feat(scanner): fail closed on plugin LICENSE/NOTICE SPDX mismatch

[seonghobae]

Current repair boundary — 2026-09-12

• base: feat/claude-plugin-sarif-receipt-1099@8850f01300e44615245e91a12bfe64c90a095a1a
• exact head: 3ceb0235946fbb8a215e9caa0db02a816b53ebc2
• exact tree: b57a44e10c15fedabbb17db33225f7060d124b47
• ancestry: ordinary two-parent merge of previous feat(scanner): fail closed on plugin LICENSE/NOTICE SPDX mismatch #1143 head e5051ea… and current feat(scanner): bind plugin SARIF findings to the scan receipt #1142 head 8850f01…; no force update
• exact-tree validation: PYTHONPATH=. python -m pytest -q tests/test_claude_plugin*.py → 118 passed; py_compile and git diff --check passed
• lifecycle: Draft / license-mismatch delta and all parent repairs preserved / hosted exact-head Checks and independent review absent
• stacked-workflow admission remains owned by fix(ci): admit stacked PR checks without bypassing docs contracts #1096; do not create a source-neutral wake-up commit

Summary

• NOTICE files count as license evidence, so a NOTICE-only tree is not claude-plugin-license-missing.
• Conflicting SPDX identifiers across the declared license field, LICENSE, and NOTICE fail as claude-plugin-license-mismatch.
• Copyright-only NOTICE text does not invent an SPDX token. Matching MIT evidence still passes.
• Does not invent legal approval. scan_result=pass is not Noema admission.

Stacked on #1142. Unique remaining #1099 TDD item 11 mismatch slice. Do not Close #1099 or #1142. Do not steal G-06 #1133.

Test plan

• RED then GREEN (tests/test_claude_plugin_license_mismatch.py)
• Detector statement coverage 935/935 with plugin suites
• Exact-head Checks on this head
• Keep Draft until current-head gates are GREEN

Relates to #1099. Relates to #1142.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Unique remaining #1099 TDD item 11 mismatch slice on #1142 d5df6c7.

Exact head e5051ea32eeedb708e3f7e04c1f25c395fc4bbbd. NOTICE counts as license evidence. Conflicting SPDX tokens fail as claude-plugin-license-mismatch. Detector statement coverage 935/935. Keep Draft. Do not Close #1099 or #1142.

[seonghobae]

Successor slice for #1099 lifecycle/post-install scripts is stacked on this head as Draft #1144 (feat/claude-plugin-postinstall-download-1099 @ c66dfaf88b29ae478431c2fd1a0d325d91da4bc2).

package.json preinstall/install/postinstall unsigned downloads fail closed on the existing claude-plugin-unsigned-executable-download / pipe-to-shell / unpinned-package-install rules. Lockfile-only trees without a postinstall download stay package_install inventory. LICENSE/NOTICE SPDX mismatch on this PR is unchanged. Does not Close #1099 or #1143. Does not steal G-06 #1133 or #1142 SARIF.