Merge: relicense to MPL-2.0 + OIDC publish + socket.json (0.4.1)

hyperpolymath · hyperpolymath · commit 6f8dcc6d3bf8 · 2026-04-21T19:12:16.000+01:00
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # CODEOWNERS - Define code review assignments
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
 #
diff --git a/.github/DISCUSSION_TEMPLATE/cartridge-proposal.yml b/.github/DISCUSSION_TEMPLATE/cartridge-proposal.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 labels: [cartridge-proposal]
 body:
   - type: markdown
diff --git a/.github/DISCUSSION_TEMPLATE/hosting.yml b/.github/DISCUSSION_TEMPLATE/hosting.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 labels: [umoja-network]
 body:
   - type: markdown
diff --git a/.github/DISCUSSION_TEMPLATE/ideas.yml b/.github/DISCUSSION_TEMPLATE/ideas.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 labels: [enhancement]
 body:
   - type: markdown
diff --git a/.github/DISCUSSION_TEMPLATE/q-and-a.yml b/.github/DISCUSSION_TEMPLATE/q-and-a.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 labels: [question]
 body:
   - type: markdown
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 
diff --git a/.github/GOVERNANCE.md b/.github/GOVERNANCE.md
@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 
 # Project Governance
 
@@ -155,4 +155,4 @@ with the community before adoption, even though the BDFL retains final authority
 
 ---
 
-<sub>Copyright (c) 2026 hyperpolymath. Licensed under PMPL-1.0-or-later.</sub>
+<sub>Copyright (c) 2026 hyperpolymath. Licensed under MPL-2.0.</sub>
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Bug report issue template for hyperpolymath/boj-server
 name: Bug Report
 description: Create a report to help us improve
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Issue template chooser configuration for hyperpolymath/boj-server
 blank_issues_enabled: true
 contact_links:
diff --git a/.github/ISSUE_TEMPLATE/custom.yml b/.github/ISSUE_TEMPLATE/custom.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Custom issue template for hyperpolymath/boj-server
 name: Other
 description: Report an issue that does not fit the other categories
diff --git a/.github/ISSUE_TEMPLATE/documentation.yml b/.github/ISSUE_TEMPLATE/documentation.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Documentation issue template for hyperpolymath/boj-server
 name: Documentation
 description: Report unclear, missing, or incorrect documentation
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Feature request issue template for hyperpolymath/boj-server
 name: Feature Request
 description: Suggest an idea or enhancement for this project
diff --git a/.github/ISSUE_TEMPLATE/question.yml b/.github/ISSUE_TEMPLATE/question.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Question issue template for hyperpolymath/boj-server
 name: Question
 description: Ask a question about usage or behaviour
diff --git a/.github/MAINTAINERS b/.github/MAINTAINERS
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # MAINTAINERS - Project maintainers and contact information
 #
 # Format: Name <email> (role)
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 <!-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> -->
 <!-- Authoritative source: docs/AI-CONVENTIONS.md -->
 
@@ -11,7 +11,7 @@
 
 ## License
 
-- SPDX: `PMPL-1.0-or-later` on all new files.
+- SPDX: `MPL-2.0` on all new files.
 - Never use AGPL-3.0.
 - Copyright: `Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>`
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Dependabot configuration for RSR-compliant repositories
 # Covers common ecosystems - remove unused ones for your project
 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+<!-- SPDX-License-Identifier: MPL-2.0 -->
 ## Summary
 
 <!-- Briefly describe what this PR does and why. Link to related issues with "Closes #N". -->
@@ -32,7 +32,7 @@
 - [ ] Documentation updated for user-facing changes
 - [ ] `TOPOLOGY.md` updated (if architecture changed)
 - [ ] `CHANGELOG` or release notes updated
-- [ ] New dependencies reviewed for license compatibility (PMPL-1.0-or-later / MPL-2.0)
+- [ ] New dependencies reviewed for license compatibility (MPL-2.0 / MPL-2.0)
 - [ ] ABI/FFI changes validated (`src/abi/` and `ffi/zig/` consistent)
 
 ## Testing
diff --git a/.github/settings.yml b/.github/settings.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 #
 # Repository settings for probot/settings GitHub App.
 # https://github.com/probot/settings
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:
diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Container Publish workflow — builds and pushes the container image to
@@ -60,5 +60,5 @@ jobs:
           labels: |
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.description=Bundle of Joy MCP Server — 99 formally verified cartridges
-            org.opencontainers.image.licenses=PMPL-1.0-or-later
+            org.opencontainers.image.licenses=MPL-2.0
             org.opencontainers.image.version=${{ steps.meta.outputs.version }}
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Full test suite for BoJ Server: E2E, aspect tests, and benchmarks.
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Fuzz testing for BoJ Server FFI layer
 # Addresses OpenSSF Scorecard "Fuzzing" check
 name: Fuzz Testing
diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Guix/Nix Package Policy
 on: [push, pull_request]
 
