License inconsistency: Cargo.toml + package.json AGPL-3.0-or-later vs LICENSE MPL-2.0

[hyperpolymath]

Gap

Root LICENSE is Mozilla Public License 2.0 but both Cargo.toml and package.json declare AGPL-3.0-or-later. Same shape as verisimdb#82.

Specifics

• Cargo.toml:20: license = "AGPL-3.0-or-later"
• package.json:20: "license": "AGPL-3.0-or-later"
• Root LICENSE: Mozilla Public License Version 2.0

Why this is filed as an issue rather than a PR

Estate memory flags panll as ask-first before sweeps (per prior owner revert of panll#60 in May 2026). License changes here need explicit owner direction even though the inconsistency is real and the fix is two lines.

Decision needed

Which way?

• Manifests → MPL-2.0 (align to LICENSE) — matches sole-owner default per estate policy
• LICENSE → AGPL-3.0-or-later (align to manifest) — only if this repo is intended as son-collaboration
• Other

Related

• verisimdb#82, verisimdb#101 (precedent)
• Estate memory: feedback_estate_license_policy_umbrella, feedback_panll_claude_md_leave_alone

🤖 Generated with Claude Code

[hyperpolymath]

Status update post-hardening landed today (2026-06-02):

This auto-filed inconsistency is now flag-only — see umbrella hypatia#416 (now CLOSED). The 3-layer guard prevents any auto-PR:

• hypatia#414+#415 — SC-010 flipped to auto_fixable: false; license_finding_strategy/0 caps severity to :warn/:review; Manual-Only policy header at the top of lib/rules/cicd_rules.ex
• gitbot-fleet#247 — dispatch-runner.sh refuses any recipe_id or category matching license|spdx|pmpl|mpl-2|agpl|palimpsest; the 3 fix-scripts (fix-license-hygiene.sh/fix-license-file.sh/fix-missing-spdx.sh) exit 1 with refusal banners
• standards#339 — .claude/CLAUDE.md top-of-file 'License Policy — Manual Only' section + 5-way classification

Resolution requires manual owner classification per the 5-way directive (estate-license-policy-umbrella):

Category	License	Applies to
Sole owner repos (default)	MPL-2.0	most of hyperpolymath/*
007 only	All Rights Reserved	hyperpolymath/007
Shared with son	AGPL-3.0-or-later	idaptik, burble, etc.
Third-party / forks	DO NOT TOUCH	upstream forks
Palimpsest carve-out	PMPL-1.0-or-later	palimpsest-license, palimpsest-plasma, consent-aware-http

Until classified manually by owner, this issue stays open as a tracked-but-not-auto-actionable record.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

[hyperpolymath]

FYI from the 2026-06-02 estate-wide PMPL→MPL sweep (standards#308): panll was explicitly EXCLUDED from the sweep per the always-on memory feedback_panll_claude_md_leave_alone.md (owner reverted panll#60 on 2026-05-30; panll is owner-managed).

The inconsistency this issue describes (Cargo.toml + package.json AGPL vs LICENSE MPL-2.0) is real and was observed during audit but NOT touched. Resolving it is owner-action only.

If the AGPL manifest fields are intentional (i.e., panll is category 3 son-shared), the LICENSE file should flip to AGPL-3.0-or-later. If the LICENSE is correct, the manifests should flip to MPL-2.0. The current discrepancy is owner-call.