From d31b277fb0dae4484a59b74b1977460bcb445efa Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 22 May 2026 14:49:38 +0100
Subject: [PATCH 1/2] chore: migrate license from PMPL-1.0-or-later to MPL-2.0

---
 .claude/PROJECT.md | 33 +++++++++++++++++++++++++++++++++
 selur-compose.toml |  2 +-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 .claude/PROJECT.md

diff --git a/.claude/PROJECT.md b/.claude/PROJECT.md
new file mode 100644
index 0000000..44ae675
--- /dev/null
+++ b/.claude/PROJECT.md
@@ -0,0 +1,33 @@
+# File Soup - Claude Code Instructions
+
+This repository contains the File Soup file management utility.
+
+## Project Structure
+
+```
+file-soup/
+├── .claude/         # AI assistant instructions
+├── .git/           # Version control
+├── .gitignore      # Git ignore rules
+├── .editorconfig   # Editor configuration
+└── ...             # Utility files
+```
+
+## Build Commands
+
+Refer to project-specific documentation.
+
+## Coding Conventions
+
+- Follow hyperpolymath standards
+- All code must have SPDX license headers
+- Use approved languages only (see CLAUDE.md)
+- Document all non-obvious decisions
+
+## Security
+
+- No hardcoded secrets
+- All secrets through environment variables or secret management
+- SHA-pinned dependencies where applicable
+- HTTPS only, no HTTP URLs
+- No MD5/SHA1 for security purposes
diff --git a/selur-compose.toml b/selur-compose.toml
index 977ab68..88277fa 100644
--- a/selur-compose.toml
+++ b/selur-compose.toml
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Stapeln service definition for file-soup

From 31acb5e40880991bc39822d8719ba0ccef0269a6 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 7 Jul 2026 16:11:02 +0100
Subject: [PATCH 2/2] fix(ci): estate-wide structural CI fixes

- grant secret-scanner reusable its requested job permissions
- drop invalid timeout-minutes on reusable-call jobs
- drop hashFiles() from job-level if: expressions
---
 .github/workflows/mirror.yml         | 1 -
 .github/workflows/rust-ci.yml        | 1 -
 .github/workflows/secret-scanner.yml | 5 ++++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index ee8ea02..2083ca6 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -12,5 +12,4 @@ permissions:
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
-    timeout-minutes: 10
     secrets: inherit
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 855e4c9..2bf9879 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -15,7 +15,6 @@ permissions:
 jobs:
   rust-ci:
     uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@f5f0506a6ec88e574753eee701a268e0d4b3a7f2
-    timeout-minutes: 10
     with:
       enable_audit: true
       enable_coverage: true
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index c7761fe..ef638d3 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -15,6 +15,9 @@ permissions:
 
 jobs:
   scan:
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
-    timeout-minutes: 10
     secrets: inherit