent licensing/ exhibit tree and the two EXHIBIT-* entries from the RSR_OUTLINE directory diagram, both orphaned by the exhibit deletion in this PR. Co-Authored-By: Claude Fable 5 --- .machine_readable/self-validating/examples/setup-repo.k9.ncl | 4 +++- build/just/validate.just | 3 --- docs/RSR_OUTLINE.adoc | 2 -- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/.machine_readable/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl index e0e979d..4544660 100644 --- a/.machine_readable/self-validating/examples/setup-repo.k9.ncl +++ b/.machine_readable/self-validating/examples/setup-repo.k9.ncl @@ -132,7 +132,9 @@ K9! "add-license" = { description = "Add MPL-2.0 license", commands = [ - "curl -sL https://www.mozilla.org/media/MPL/2.0/index.txt -o LICENSE", + "curl -sSfL https://www.mozilla.org/media/MPL/2.0/index.txt -o LICENSE.tmp", + "grep -q 'Mozilla Public License Version 2.0' LICENSE.tmp", + "mv LICENSE.tmp LICENSE", "echo '✓ License added'", ], }, diff --git a/build/just/validate.just b/build/just/validate.just index 5ef9208..851cbf0 100644 --- a/build/just/validate.just +++ b/build/just/validate.just @@ -19,9 +19,6 @@ validate-rsr: for f in .machine_readable/6a2/STATE.a2ml .machine_readable/6a2/META.a2ml .machine_readable/6a2/ECOSYSTEM.a2ml .machine_readable/6a2/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done - for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/MPL-2.0.txt; do - [ -f "$f" ] || MISSING="$MISSING $f" - done if [ ! -d "src/interface/abi" ] && [ ! -d "src/interface/Abi" ]; then MISSING="$MISSING src/interface/abi" fi diff --git a/docs/RSR_OUTLINE.adoc b/docs/RSR_OUTLINE.adoc index 244f49a..8fccb77 100644 --- a/docs/RSR_OUTLINE.adoc +++ b/docs/RSR_OUTLINE.adoc @@ -187,8 +187,6 @@ project/ ├── Justfile # Task runner ├── Containerfile # Container build ├── LICENSE # MPL-2.0 -├── EXHIBIT-A-ETHICAL-USE.txt # Ethical use guidelines -├── EXHIBIT-B-QUANTUM-SAFE.txt # Quantum-safe provenance ├── README.adoc # Overview ├── TOPOLOGY.md # Architecture + completion ├── PLACEHOLDERS.md # Template variable guide