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
 
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 
diff --git a/.github/workflows/lsp-dap-bsp.yml b/.github/workflows/lsp-dap-bsp.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # lsp-dap-bsp.yml — Dedicated CI for Language Server, Debug Adapter, and Build Server cartridges
 # Validates ABI specs, FFI builds, adapter compilation, and panel manifests
 # for the three protocol cartridges (lsp-mcp, dap-mcp, bsp-mcp).
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
 name: Mirror to Git Forges
 
diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: NPM/Bun Blocker
 on: [push, pull_request]
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Publish workflow — publishes to npm and JSR on version tag push (v*).
@@ -40,8 +40,6 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   publish-jsr:
     name: Publish to JSR
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Code Quality
 on: [push, pull_request]
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Release workflow — triggered by version tags (v*).
diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml
@@ -1,6 +1,6 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # RSR Anti-Pattern CI Check
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 #
 # Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
 # Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores
 name: OpenSSF Scorecard Enforcer
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: OSSF Scorecard
 on:
   push:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Prevention workflow - scans for hardcoded secrets before they reach main
 name: Secret Scanner
 
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Security Policy
 on: [push, pull_request]
 
diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: TypeScript/JavaScript Blocker
 on: [push, pull_request]
 
diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Well-Known Standards (RFC 9116 + RSR)
 on:
   push:
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # workflow-linter.yml - Validates GitHub workflows against RSR security standards
 # This workflow can be copied to other repos for consistent enforcement
 name: Workflow Security Linter
diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # BoJ Server — Zig FFI test & build pipeline
diff --git a/README.md b/README.md
@@ -0,0 +1,73 @@
+# boj-server
+
+[![OpenSSF Best Practices](https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity)](https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/boj-server)
+[![Glama MCP Server](https://glama.ai/mcp/servers/hyperpolymath/boj-server/badge)](https://glama.ai/mcp/servers/hyperpolymath/boj-server)
+[![Green Hosting](https://api.thegreenwebfoundation.org/greencheckimage/boj-server.net)](https://www.thegreenwebfoundation.org/green-web-check/?url=boj-server.net)
+
+BoJ (Bundle of Joy) is a unified MCP server that consolidates all hyperpolymath tooling into a single endpoint — GitHub, GitLab, Cloudflare, Vercel, Verpex, Gmail, Calendar, browser automation, research, ML, and 50+ open-source cartridges.
+
+## Install
+
+Add to Claude Code:
+
+```bash
+claude mcp add boj-server -- npx -y @hyperpolymath/boj-server@latest
+```
+
+Or clone and configure:
+
+```bash
+git clone https://github.com/hyperpolymath/boj-server
+cd boj-server/mcp-bridge && npm install
+# Start the BoJ REST API first (port 7700), then:
+claude mcp add boj-server -- node mcp-bridge/main.js
+```
+
+Glama listing: <https://glama.ai/mcp/servers/hyperpolymath/boj-server>
+
+## Features
+
+- **GitHub/GitLab** — repos, issues, PRs, code search, mirroring (22 tools)
+- **Cloud** — Cloudflare (DNS, Workers, KV, R2, D1), Vercel (deployments, projects), Verpex (cPanel)
+- **Communication** — Gmail, Google Calendar
+- **Browser** — Firefox automation: navigate, click, type, screenshot, arbitrary JS (7 tools)
+- **Code Intelligence** — CodeSeeker hybrid search + graph RAG
+- **Research** — Semantic Scholar papers, citations, authors
+- **ML** — Hugging Face model / dataset / inference
+- **Local coordination** — `local-coord-mcp` (24 tools): multi-instance AI peer discovery, typed envelopes, claim/heartbeat/watchdog, quarantine + master/journeyman/apprentice supervision, track-record affinity, capability advertisement
+- **Cartridges** — 100 pluggable cartridges across Teranga / Shield / Ayo trust tiers
+
+## Local-coord-mcp at a glance
+
+Localhost multi-agent bus on `127.0.0.1:7745`. Lets multiple Claude / Gemini / Codex / Vibe sessions on the same machine discover each other, claim tasks without collision, and operate under a supervision model (master approves; journeyman executes; apprentice stays gated).
+
+Highlights:
