edison/chanora
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(legal): resolve DEC-020 — dual-license under Apache-2.0 OR MIT

Browse Source 
Closes the only previously-open decision in the register. Chanora is
now dual-licensed under either:

  * Apache License, Version 2.0 (LICENSE-APACHE), OR
  * MIT License (LICENSE-MIT)

at the recipient's option. This is the standard Rust-ecosystem
permissive model and is compatible with every direct dependency
in the PoC tree:

  tsclientlib          MIT OR Apache-2.0
  flutter_rust_bridge  MIT
  cpal                 Apache-2.0
  rusqlite             MIT
  keyring              MIT OR Apache-2.0
  hound                Apache-2.0
  ndk-context, jni, android_logger, regex, serde, tokio,
  tracing, thiserror, zeroize, etc.   MIT OR Apache-2.0

and with the Flutter framework's BSD-3-Clause.

Files added:
  - LICENSE-APACHE  Apache 2.0 license text.
  - LICENSE-MIT     MIT license text with the standard 2026 copyright
                    line.

Files updated:
  - LICENSE     Now the dual-license aggregator. Includes the standard
                Apache-2.0 inbound-contribution clause ("Unless you
                explicitly state otherwise, any contribution
                intentionally submitted for inclusion in Chanora by you,
                as defined in the Apache-2.0 license, shall be
                dual-licensed as above, without any additional terms or
                conditions.").
  - NOTICE      Rewritten with the dual-license declaration and an
                inventory of direct dependencies with their upstream
                licenses. Transitive deps remain to be enumerated by
                build tooling (cargo about, Flutter LicenseRegistry).
  - README.md   §License section rewritten to point at LICENSE-APACHE
                and LICENSE-MIT.
  - docs/governance/product-decision-register.md v0.9.5 → v0.9.6:
    DEC-020 status: Open → Accepted. §4 license row updated. §6
    collapsed: every previously-Proposed or Open decision in the
    register is now resolved. DEC-012 legal review remains as a
    release-gating *work* item, but is not an open decision.
  - docs/governance/poc-results-summary.md v0.3.0 → v0.4.0:
    RISK-PoC-003 closed. DEC-020 row moved out of 'Still open'.

This is a license-model commitment, not a substitute for the
DEC-012 legal review. Per DEC-012 the actual legal review work
(transitive-dep OSS obligations, trademark registrability, final
sign-off on the non-affiliation wording) must still be completed
before any public/store release; that is sign-off work, not an
architectural decision.

