From ca9995eb37e26c19c3399dc62064fc940e0dd6aa Mon Sep 17 00:00:00 2001 From: Erin Spencer Date: Sat, 26 Sep 2026 22:57:40 -0700 Subject: [PATCH] fix(license): restore canonical MPL-2.0 text (line 212 comma) RIGHTS-AUDIT Phase 1.2: LICENSE differed from the canonical Mozilla text only at line 212 ('indemnity or' -> 'indemnity, or'). LICENSE is now byte-identical to https://www.mozilla.org/media/MPL/2.0/index.txt. README gains a License section naming MPL-2.0. No license change. --- LICENSE | 2 +- README.md | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/LICENSE b/LICENSE index 93bc3cb8..d0a1fa14 100644 --- a/LICENSE +++ b/LICENSE @@ -209,7 +209,7 @@ You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations to one or more recipients of Covered Software. However, You may do so only on Your own behalf, and not on behalf of any Contributor. You must make it absolutely clear that any -such warranty, support, indemnity or liability obligation is offered by +such warranty, support, indemnity, or liability obligation is offered by You alone, and You hereby agree to indemnify every Contributor for any liability incurred by such Contributor as a result of warranty, support, indemnity or liability terms You offer. You may include additional diff --git a/README.md b/README.md index a7ac28b5..206c2cc7 100644 --- a/README.md +++ b/README.md @@ -284,3 +284,7 @@ checks; it does not select geometry, ratify candidates, or establish freshness. Distribution replays hash the complete extracted tree before and after each full suite, reject persistent source changes, and retain the full source map. Each installed distribution inventory covers package files, dist-info payloads, and validated uv installer metadata/RECORD; imports remain separately witnessed. Check downloaded archives from their directory with `sha256sum -c ../replay/archives.sha256`. These checks establish execution provenance, not scientific ratification. Standalone replay requires uv 0.11.18. It verifies the bootstrap version, synchronizes the verification environment from the hash-locked export, uses that environment’s uv for later installation, and retains both executable identities. Fixture source builds consume the same locked dependency export. Optimized Python mode is rejected before evidence can be produced. + +## License + +This repository is licensed under the Mozilla Public License 2.0 (SPDX: `MPL-2.0`). See [`LICENSE`](LICENSE) for the full text.