You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Grouped licence/metadata debt found in the 2026-08-07 audit. None of it is urgent; all of it is cheap.
Licence
3 workflows still stamped PMPL-1.0-or-later — governance.yml:1, hypatia-scan.yml:1, scorecard.yml:1. The repo ships a fixer for exactly this (scripts/fix-scripts/fix-pmpl-drift.sh) and has never run it on itself. A dogfooding gap.
guix.scm:37 declares (license #f) while its own SPDX header (line 1) says MPL-2.0, and every other manifest declares MPL-2.0.
No REUSE compliance.LICENSES/ exists but there is no .reuse/dep5, and reuse appears in no workflow, the Justfile, or .pre-commit-config.yaml. LICENSES/AGPL-3.0-or-later.txt is dead weight — no file in the tree declares AGPL — and reuse lint would flag it as unused.
3 source files lack an SPDX header entirely — integration/fixtures/test-repo/src/main.rs, test/test_helper.exs, test_integration.exs. (Coverage is otherwise excellent: 355 of 358 tracked source files carry one at line 1.)
16 .md/.adoc files lack a header, and .github/TEST_CI_CODEQL_HYPATIA.md is a lone MPL-2.0 outlier among CC-BY-SA-4.0 docs.
#417 is stale-open and should be closed — all 8 manifests it names now read license = "MPL-2.0", fixed by 4d2a516 (#552).
NOTICE was the serious one (it described "the Palimpsest License (MPL-2.0)" as "a philosophical extension of the Mozilla Public License 2.0" and cited "PMPL Section 6" of a text not in the repo). Already fixed in the 2026-08-07 docs pass.
Metadata
No CITATION.cff and no codemeta.json, despite a 71 KB academic paper (arcvix-neurosymbolic-ci-intelligence.tex) living in the repo. For a project that publishes, CITATION.cff is the cheapest possible win.
mise.toml mandates a Python/JS toolchain in a Python-banned estate — declares python, pip, black, isort, ruff, pytest, jest, vitest, sets PYTHONDONTWRITEBYTECODE/PYTHONUNBUFFERED, and aliases lint = "ruff check . || prettier … || black …". This is the last surviving Python surface after fix(WF017): recognise the raw env-mapping secret gate #687 deleted resolve.py, and unlike a stray file it is the policy layer. mise itself warns most of these are unresolvable. May belong with PR chore(governance): declare the banned-language migration backlog #686.
mix hypatia.rsr_score cannot find its own SSOT by default — lib/mix/tasks/hypatia.rsr_score.ex:65-67 resolves via :code.priv_dir/1, landing inside _build, so the bare command fails with :enoent. Its own docstring calls it "the CLI the template dogfood gate and estate corpus run both call". Workaround: pass --ssot test/fixtures/a2ml/rsr-criteria-v2.a2ml.
The descriptiles are in the wrong directory per Hypatia's own oracle. RSR v2.0 criteria 3.1.1-3.1.9 require .machine_readable/descriptiles/; the files live in .machine_readable/6a2/. mix hypatia.rsr_score scores this as 10 failures (tier=none score=65.76%), and test/rules/rsr_conformance_test.exs:290 already asserts it as a known deviation.
Evidence for all of the above: docs/DEBT-REGISTER.md (L-2 to L-6, M-1, M-3, M-7, B-1).
Grouped licence/metadata debt found in the 2026-08-07 audit. None of it is urgent; all of it is cheap.
Licence
PMPL-1.0-or-later—governance.yml:1,hypatia-scan.yml:1,scorecard.yml:1. The repo ships a fixer for exactly this (scripts/fix-scripts/fix-pmpl-drift.sh) and has never run it on itself. A dogfooding gap.guix.scm:37declares(license #f)while its own SPDX header (line 1) says MPL-2.0, and every other manifest declares MPL-2.0.LICENSES/exists but there is no.reuse/dep5, andreuseappears in no workflow, theJustfile, or.pre-commit-config.yaml.LICENSES/AGPL-3.0-or-later.txtis dead weight — no file in the tree declares AGPL — andreuse lintwould flag it as unused.integration/fixtures/test-repo/src/main.rs,test/test_helper.exs,test_integration.exs. (Coverage is otherwise excellent: 355 of 358 tracked source files carry one at line 1.).md/.adocfiles lack a header, and.github/TEST_CI_CODEQL_HYPATIA.mdis a lone MPL-2.0 outlier among CC-BY-SA-4.0 docs.#417 is stale-open and should be closed — all 8 manifests it names now read
license = "MPL-2.0", fixed by4d2a516(#552).NOTICEwas the serious one (it described "the Palimpsest License (MPL-2.0)" as "a philosophical extension of the Mozilla Public License 2.0" and cited "PMPL Section 6" of a text not in the repo). Already fixed in the 2026-08-07 docs pass.Metadata
CITATION.cffand nocodemeta.json, despite a 71 KB academic paper (arcvix-neurosymbolic-ci-intelligence.tex) living in the repo. For a project that publishes,CITATION.cffis the cheapest possible win.mise.tomlmandates a Python/JS toolchain in a Python-banned estate — declarespython,pip,black,isort,ruff,pytest,jest,vitest, setsPYTHONDONTWRITEBYTECODE/PYTHONUNBUFFERED, and aliaseslint = "ruff check . || prettier … || black …". This is the last surviving Python surface after fix(WF017): recognise the raw env-mapping secret gate #687 deletedresolve.py, and unlike a stray file it is the policy layer.miseitself warns most of these are unresolvable. May belong with PR chore(governance): declare the banned-language migration backlog #686.mix hypatia.rsr_scorecannot find its own SSOT by default —lib/mix/tasks/hypatia.rsr_score.ex:65-67resolves via:code.priv_dir/1, landing inside_build, so the bare command fails with:enoent. Its own docstring calls it "the CLI the template dogfood gate and estate corpus run both call". Workaround: pass--ssot test/fixtures/a2ml/rsr-criteria-v2.a2ml..machine_readable/descriptiles/; the files live in.machine_readable/6a2/.mix hypatia.rsr_scorescores this as 10 failures (tier=none score=65.76%), andtest/rules/rsr_conformance_test.exs:290already asserts it as a known deviation.Evidence for all of the above:
docs/DEBT-REGISTER.md(L-2 to L-6, M-1, M-3, M-7, B-1).