docs: declare MPL-2.0 + CC-BY-SA-4.0 standard licence; de-drift CLAUDE.md

[hyperpolymath]

Summary

Two owner-directed follow-ups from the post-#55 discussion:

1. Make the dual licence the explicit standard — MPL-2.0 (code) + CC-BY-SA-4.0 (docs), with MPL-2.0 holding the GitHub marker.
2. De-drift .claude/CLAUDE.md — re-sync to the canonical estate policy (Hypatia SD007).

No source code touched; docs/metadata only. No file SPDX headers were swept (per the no-bulk-SPDX / neurophone#99 guardrail).

1 — Licensing standard

• LICENSING.adoc (new, root) — the authoritative declaration, mirroring the estate LICENCE-POLICY.adoc: two SPDX identifiers in normal use (MPL-2.0 for code/config/scripts/build/metadata/specs; CC-BY-SA-4.0 for prose docs), one per file by class. Documents that the root LICENSE carries the MPL-2.0 text as the single licence GitHub detects (community-health / "git health" marker), the file-class mapping, and the exclusion cases.
• .machine_readable/licensing-policy.toml (new) — machine-readable twin (tools enforce from the TOML; the .adoc is the source of truth).
• README.adoc — licensing section now points at LICENSING.adoc and notes the MPL-2.0 GitHub marker.
• root-allow.txt — admits LICENSING.adoc as an authority file.
• Already correct: root LICENSE = MPL-2.0; LICENSES/{MPL-2.0,CC-BY-SA-4.0}.txt present.

⚠️ Flagged for your decision (not swept)

The census found two sets of files that deviate from the standard. Per the guardrail these are owner-only, manual — I did not touch them:

Files	Current	Question
academic/formal-verification/{agda/*.agda, coq/Phronesis.v, lean4/Phronesis.lean, lean4/lakefile.lean} (5)	Apache-2.0	Keep (Lean/Coq/Agda ecosystem convention) or normalise to MPL-2.0?
.github/workflows/{scorecard.yml, secret-scanner.yml} (2)	PMPL-1.0	Drift — Phronesis isn't a Palimpsest carve-out repo. Flip to MPL-2.0? (PMPL flips are owner-only.)

2 — CLAUDE.md de-drift

.claude/CLAUDE.md is now byte-identical to the canonical hyperpolymath/standards .claude/CLAUDE.md, pulling in what the divergent copy was missing: the five-way License Policy guardrail, the full language table (Rust/SPARK, Zig, Idris2, Agda, Gleam, Elixir…), the V-lang/ATS2/ReScript/Python bans, the Mustfile build system, and the TS/ReScript/npm/JS exemption tables.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AqMopxUsgu78rg5fhWBUkk

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 6 issues detected

Severity	Count
🔴 Critical	0
🟠 High	3
🟡 Medium	3

View findings

[
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/phronesis/phronesis/lib/phronesis/compiler.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in phronesis: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/phronesis/phronesis",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 7 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/scorecard/StaticAnalysis -- Hypatia scorecard: StaticAnalysis -- 1 day(s) old",
    "type": "CSA001",
    "file": "phronesis",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_safety/elixir_send_unsanitised -- Hypatia code_safety: elixir_send_unsanitised -- 9 day(s) old [STALE]",
    "type": "CSA001",
    "file": "lib/phronesis/compiler.ex",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code-scanning alert hypatia/code_safety/elixir_send_unsanitised (high) at lib/phronesis/compiler.ex is 9 days old (threshold: 7 days) -- overdue for remediation",
    "type": "CSA003",
    "file": "lib/phronesis/compiler.ex",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence