Skip to content

docs(debt): close L1 — GitHub now detects MPL-2.0 #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Aug 7, 2026
Merged

docs(debt): close L1 — GitHub now detects MPL-2.0 #61

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 20 additions & 5 deletions docs/DEBT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ the proof item — see [P1](#p1).
|---|---|---|---|
| A | Architecture — the three layers | 3 | **HIGH** |
| C | CI/CD | 3 | MEDIUM |
| L | Licence | 3 | MEDIUM |
| L | Licence | 2 | MEDIUM |
| D | Docs | 3 | MEDIUM |
| P | Proof | 2 | MEDIUM |
| K | Code | 1 | LOW |
Expand Down Expand Up @@ -128,6 +128,13 @@ startup cause — the two are independent.

**Closed when:** Scorecard produces a conclusion other than `startup_failure`.

> PR #59 proposes dropping Scorecard's `push` trigger so it runs on a schedule
> only. That is right on signal-discipline grounds — Scorecard measures the
> *repository's* posture, not the change under review — but it does **not** fix
> this finding: a scheduled run will still fail to start for whatever the
> underlying cause is. It changes when the failure is visible, not whether it
> happens.

### C3 — Two workflows fail on content. `MEDIUM`

Genuine failures, not startup problems — which means they are now doing their
Expand All @@ -154,7 +161,7 @@ verifier, and both can fail the build.

## Licence debt

### L1 — GitHub reports **no licence** for this repository. `MEDIUM`
### L1 — GitHub reported **no licence** for this repository. `RESOLVED`

`gh repo view --json licenseInfo` returns `null`, despite a 373-line MPL-2.0
`LICENSE` at the root and `license = "MPL-2.0"` in `Cargo.toml`. The repository
Expand All @@ -164,10 +171,18 @@ Cause: `LICENSE` deviates from canonical MPL-2.0 in two places — a **trailing
space** at line 38, and `http://` rather than `https://` at line 360.
`LICENSES/MPL-2.0.txt` is the clean copy.

Fixed in this change by replacing `LICENSE` with the canonical text; detection
is recomputed on push, so the API result must be re-checked after merge.
**RESOLVED 2026-08-05.** `LICENSE` was replaced with the canonical text and the
change merged to `main`; detection recomputed and now reports:

```
$ gh api repos/hyperpolymath/invariant-path/license --jq '{name:.license.spdx_id, path:.path}'
{"name":"MPL-2.0","path":"LICENSE"}
```

**Closed when:** `gh repo view --json licenseInfo` reports `MPL-2.0`.
Note for anyone re-testing this: detection **lags the push**. An immediate
`gh repo view --json licenseInfo` still returned `null` and only cleared after
a pause — long enough to look like the fix had failed. Re-check before
concluding.

### L2 — SPDX headers are not on line 1. `MEDIUM`

Expand Down
Loading