Decision register state after this commit:
  Accepted:       23 of 23 unique decisions
  Open/Deferred:  0
  Proposed:       0
This commit is contained in:
EdisonJwa
2026-05-14 20:53:04 +08:00
parent a0d1c35461
commit 0f418f1d7e
8 changed files with 387 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/governance/poc-results-summary.md
+8 -6
View File
@@ -1,7 +1,7 @@
# PoC Results Summary
**Document type:** Governance / PoC Results Summary
**Version:** 0.3.0
**Version:** 0.4.0
**Status:** Draft
**Language:** English
**Product:** Chanora
@@ -74,7 +74,7 @@ Recorded in [`docs/governance/product-decision-register.md`](product-decision-re
| **DEC-013.2** Linux secure-storage backend policy | Accepted (Secret Service preferred, keyutils fallback) | `secure-storage-spike` |
| **DEC-011.1** audio crate | Accepted (desktop: `cpal`; Android: `cpal`-on-Oboe) / Deferred (iOS) | `audio-capture-playback-spike` (desktop) + `audio-capture-playback-android-spike` (mobile) |
| **DEC-022** canonical implementation directory layout | Accepted (README sketch — `apps/chanora_flutter/`, `core/chanora_core/`, `crates/chanora_*`) | Owner ruling on 2026-05-13 |
| **DEC-020** license | **Open / Deferred** | Owner deferred 2026-05-13 — **remains a public-release blocker** |
| **DEC-020** license | Accepted (Apache-2.0 OR MIT dual-license) | Owner ruling on 2026-05-14; license texts added as `LICENSE-APACHE` and `LICENSE-MIT`. |
### From the 2026-05-14 owner-confirmation pass (all 17 previously-Proposed)
@@ -102,9 +102,10 @@ Recorded in [`docs/governance/product-decision-register.md`](product-decision-re
### Still open
| Decision | Status |
|---|---|
| DEC-020 License model | **Open / Deferred** — only remaining public-release blocker. |
(none — DEC-020 closed on 2026-05-14; see register v0.9.6.)
DEC-012 legal/trademark/licensing review remains a release-gating
*work* item but is not an open decision.
## 5. Audit-report coverage
@@ -132,7 +133,7 @@ Recorded in [`docs/governance/product-decision-register.md`](product-decision-re
|---|---|---|---|
| RISK-PoC-001 | iOS audio (AVAudioEngine via cpal or a per-platform iOS adapter) is not verified. The desktop and Android halves of the PoC plan's audio criterion are met; iOS is explicitly deferred per DEC-011.1. | Audio Owner + iOS Owner | iOS spike on macOS + Xcode hardware; or accept the risk and discover it during product integration (not recommended). |
| RISK-PoC-002 | Windows / macOS / iOS / Android secure-storage adapters not implemented. SS-TC-001/002/004/005 unverified. | Platform Owners | Per-platform adapter spike or first-implementation-in-`chanora_storage` with the audit checks re-run on each target. |
| RISK-PoC-003 | License (DEC-020) deferred. Blocks public/store release. | Product Owner + Legal | Owner ruling. |
| RISK-PoC-003 | ~~License (DEC-020) deferred. Blocks public/store release.~~ **CLOSED 2026-05-14.** DEC-020 Accepted as Apache-2.0 OR MIT dual-license; texts present in repository root. Release-gating legal review under DEC-012 remains pending as a separate *work* item, but no longer a license-choice blocker. | Product Owner + Legal | Closed. |
| RISK-PoC-004 | ~~DEC-001..012, 015..019, 021 still in Proposed status.~~ **CLOSED 2026-05-14.** All 17 decisions were owner-reviewed; statuses recorded in the register at v0.9.5. | Product Owner | Closed. |
| RISK-PoC-005 | Production code does not exist yet. README's "Implementation status: Not production-ready" remains accurate. | Software Architect | Promote PoC code into `apps/` and `crates/` per DEC-022. The only release-gating decision still open is DEC-020 (license). Scaffolding can begin without it; publication cannot. |
| RISK-PoC-006 | **DEC-004 Android minimum was raised to API 28 from the spike's `minSdk = 24`.** The Android spike still builds and runs; product code in `apps/chanora_flutter` must move `minSdk` to 28 and may simplify its AAudio fallback logic accordingly. | Android Owner | Set `minSdk = 28` when the Android target is added to `apps/chanora_flutter`. |
@@ -152,3 +153,4 @@ without an explicit promotion record per spike.
| 0.1.0 | 2026-05-14 | Initial PoC results summary. Records the outcome of the first PoC batch (5 PASS, 1 PARTIAL), the toolchain versions exercised, the owner-confirmed decisions, audit-report coverage, and the open risks. |
| 0.2.0 | 2026-05-14 | Audio PoC promoted from PARTIAL to PASS after the Android spike verified the mobile half on a physical Motorola Moto G Stylus 5G running Android 14 arm64-v8a. All six PoC plan entries now PASS. RISK-PoC-001 narrowed from "mobile audio" to "iOS audio only". Android toolchain (NDK r26.3, cargo-ndk, AGP/Gradle/Kotlin, jni/ndk-context/android_logger) added to the toolchain table. |
| 0.3.0 | 2026-05-14 | Recorded the owner-confirmation pass on the 17 remaining Proposed decisions (register at v0.9.5). RISK-PoC-004 closed. Added RISK-PoC-006 (Android `minSdk` 24 → 28) and RISK-PoC-007 (MVP language expanded to English + Chinese Simplified) for the two decisions that diverged from the original recommendations. DEC-020 license remains the sole open release-gating decision. |
| 0.4.0 | 2026-05-14 | DEC-020 license closed as Apache-2.0 OR MIT dual-license (register v0.9.6). RISK-PoC-003 closed. No remaining open decisions; the only release-gating activity outstanding is the DEC-012 legal review *work*, which is sign-off rather than an architectural choice. |
docs/governance/product-decision-register.md
+18 -14
View File
@@ -1,8 +1,8 @@
# CHANORA_CFG_Product_Decision_Register_v0.9.5.0.0
# CHANORA_CFG_Product_Decision_Register_v0.9.6.0.0
**Document type:** Configuration / Product Decision Register
**Version:** 0.9.5
**Version:** 0.9.6
**Status:** Baseline Candidate
**Language:** English
**Product:** Chanora
@@ -50,7 +50,7 @@ A decision marked **Proposed / Owner Confirmation Required** is a recommended de
| DEC-018 | Public product name | Chanora | Accepted | Product Owner | Branding and legal identity. Trademark / registrability check remains under DEC-012 legal review before public release. |
| DEC-019 | Public non-affiliation statement | Use legal-approved wording; drafted text accepted as working copy: "Chanora is independent and is not affiliated with, endorsed by, sponsored by, or officially associated with TeamSpeak." Subject to final legal review under DEC-012 before public release. | Accepted (drafted wording) | Legal / Compliance | Required for public release and store metadata. |
| DEC-021 | Apple App Store submission SDK | Use Xcode 26 or later and the iOS 26 / iPadOS 26 SDK or later for App Store submission on or after 2026-04-28, unless Apple publishes a newer applicable requirement before upload | Accepted | iOS Owner + Release Manager | Controls App Store Connect upload eligibility and release pipeline. |
| DEC-020 | License model | TBD by owner; no public release until license model and OSS obligations are confirmed | Open | Product Owner + Legal | Business and OSS compliance decision. Explicitly deferred on 2026-05-13 by owner; remains a public-release blocker. |
| DEC-020 | License model | **Dual-licensed under Apache-2.0 OR MIT (recipient's choice)**, the standard Rust-ecosystem permissive license model. Accepted on 2026-05-14. Compatible with every direct dependency in the PoC tree (`tsclientlib` MIT-OR-Apache-2.0, `flutter_rust_bridge` MIT, `cpal` Apache-2.0, `rusqlite` MIT, `keyring` MIT-OR-Apache-2.0, etc.) and with the Flutter framework's BSD-3-Clause. The license texts ship as `LICENSE-APACHE` and `LICENSE-MIT` at the repository root; an aggregator `LICENSE` points to both. `NOTICE` enumerates current direct-dependency attributions. The full OSS legal review (transitive deps, license obligations, OSS notices) remains under DEC-012 and is still required before public release. | Accepted | Product Owner + Legal | Business and OSS compliance decision. No longer a public-release blocker by itself; legal review under DEC-012 is the remaining gate. |
| DEC-022 | Canonical implementation directory layout | Accept the README's sketch as canonical: `apps/chanora_flutter/`, `core/chanora_core/`, `crates/chanora_protocol/`, `crates/chanora_audio/`, `crates/chanora_state/`, `crates/chanora_storage/`, `crates/chanora_diagnostics/`, `crates/chanora_bridge/`. Matches SAD §7.2 module decomposition | Accepted | Software Architect | Unblocks product-crate scaffolding; was not formalised by any prior doc. |
## 4. Accepted MVP Defaults
@@ -83,7 +83,7 @@ two were modified from the original recommendation (marked **MODIFIED**).
| Audio crate | `cpal` (desktop, Android); iOS deferred |
| Bridge | Stable typed Flutter/Rust bridge; `flutter_rust_bridge` 2.x pinned |
| Implementation directory layout | `apps/chanora_flutter/`, `core/chanora_core/`, `crates/chanora_*` |
| License | **Still Open** — DEC-020; blocks public release |
| License | **Dual-licensed under Apache-2.0 OR MIT**, recipient's choice (DEC-020) |
## 5. Decision Impact Matrix
@@ -103,17 +103,14 @@ two were modified from the original recommendation (marked **MODIFIED**).
## 6. Decisions That Must Be Confirmed By You
All previously listed P0/P1 owner-confirmation items were addressed
on **2026-05-14** in a single owner-review session; their final
status is reflected in §3 and §7. The only remaining open item is:
All decisions in the register have been addressed by the owner. The
remaining release-gating *work* (not decisions) is the legal review
itself under DEC-012, which must complete before any public/store
release but is not an open decision:
| Priority | Decision | Status |
| Priority | Item | Status |
|---|---|---|
| P0 | DEC-020 — License model. | **Open / Deferred** — blocks any public/store release. |
The release-gate legal review (DEC-012) is itself Accepted as a gate,
but the legal review work has not yet been performed and remains a
public-release blocker until completed.
| P0 | DEC-012 legal/trademark/licensing review — perform the actual review work (non-affiliation wording final sign-off, trademark registrability check, transitive-dependency OSS obligations, `tsclientlib` license posture confirmation). | Pending; gate Accepted. |
## 7. Open Decision Log
@@ -141,7 +138,7 @@ public-release blocker until completed.
| DEC-017 | Product Owner / Legal / Security | Crash reporting | Accepted | 2026-05-14 | Disabled for MVP. |
| DEC-018 | Product Owner | Public product name | Accepted | 2026-05-14 | Chanora. Trademark check still required under DEC-012. |
| DEC-019 | Legal / Compliance | Public non-affiliation statement | Accepted (drafted wording) | 2026-05-14 | Final legal sign-off still required under DEC-012. |
| DEC-020 | Product Owner / Legal | License model | **Open / Deferred** | 2026-05-13 | Explicitly deferred by owner; remains a public-release blocker. |
| DEC-020 | Product Owner / Legal | License model | Accepted (Apache-2.0 OR MIT dual-license) | 2026-05-14 | Compatible with every direct dependency; texts ship as LICENSE-APACHE / LICENSE-MIT. Full OSS legal review remains under DEC-012. |
| DEC-021 | iOS Owner / Release Manager | Apple App Store SDK gate | Accepted | 2026-05-14 | Xcode 26+ / iOS 26 SDK+ on or after 2026-04-28. |
| DEC-022 | Software Architect | Canonical implementation directory layout | Accepted (README sketch) | 2026-05-13 | Closes the absence flagged during PoC review. |
@@ -185,3 +182,10 @@ public-release blocker until completed.
| Version | Date | Description |
|---|---|---|
| 0.9.5 | 2026-05-14 | Owner confirmation pass on all previously-Proposed decisions. Accepted: DEC-001, DEC-002, DEC-003, DEC-005, DEC-006, DEC-007, DEC-008, DEC-009, DEC-010, DEC-011, DEC-012 (as a release gate), DEC-013, DEC-015, DEC-016, DEC-017, DEC-018, DEC-019 (drafted wording), DEC-021. Two decisions modified from their original recommendations: **DEC-004 Android minimum** raised from API 24 to **API 28** (simpler audio path, narrower compatibility surface); **DEC-015 product language** expanded from English-only to **English + Chinese (Simplified)** for MVP (reflects the demonstrated TS3-compatible-server audience). DEC-020 license model remains Open / Deferred — the only public-release blocker outstanding. §4 renamed from "Recommended MVP Defaults" to "Accepted MVP Defaults" with MODIFIED rows annotated. §6 collapsed to the single remaining DEC-020 item. §7 dated and statused. |
## Baseline Candidate 0.9.6 Update
| Version | Date | Description |
|---|---|---|
| 0.9.6 | 2026-05-14 | DEC-020 license model closed: **Apache-2.0 OR MIT** dual-license (standard Rust-ecosystem permissive model). The license is compatible with every direct dependency in the PoC tree (tsclientlib, flutter_rust_bridge, cpal, rusqlite, keyring, hound, etc.) and with the Flutter framework's BSD-3-Clause. License texts added as `LICENSE-APACHE` and `LICENSE-MIT` at the repository root; the existing `LICENSE` file now aggregates both with the dual-license declaration and the standard Apache-2.0 inbound-contribution clause. `NOTICE` populated with current direct-dependency attributions. README §License rewritten. §4 updated. §6 collapsed: there is no longer any open decision — DEC-012 legal review remains a pending *work* item, not a pending decision. With this change, every previously-Proposed or Open decision in the register has been resolved; the only outstanding release-gating activity is the DEC-012 legal review itself (which is sign-off work, not an architectural choice). |