From adc177e71507ffd2ab5f375964b10d1ac00403e9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 2 Sep 2026 08:58:44 +0100 Subject: [PATCH 1/2] chore(licence): clear residual PMPL debt after the MPL-2.0 ruling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #78 (owner ruling: MPL-2.0 for code, CC-BY-SA-4.0 for docs): - Delete legacy vext/COMMIT-AND-PUSH.sh — one-shot bootstrap script with broken /var$REPOS_DIR paths, superseded by the monorepo; no inbound references. - Fix vext-core cargo-deb license-file to ../LICENSE (the ../LICENSE.txt it pointed at never existed; vext/LICENSE is canonical MPL-2.0). - Drop the dead PMPL alternative from the licence-content accept patterns in contractile.just and .machine_readable/contractiles/Trustfile.a2ml. just trust-verify and just trust-manifest-verify both pass; neither edited gate file is trust-manifest-tracked, so no regen is required. Co-Authored-By: Claude Fable 5 --- .machine_readable/contractiles/Trustfile.a2ml | 2 +- contractile.just | 2 +- vext/COMMIT-AND-PUSH.sh | 220 ------------------ vext/vext-core/Cargo.toml | 2 +- 4 files changed, 3 insertions(+), 223 deletions(-) delete mode 100644 vext/COMMIT-AND-PUSH.sh diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml index e2028b5..3f72ed4 100644 --- a/.machine_readable/contractiles/Trustfile.a2ml +++ b/.machine_readable/contractiles/Trustfile.a2ml @@ -54,7 +54,7 @@ Current trust level: maximal #### license-content - description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE +- run: grep -q 'MPL\|MIT\|Apache\|LGPL' LICENSE - severity: warning ## Template-Specific Trust diff --git a/contractile.just b/contractile.just index 9a5827b..20a5fbb 100644 --- a/contractile.just +++ b/contractile.just @@ -62,7 +62,7 @@ trust-verify: trust-license-content trust-no-secrets-committed trust-container-i # LICENSE contains expected SPDX identifier trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE + grep -q 'SPDX\|License\|MIT\|Apache\|MPL' LICENSE # No .env or credential files in repo trust-no-secrets-committed: diff --git a/vext/COMMIT-AND-PUSH.sh b/vext/COMMIT-AND-PUSH.sh deleted file mode 100644 index f5012e4..0000000 --- a/vext/COMMIT-AND-PUSH.sh +++ /dev/null @@ -1,220 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# Script to commit and push vext repository to GitHub - -set -e # Exit on error - -echo "🚀 Vext Repository Setup and Push Script" -echo "========================================" - -# Navigate to repo -cd /var$REPOS_DIR/vext - -# Copy documentation from home directory -echo "📄 Copying documentation files..." -mkdir -p docs -cp /var$HOME/VEXT-MANIFESTO.md docs/ 2>/dev/null || echo " ⚠️ VEXT-MANIFESTO.md not found" -cp /var$HOME/VEXT-TECHNICAL-SPEC.md docs/ 2>/dev/null || echo " ⚠️ VEXT-TECHNICAL-SPEC.md not found" -cp /var$HOME/VEXT-MOBILE-SMS-EMAIL.md docs/ 2>/dev/null || echo " ⚠️ VEXT-MOBILE-SMS-EMAIL.md not found" -cp /var$HOME/VEXT-ADDITIONAL-PROTOCOLS.md docs/ 2>/dev/null || echo " ⚠️ VEXT-ADDITIONAL-PROTOCOLS.md not found" -cp /var$HOME/VEXT-MULTICAST-ARCHITECTURE.md docs/ 2>/dev/null || echo " ⚠️ VEXT-MULTICAST-ARCHITECTURE.md not found" -cp /var$HOME/VEXT-ANTI-ALGORITHM-ARCHITECTURE.md docs/ 2>/dev/null || echo " ⚠️ VEXT-ANTI-ALGORITHM-ARCHITECTURE.md not found" -cp /var$HOME/VEXT-ARXIV-PAPER-PLAN.md docs/ 2>/dev/null || echo " ⚠️ VEXT-ARXIV-PAPER-PLAN.md not found" -cp /var$HOME/NUJ-VEXT-PROPOSAL.md docs/ 2>/dev/null || echo " ⚠️ NUJ-VEXT-PROPOSAL.md not found" - -echo "✅ Documentation copied" - -# Create basic LICENSE file -echo "📜 Creating LICENSE file..." -cat > LICENSE << 'EOL' -Mozilla Public License Version 2.0 - -Copyright (c) 2025 Jonathan D.A. Jewell - -This software is licensed under the Mozilla Public License, v. 2.0. - -For the full license text, see: -https://mozilla.org/MPL/2.0/ - -SPDX-License-Identifier: MPL-2.0 -EOL - -# Create CONTRIBUTING.md -echo "📝 Creating CONTRIBUTING.md..." -cat > CONTRIBUTING.md << 'EOL' -# Contributing to Vext - -Thank you for your interest in contributing to Vext! - -## Prerequisites - -- **Idris2** (required for a2ml specification) -- **Rust** (for implementation) -- **Git** - -## Getting Started - -1. Fork the repository -2. Clone your fork: `git clone https://github.com/YOUR-USERNAME/vext` -3. Create a branch: `git checkout -b feature/your-feature` -4. Make changes -5. Test thoroughly -6. Commit: `git commit -m "Description" -m "Co-Authored-By: Your Name "` -7. Push: `git push origin feature/your-feature` -8. Open Pull Request - -## Areas We Need Help - -- **Idris2 expertise** - a2ml specification -- **Cryptography review** - Security analysis -- **NNTP integration** - Protocol implementation -- **Documentation** - Improve clarity -- **Testing** - Property-based tests, fuzzing - -## Code Standards - -- Follow language conventions (rustfmt, idris2 style) -- Add SPDX headers to all files -- Write tests for new code -- Update documentation - -## Questions? - -Open a GitHub Discussion or contact: j.d.a.jewell@open.ac.uk -EOL - -# Create SECURITY.md -echo "🔒 Creating SECURITY.md..." -cat > SECURITY.md << 'EOL' -# Security Policy - -## Supported Versions - -| Version | Supported | -| ------- | ------------------ | -| 0.x.x | :white_check_mark: (development) | - -## Reporting a Vulnerability - -**DO NOT** open a public issue for security vulnerabilities. - -Instead, email: security@vext.org (or j.d.a.jewell@open.ac.uk until domain is set up) - -Include: -- Description of vulnerability -- Steps to reproduce -- Potential impact -- Suggested fix (if any) - -We will respond within 48 hours and provide updates on the fix timeline. - -## Security Guarantees - -Vext provides cryptographic proofs of: -- Feed chronological ordering (Merkle tree commitments) -- No ad injection (content-type verification) -- Message authenticity (Ed25519 signatures) - -These are **mathematically provable**, not just policy-based. - -## Cryptographic Assumptions - -Vext security relies on: -- Ed25519 signature security (NIST standard) -- SHA-256 collision resistance (NIST standard) -- Idris2 type-level proofs (formal verification) - -If any of these are broken, vext security may be compromised. - -## Verification - -Users can verify feed integrity using: -```bash -vext verify -``` - -This checks: -1. Server signature validity -2. Merkle root correctness -3. Policy compliance (chronological, no ads) - -**Don't trust us. Verify the cryptography.** -EOL - -# Initialize git if needed -if [ ! -d .git ]; then - echo "🔧 Initializing git repository..." - git init -fi - -# Add all files -echo "📦 Adding files to git..." -git add . - -# Check if anything to commit -if git diff --cached --quiet; then - echo "⚠️ No changes to commit" - exit 0 -fi - -# Commit -echo "💾 Committing changes..." -git commit -m "$(cat <<'EOF' -feat: initial vext repository with comprehensive documentation - -Complete vext protocol specification and roadmap including: -- README.adoc with project overview and architecture -- ROADMAP.md with 5-phase implementation plan -- STATE.scm with current project state and milestones -- ECOSYSTEM.scm describing vext's position in broader ecosystem -- META.scm with ADRs and design philosophy -- Documentation suite (manifesto, technical spec, architecture) -- arXiv paper plan (cs.CR publication) -- NUJ Ethics Council proposal - -Key innovations: -- a2ml (Anti-Algorithm Markup Language) requires Idris2 dependent types -- Cryptographic proofs of chronological ordering (Merkle trees) -- Mathematical guarantees of no algorithms, no ads -- Built on proven protocols (NNTP) with modern cryptography - -Status: Research phase, a2ml specification in design - -Co-Authored-By: Claude Sonnet 4.5 -EOF -)" - -echo "✅ Committed successfully!" - -# Create GitHub repo and push -echo "🌐 Creating GitHub repository..." -if ! gh repo view hyperpolymath/vext &>/dev/null; then - gh repo create hyperpolymath/vext \ - --public \ - --description "Cryptographically verifiable communications protocol with proof of algorithmic neutrality" \ - --homepage "https://vext.org" \ - || echo "⚠️ Failed to create GitHub repo (may already exist)" -fi - -# Add remote if not exists -if ! git remote get-url origin &>/dev/null; then - echo "🔗 Adding remote origin..." - git remote add origin https://github.com/hyperpolymath/vext.git -fi - -# Push to GitHub -echo "⬆️ Pushing to GitHub..." -git branch -M main -git push -u origin main - -echo "" -echo "✅ SUCCESS! Repository pushed to GitHub" -echo "📍 URL: https://github.com/hyperpolymath/vext" -echo "" -echo "Next steps:" -echo "1. Visit https://github.com/hyperpolymath/vext to verify" -echo "2. Enable GitHub Pages (Settings → Pages → Source: main branch, /docs)" -echo "3. Start implementing a2ml specification in Idris2" -echo "4. Begin arXiv paper draft" -echo "" -echo "🚀 Vext is live!" diff --git a/vext/vext-core/Cargo.toml b/vext/vext-core/Cargo.toml index 651b4e2..5d946c2 100644 --- a/vext/vext-core/Cargo.toml +++ b/vext/vext-core/Cargo.toml @@ -81,7 +81,7 @@ path = "src/bin/send.rs" [package.metadata.deb] maintainer = "hyperpolymath " copyright = "2025, hyperpolymath" -license-file = ["../LICENSE.txt", "0"] +license-file = ["../LICENSE", "0"] extended-description = """ Vext is a high-performance IRC notification daemon for version control systems. It monitors git repositories and sends real-time notifications to IRC channels From cae5404aa6a4bcf6564d8937f53fe7f6b601dcde Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 2 Sep 2026 09:32:53 +0100 Subject: [PATCH 2/2] fix(trust): make the licence-content gates boundary-aware and aligned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per review: the unbounded MPL alternative still substring-matched PMPL, and the contractile.just variant also accepted SPDX|License — a pattern nearly any licence file satisfies, i.e. a gate that cannot fail. Both gates now use grep -qE '\b(MPL|MIT|Apache|LGPL)\b' LICENSE: proven to match the canonical MPL-2.0 body (Exhibit A URL) and to reject PMPL text. Co-Authored-By: Claude Fable 5 --- .machine_readable/contractiles/Trustfile.a2ml | 2 +- contractile.just | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml index 3f72ed4..0e75946 100644 --- a/.machine_readable/contractiles/Trustfile.a2ml +++ b/.machine_readable/contractiles/Trustfile.a2ml @@ -54,7 +54,7 @@ Current trust level: maximal #### license-content - description: LICENSE contains expected identifier -- run: grep -q 'MPL\|MIT\|Apache\|LGPL' LICENSE +- run: grep -qE '\b(MPL|MIT|Apache|LGPL)\b' LICENSE - severity: warning ## Template-Specific Trust diff --git a/contractile.just b/contractile.just index 20a5fbb..841225e 100644 --- a/contractile.just +++ b/contractile.just @@ -62,7 +62,7 @@ trust-verify: trust-license-content trust-no-secrets-committed trust-container-i # LICENSE contains expected SPDX identifier trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|MPL' LICENSE + grep -qE '\b(MPL|MIT|Apache|LGPL)\b' LICENSE # No .env or credential files in repo trust-no-secrets-committed: