Licence campaign follow-through: stop the MPL-normalise sweeper re-clobbering AGPL exceptions + estate hygiene

[hyperpolymath]

Summary

The AGPL-clobber incident (estate MPL-normalise sweep #40 = 5e390d7) is only
half-fixed. We fixed the detection side — the governance body classifier now
recognises AGPL (PR #501, merged) — but the prevention side is untouched: the
normalise sweeper that did the clobbering still has no AGPL exception list, so the
next run will re-flatten the co-developed games back to MPL-2.0.

This issue tracks closing the loop and the residual licence hygiene the campaign surfaced.

Prevention (root cause — the actual "stop it happening again")

• Locate the MPL-normalise sweeper tooling (the thing that produced sweep ci(antipattern): TS check reads .claude/CLAUDE.md exemption table #40 /
  commit 5e390d7).
• Teach it a canonical AGPL exception allowlist: airborne-submarine-squadron,
  the-nash-equilibrium (both co-developed games), plus any repo carrying a
  [CRITICAL] agpl-license invariant. The sweeper must skip these, not flatten them.
• Publish the allowlist as data (single source of truth) so the sweeper, the
  governance check, and humans all read the same list.

Per the estate CI/CD doctrine, prevention must be foundational, not a per-repo patch.
If the sweeper tooling lives somewhere unreachable, this is a STOP-and-chat item —
flagged here for that conversation.

Detection (done, recorded for the trail)

• check-licence-consistency.sh body classifier recognises full-text AGPL-3.0
  → PR fix(licence-check): recognise AGPL-3.0 in the body classifier #501 (merged). Propagates estate-wide via the default-branch script.

Residual licence hygiene (campaign remainder)

• the-nash-equilibrium: full AGPL restoration (tracked in its own repo issue).
• coq-jr: dangling LICENSE-AGPL / LICENSE-PMPL doc links + garbled
  "v3.0 or later (MPL-2.0)" text.
• academic-workflow-suite: stale "Why AGPL?" heading over a now-MPL repo.
• boj-server: stray AGPL manifest string.
• 44 repos with no root LICENSE at all — a distinct CI/CD gap; the governance
  check errors on absence. Audit + backfill (MPL-2.0 default, AGPL for the allowlist).

References

• Umbrella: [umbrella] Estate audit & optimization — make the enforcement real (Waves 0–6) #460 (estate audit — make enforcement real).
• Related: Reusable-workflow wrappers startup-fail estate-wide: callers grant narrower permissions than the reusable's jobs request #451 (reusable-workflow startup failures estate-wide).
• Incident restorations: asq PR fix(ci): move secret-scanner Cargo.toml gate from job-level if: to step-level #57/docs(policy): add canonical CODEOWNERS policy (standards#55) #58; the-nash issue (linked).

[hyperpolymath]

Partial Completion

✅ COMPLETED: Fixed AI-CONVENTIONS.adoc files with contradictory AGPL guidance:

• Corrected 11 AI-CONVENTIONS.adoc files in k9-svc/ and a2ml/ subdirectories
• Changed AGPL-3.0-or-later to MPL-2.0 for source file SPDX identifiers
• Changed PMPL-1.0-or-later to MPL-2.0 (PMPL only applies to palimpsest repos)
• Aligns with LICENCE-POLICY.adoc Rule 1: MPL-2.0 for code, CC-BY-SA-4.0 for docs

This prevents AI agents from being directed to use incorrect AGPL headers.

⏳ REMAINING: Core issue items (prevention side):

• Locate the MPL-normalise sweeper tooling
• Teach it AGPL exception allowlist
• Publish allowlist as data
• Residual licence hygiene items (nash-equilibrium, coq-jr, academic-workflow-suite, boj-server, 44 repos without LICENSE)

Commit: ff59863 fix(license): normalize AGPL references to MPL-2.0 in AI-CONVENTIONS.adoc files

[hyperpolymath]

Datapoint from chronicles-of-slavia (2026-08-04): the Rhodibot canary's inline SPDX rule hard-coded estate policy is MPL-2.0 for .gitignore/.gitattributes/.editorconfig and tripped weekly against the repo's ruled licence (AGPL-3.0-or-later per its ADR-0008, PR metadatastician/chronicles-of-slavia#45).

Per the canary's own doctrine ("either the repo drifted OR the rule diverged from the norm"), owner ruled it was rule divergence. Fixed at the repo level in metadatastician/chronicles-of-slavia#58: the canary now validates dotfiles against the repo's ruled licence and still warns on anything matching neither. No licence headers edited.

Suggests the canonical rhodibot rule (if templated from here) needs the same exception class this issue proposes: repos with a licence ADR should be checked against their ruling, not the estate default.