edison/chanora
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0f418f1d7ec8d985eee53a8e67e2dade8efcdc71
chanora/CHANGELOG.md
T
EdisonJwa 0f418f1d7e feat(legal): resolve DEC-020 — dual-license under Apache-2.0 OR MIT 
Closes the only previously-open decision in the register. Chanora is
now dual-licensed under either:

  * Apache License, Version 2.0 (LICENSE-APACHE), OR
  * MIT License (LICENSE-MIT)

at the recipient's option. This is the standard Rust-ecosystem
permissive model and is compatible with every direct dependency
in the PoC tree:

  tsclientlib          MIT OR Apache-2.0
  flutter_rust_bridge  MIT
  cpal                 Apache-2.0
  rusqlite             MIT
  keyring              MIT OR Apache-2.0
  hound                Apache-2.0
  ndk-context, jni, android_logger, regex, serde, tokio,
  tracing, thiserror, zeroize, etc.   MIT OR Apache-2.0

and with the Flutter framework's BSD-3-Clause.

Files added:
  - LICENSE-APACHE  Apache 2.0 license text.
  - LICENSE-MIT     MIT license text with the standard 2026 copyright
                    line.

Files updated:
  - LICENSE     Now the dual-license aggregator. Includes the standard
                Apache-2.0 inbound-contribution clause ("Unless you
                explicitly state otherwise, any contribution
                intentionally submitted for inclusion in Chanora by you,
                as defined in the Apache-2.0 license, shall be
                dual-licensed as above, without any additional terms or
                conditions.").
  - NOTICE      Rewritten with the dual-license declaration and an
                inventory of direct dependencies with their upstream
                licenses. Transitive deps remain to be enumerated by
                build tooling (cargo about, Flutter LicenseRegistry).
  - README.md   §License section rewritten to point at LICENSE-APACHE
                and LICENSE-MIT.
  - docs/governance/product-decision-register.md v0.9.5 → v0.9.6:
    DEC-020 status: Open → Accepted. §4 license row updated. §6
    collapsed: every previously-Proposed or Open decision in the
    register is now resolved. DEC-012 legal review remains as a
    release-gating *work* item, but is not an open decision.
  - docs/governance/poc-results-summary.md v0.3.0 → v0.4.0:
    RISK-PoC-003 closed. DEC-020 row moved out of 'Still open'.

This is a license-model commitment, not a substitute for the
DEC-012 legal review. Per DEC-012 the actual legal review work
(transitive-dep OSS obligations, trademark registrability, final
sign-off on the non-affiliation wording) must still be completed
before any public/store release; that is sign-off work, not an
architectural decision.

Decision register state after this commit:
  Accepted:       23 of 23 unique decisions
  Open/Deferred:  0
  Proposed:       0
2026-05-14 20:53:04 +08:00

