docs(claude-md): License Policy — Manual Only (neurophone#99 closeout)

[hyperpolymath]

Summary

• Top-of-file ## License Policy — Manual Only (highest-priority guardrail) section in .claude/CLAUDE.md.
• Quotes the verbatim owner directive 2026-06-02 + 5-way classification table.
• Hard rules for agents: no licence-change PRs without owner approval, no bulk SPDX sweeps, no touching third-party headers, flag-only findings.
• Canonical source pointers: memory files + hypatia rule + gitbot-fleet dispatcher gate + fix-script refusal banners.

Why

Owner directive 2026-06-02 forbids automated licence/SPDX edits. Triggered by neurophone#99 — an auto-generated PR by the Claude bot reverting PMPL-1.0-or-later → MPL-2.0 across ~140 files, closed by the owner. The CLAUDE.md guardrail makes the policy discoverable to every agent that reads project context before acting.

Verbatim:

"mpl-2.0 is for my sole repos, all rights reserved is for 007, agpl-3.0-or-later is for those shared with my son, and leave other people's forked stuff alone … only palimpsest license for obvious reasons should be talking about palipsest and palimpsest plasma, and consent-aware-http, but in that case prospectively"

Test plan

• Section renders correctly at the top of .claude/CLAUDE.md.
• Five-way classification table is intact and readable.
• Cross-references to gitbot-fleet/hypatia PRs land alongside this one.

Related: hyperpolymath/gitbot-fleet chore/halt-license-auto-prs, hyperpolymath/hypatia rules/license-no-auto-fix.

[github-actions]

🔍 Hypatia Security Scan

Findings: 201 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	94

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action  (for the check script)\n        uses: actions/checkout@de needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action  (for the check script)\n        uses: actions/checkout@de needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence