From 2cf4a18c6ecc2e112e438a1584b303832f8536a1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 26 Aug 2026 17:00:53 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20rhodibot=20must=20never=20relicense?= =?UTF-8?q?=20AGPL=20=E2=80=94=20warn=20only?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rhodibot ran a sed sweep over dotfiles rewriting AGPL SPDX headers, on a Monday cron AND on every completed Hypatia analysis: sed -i 's/AGPL-3.0-or-later/MPL-2.0/g; s/AGPL-3.0/MPL-2.0/g' "$dotfile" Three things wrong with that: 1. LICENCE-POLICY.adoc A2 forbids it outright -- "No automated or bulk SPDX/licence change (sed sweep, script, agent pass) on any estate repo, ever. Prior automated attempts falsified third-party licence authorship -- a legal-integrity hazard." This is literally a sed sweep changing SPDX headers. 2. AGPL is CORRECT in this estate, not drift. Rule 3 covers projects co-developed with the owner's son; Rule 5 (added 2026-08-26) makes games AGPL as a class. This bot was scheduled to undo a policy set the same day. 3. It was HALF-fixed, which is worse than either state. The sed target had been changed from PMPL to MPL-2.0, but the report line still read "(AGPL → PMPL)" -- so the log described an edit the code no longer made. A bot whose output misdescribes its own behaviour is harder to audit than one that is plainly wrong. Replaced with warn-only, matching what rsr-template-repo's rhodibot already does correctly: echo "::warning::... must be fixed MANUALLY (owner-only, never auto-edited). AGPL is correct under LICENCE-POLICY Rule 3 and Rule 5." The header comment claiming 'Fix SPDX headers (AGPL → PMPL in dotfiles)' is corrected to say it flags for manual review. Note on scope: 38 copies of the original PMPL-rewriting form exist as vendored sub-copies under developer-ecosystem and standards/k9-svc. Those are inert unless executed, and are a separate cleanup; this fixes the one that is ACTIVE and scheduled. Co-Authored-By: Claude Opus 5 --- .github/workflows/rhodibot.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 687e30c..3b9da9a 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -5,7 +5,7 @@ # Reads root-hygiene rules and auto-fixes what it can: # - Delete banned files (AI.djot, duplicate CONTRIBUTING.adoc, stale snapshots) # - Rename misnamed files (AI.a2ml → 0-AI-MANIFEST.a2ml) -# - Fix SPDX headers (AGPL → PMPL in dotfiles) +# - Flag AGPL SPDX headers for MANUAL review (never auto-edited -- see A2) # - Create missing required files (SECURITY.md, CONTRIBUTING.md) # - Report unfixable issues as PR comments # @@ -84,8 +84,13 @@ jobs: # --- 4. Fix SPDX headers in dotfiles --- for dotfile in .gitignore .gitattributes .editorconfig; do if [ -f "$dotfile" ] && grep -q "AGPL-3.0" "$dotfile" 2>/dev/null; then - sed -i 's/AGPL-3.0-or-later/MPL-2.0/g; s/AGPL-3.0/MPL-2.0/g' "$dotfile" - FIXES="$FIXES\n- Fixed SPDX header in \`$dotfile\` (AGPL → PMPL)" + # WARN ONLY -- never edit. LICENCE-POLICY.adoc A2: "No automated or + # bulk SPDX/licence change (sed sweep, script, agent pass) on any + # estate repo, ever." AGPL is CORRECT in this estate for Rule 3 + # (co-developed with family) and Rule 5 (games), so rewriting it + # would undo deliberate policy, not fix drift. + echo "::warning::$dotfile carries an AGPL-3.0 SPDX header. If that is wrong it must be fixed MANUALLY (owner-only, never auto-edited). AGPL is correct under LICENCE-POLICY Rule 3 and Rule 5." + FIXES="$FIXES\n- ⚠️ \`$dotfile\` carries AGPL-3.0 — flagged for manual owner review, NOT changed" CHANGED=true fi done