137 lines
6.7 KiB
Markdown
Raw Blame History

# Changelog
All notable changes to Chanora will be documented in this file.
This project is expected to follow a Conventional Commits style workflow.
## [Unreleased]
### Added
- `LICENSE-APACHE` — Apache License Version 2.0 text (DEC-020).
- `LICENSE-MIT` — MIT License text (DEC-020).
- Initial repository foundation files.
- Documentation-first project structure.
- `justfile` with `format`, `lint`, `test`, `verify-docs`, and
`security-scan` targets, completing `repository-bootstrap-plan` v0.1.0 §3.
- `poc/tsclientlib-connect-spike/` — PoC proving protocol feasibility via
`tsclientlib`. Verified against `cn.teamspeak.app` on 2026-05-13.
- `poc/flutter_rust_bridge_hello/` — PoC proving the Flutter↔Rust command
and event-stream boundary via `flutter_rust_bridge` 2.12.0. Verified on
Linux desktop on 2026-05-13.
- `poc/secure-storage-spike/` — PoC proving platform secure storage via
a typed `SecretStorageRepository` trait and a Linux adapter selecting
between Secret Service (libsecret) and kernel keyutils. Audit checks
SS-AUD-001/002/003/005/006 and SS-TC-003 verified on 2026-05-13.
- `poc/sqlite-storage-spike/` — PoC proving SRS-089's "embedded data
store + migration mechanism" acceptance criteria: forward-only schema
migrator tracked via `PRAGMA user_version`, repository pattern with
`BookmarkRepository` / `SettingsRepository` traits over
`LocalDatabaseRepository`. 11/11 tests verified on 2026-05-13.
- `poc/diagnostics-redaction-spike/` — PoC proving the diagnostic
redaction policy from `diagnostic-redaction-audit-report.md`:
typed policy + regex rules + literal known-secret registry + bundle
redaction. Audit cases REDACT-TC-001..010 verified on 2026-05-13.
- `poc/audio-capture-playback-spike/` — PoC proving platform audio
capture/playback via cpal. Desktop half (Linux + PipeWire)
empirically verified end-to-end on 2026-05-13; mobile half closed
separately by `poc/audio-capture-playback-android-spike`.
- `poc/audio-capture-playback-android-spike/` — PoC closing the
mobile half of the audio capture/playback PoC plan entry. Rust
cdylib + JNI + Kotlin Android app; cpal targets Android's Oboe
backend (AAudio). Verified end-to-end on a physical Motorola
Moto G Stylus 5G (2023) running Android 14 arm64-v8a on
2026-05-13: 500 ms 440 Hz sine wave driven out the device speaker
(22,050 frames at 44.1 kHz) and 1 s captured from the microphone
into a valid 85,292-byte RIFF/WAVE mono 16-bit PCM file pulled via
`adb exec-out run-as`.
- `poc/README.md` summarising PoC status against
`docs/architecture/proof-of-concept-plan.md`.
### Changed
- **DEC-020 license resolved.** Chanora is now dual-licensed under
**Apache-2.0 OR MIT** (recipient's choice), the standard
Rust-ecosystem permissive model. Compatible with every direct
dependency (`tsclientlib`, `flutter_rust_bridge`, `cpal`, `rusqlite`,
`keyring`, etc.) and with the Flutter framework's BSD-3-Clause.
`LICENSE` rewritten as a dual-license aggregator pointing at
`LICENSE-APACHE` and `LICENSE-MIT`. `NOTICE` rewritten with current
direct-dependency attributions. `README.md` §License updated.
- `docs/governance/product-decision-register.md` bumped to v0.9.6:
DEC-020 status promoted from Open to Accepted. §4 license row
updated. §6 collapsed: there is no longer any open decision —
DEC-012 legal review remains as a *work* item, not a pending
decision. Change-history entry added.
- `docs/governance/poc-results-summary.md` bumped to v0.4.0:
RISK-PoC-003 closed. DEC-020 row moved from the "Still open"
section into the closed table.
- `docs/governance/product-decision-register.md` bumped to v0.9.5:
owner confirmation on all 17 previously-Proposed decisions
(DEC-001..010, 012, 015..019, 021). Sixteen were Accepted as
recommended; two were modified by the owner — **DEC-004**
Android minimum raised from API 24 to **API 28**, and
**DEC-015** product language for MVP expanded from English-only
to **English + Chinese (Simplified)**. DEC-020 license remains
Open / Deferred and is now the only public-release-gating
decision outstanding. §4 renamed "Recommended" → "Accepted MVP
Defaults" with MODIFIED rows annotated. §6 collapsed to the
single remaining DEC-020 item. §7 dated and statused for every
decision.
- `docs/governance/poc-results-summary.md` bumped to v0.3.0:
RISK-PoC-004 closed by the owner-confirmation pass; new
RISK-PoC-006 (Android `minSdk` move 24 → 28 for product code)
and RISK-PoC-007 (MVP language expansion to en + zh-Hans) added.
- `docs/architecture/proof-of-concept-plan.md` bumped to v0.3.0 to
promote the audio PoC from PARTIAL PASS to PASS after the Android
mobile half was closed; all six PoC plan entries are now PASS.
- `docs/governance/product-decision-register.md` bumped to v0.9.4 to
promote DEC-011.1 mobile half from Deferred to Accepted (Android),
keeping iOS Deferred.
- `docs/governance/poc-results-summary.md` bumped to v0.2.0:
audio row promoted to PASS, RISK-PoC-001 narrowed from "mobile
audio" to "iOS audio only", Android toolchain added to the
toolchain table.
- `poc/audio-capture-playback-spike/VERIFICATION.md` updated to point
at the Android spike for the mobile half.
- `poc/README.md` updated to list both audio spike directories.
- `docs/architecture/proof-of-concept-plan.md` bumped to v0.2.0 to
record PoC outcomes (5 PASS, 1 PARTIAL) and add a Status column.
- `docs/security/secure-storage-audit-report.md` bumped to v0.9.3:
SS-AUD-001/002/003/005/006 status set to PoC Pass with evidence
pointers; SS-TC-003 (Linux) Actual Result populated and Status set
to PoC Pass; findings SS-FIND-001..003 added; non-Linux test cases
marked Deferred.
- `docs/security/diagnostic-redaction-audit-report.md` bumped to
v0.9.3: REDACT-TC-001..010 status set to PoC Pass with evidence
pointers; export bundle policy §5 populated; findings
REDACT-FIND-001..003 added.
- `docs/governance/product-decision-register.md` bumped to v0.9.3:
owner-confirmed decisions recorded — DEC-014 Accepted
(`flutter_rust_bridge` 2.x pinned), DEC-013.1 Accepted (`rusqlite`
bundled), DEC-013.2 Accepted (Linux Secret Service preferred,
keyutils fallback), DEC-011.1 Accepted (desktop `cpal`) / Deferred
(mobile), DEC-022 Accepted (canonical implementation directory
layout per README sketch + SAD §7.2), DEC-020 explicitly Deferred
and remains a public-release blocker.
### Added (governance)
- `docs/governance/poc-results-summary.md` v0.1.0 — single-page
reviewer-facing summary of the PoC phase, the toolchain exercised,
the owner decisions taken, the audit coverage, and the open risks
RISK-PoC-001..005.
### Fixed
- N/A
### Security
- N/A
## Versioning note
The project implementation has not reached a public release version yet.
Reference in New Issue View Git Blame Copy Permalink