+
+- **Peer registration** with `client_kind`, `variant` (model id — `opus-4.7`, `flash-2.5`, `leanstral`), capability class/tier/prover-strengths — `coord_register`, `coord_set_variant`, `coord_set_capabilities`, `coord_get_peer_capabilities`.
+- **Typed envelopes** validated at the bridge via Nickel contracts (`coord-messages.ncl`) — `coord_send`, `coord_send_gated`.
+- **Task claims** with role-based watchdog TTL (apprentice 30s / journeyman 5m / master none), heartbeats via `coord_progress`, auto-release + explicit `coord_sweep_watchdog`.
+- **Track-record + reassignment** — `coord_report_outcome`, `coord_get_affinities`, `coord_scan_suggestions` (emits `overclaim` fyi + `drift` warn envelopes on confidence/affinity divergence).
+- **Supervision** — `coord_review`, `coord_approve`, `coord_reject`, `coord_promote_to_master`, `coord_transfer_master`.
+- **Observability** — `coord_health` snapshot of peer/quarantine/claim/reject state.
+
+Formally verified core in Idris2 (`cartridges/local-coord-mcp/abi/LocalCoord/`); Zig FFI; Deno/Node MCP bridge with input hardening (rate limiting, prompt-injection detection with unicode-normalisation, error sanitisation).
+
+## Glama AAA posture
+
+This server targets Glama's AAA tier. Posture:
+
+- **Inspectable** — `.mcp.json` + root `package.json` `bin` entry + shebang; offline manifest fallback so cloud inspection works without the REST backend (see `mcp-bridge/lib/offline-menu.js`).
+- **Tool Definition Quality** — every tool carries purpose, usage guidance, behavioural transparency (side effects, returns, errors), and parameter semantics with enums, ranges, and patterns. A coherence test enforces a minimum description floor so the server-level score (60% mean + 40% *min*) cannot regress — see `mcp-bridge/tests/dispatch_test.js`.
+- **Server Coherence** — one tool ↔ one verb; consistent `boj_<domain>_<action>` and `coord_<action>` naming; the same test asserts the bridge tool list matches the cartridge manifest so nothing advertised is un-dispatched (or vice versa).
+- **Security** — PR #27 hardening: rate limiting, size caps, prompt-injection detection with unicode-confusable normalisation, error sanitisation (strips paths, stack traces, env vars). SHA-pinned workflow actions.
+- **Formal** — `cartridges/local-coord-mcp/abi/LocalCoord/*.idr` Idris2 ABI + proof obligations (P-01..P-07).
+
+Run the coherence tests:
+
+```bash
+npm test
+```
+
+## License
+
+MPL-2.0 — see [LICENSE](./LICENSE).
diff --git a/jsr.json b/jsr.json
@@ -1,8 +1,8 @@
 {
   "name": "@hyperpolymath/boj-server",
-  "version": "0.4.0",
-  "description": "Bundle of Joy — cartridge-based MCP server with 53 formally verified domain cartridges",
-  "license": "PMPL-1.0-or-later",
+  "version": "0.4.1",
+  "description": "Bundle of Joy — cartridge-based MCP server with 100 domain cartridges, formally verified (Idris2) coord core",
+  "license": "MPL-2.0",
   "exports": "./mcp-bridge/main.js",
   "publish": {
     "include": ["mcp-bridge/", "LICENSE", "README.md"]
diff --git a/mcp-bridge/lib/api-clients.js b/mcp-bridge/lib/api-clients.js
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 //
 // BoJ Server — API client module
diff --git a/mcp-bridge/lib/generate-offline-menu.js b/mcp-bridge/lib/generate-offline-menu.js
@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 //
 // Generate offline-menu.js from the cartridges/ directory structure.
diff --git a/mcp-bridge/lib/logger.js b/mcp-bridge/lib/logger.js
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 //
 // BoJ Server — Structured logging module
diff --git a/mcp-bridge/lib/nickel-validator.js b/mcp-bridge/lib/nickel-validator.js
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 //
 // Nickel envelope validator — runtime check for coord_send / coord_send_gated
diff --git a/mcp-bridge/lib/nickel-validator.test.js b/mcp-bridge/lib/nickel-validator.test.js
diff --git a/mcp-bridge/lib/offline-menu.js b/mcp-bridge/lib/offline-menu.js
diff --git a/mcp-bridge/lib/security.js b/mcp-bridge/lib/security.js
diff --git a/mcp-bridge/lib/tools.js b/mcp-bridge/lib/tools.js
diff --git a/mcp-bridge/lib/version.js b/mcp-bridge/lib/version.js
diff --git a/mcp-bridge/main.js b/mcp-bridge/main.js
diff --git a/mcp-bridge/package.json b/mcp-bridge/package.json
diff --git a/mcp-bridge/tests/dispatch_test.js b/mcp-bridge/tests/dispatch_test.js
diff --git a/package.json b/package.json
diff --git a/socket.json b/socket.json

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-# SPDX-License-Identifier: PMPL-1.0-or-later`
	`1`	`+# SPDX-License-Identifier: MPL-2.0`
`2`	`2`	`# CODEOWNERS - Define code review assignments`
`3`	`3`	`# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners`
`4`	`4`	`#`