chanora/docs/governance/legal-review-readiness.md

# Legal review readiness — DEC-012 sign-off checklist

| Version | Date | Status |
|---|---|---|
| 0.1.0 | 2026-05-15 | Initial draft alongside v1.0.0-rc.1 |

## Purpose

DEC-012 in `product-decision-register.md` records the legal /
trademark / licensing review as the **only** outstanding gate before
the MVP public release per DEC-001 sequencing. That decision was
accepted as a *release gate* on 2026-05-14; the actual review work
has not been performed.

This document is the engineering-side handoff package for that
review. It enumerates exactly what the reviewer needs to confirm,
points to the artefacts in this repository that answer each item,
and lists the work the reviewer must perform that the engineering
side cannot.

Engineering does **not** make legal decisions. Items marked
"engineering: done" mean the underlying technical artefact is in
place; the corresponding legal confirmation is still required.

## Scope

Reviewer is expected to confirm or correct each of the following
before `v1.0.0-rc.1` is promoted to `v1.0.0` and any release
artefact is published publicly or to a store.

### 1. Trademark — "Chanora"

* **DEC-018** accepted "Chanora" as the public product name.
* Engineering: name appears in `Cargo.toml`, `pubspec.yaml`, the
  About dialog, the AppBar title via the `appTitle` localisation
  key, and every commit message.
* **Reviewer action**:
  - Trademark registrability check in target jurisdictions (CN, US,
    EU at minimum, per DEC-002 target platforms' user base).
  - Confirm no conflicting registration in voice-communication
    software / mobile-app categories.
  - Issue go / no-go ruling. A no-go ruling triggers a rename which
    invalidates `v1.0.0-rc.1` and forces a new RC.

### 2. Non-affiliation statement — TeamSpeak

* **DEC-019** accepted the working wording:
  > Chanora is independent and is not affiliated with, endorsed by,
  > sponsored by, or officially associated with TeamSpeak.
* Engineering: that exact sentence ships in:
  - `NOTICE` (top of file).
  - `README.md` `## License and trademark` section.
  - The in-app About dialog (English: `aboutNonAffiliation` ARB key;
    Chinese Simplified: `aboutNonAffiliation` in `app_zh.arb`,
    translated by an engineer — translation should be reviewed for
    legal precision).
* **Reviewer action**:
  - Confirm the English wording is sufficient under target-market
    consumer-protection and unfair-competition statutes.
  - Confirm the Chinese-Simplified translation does not weaken the
    statement.
  - Confirm there is no remaining text anywhere in the product that
    could imply affiliation (search hints: "TeamSpeak", "official",
    "endorsed").

### 3. Trademark usage — "TeamSpeak"

The product documentation and UI strings reference "TeamSpeak" in
several places where we describe interoperability (e.g.
"TeamSpeak-compatible servers"). This is nominative use.

* **Reviewer action**:
  - Confirm each occurrence of "TeamSpeak" in user-facing strings,
    documentation, and store metadata is permissible nominative
    use under target-jurisdiction trademark law.
  - Recommend a `™` or `®` symbol convention if required.

### 4. License posture — Chanora's own code

* **DEC-020** accepted dual-license **Apache-2.0 OR MIT**.
* Engineering: the texts ship as `LICENSE-APACHE` and `LICENSE-MIT`
  at the repository root; the aggregator `LICENSE` references both.
  Cargo-level package manifests carry `license.workspace = true`
  pointing to `Apache-2.0 OR MIT` in the workspace `Cargo.toml`.
* **Reviewer action**:
  - Confirm the dual-license declaration is consistent with all
    contributor agreements (none in place yet — see open items).
  - Confirm `LICENSE` file contents satisfy each app store's source-
    code-availability and inbound-license requirements.

### 5. Third-party license posture — direct dependencies

* `NOTICE` enumerates the direct dependency list as of v1.0.0-rc.1.
* Each direct dependency is permissively licensed
  (`MIT`, `Apache-2.0`, `MIT OR Apache-2.0`, `BSD-3-Clause`).
  No GPL / LGPL / AGPL surfaces in the direct set.
* **Reviewer artefacts** checked into the repository:
  - `docs/security/license-inventory.md` and
    `docs/security/license-inventory.html` — full transitive Rust
    inventory generated by `cargo about generate` from
    `about.toml`. Covers 364 crates across the workspace.
  - `docs/security/flutter-license-inventory.md` — Flutter / Dart
    inventory generated by `tools/dump_flutter_licenses.sh`.
    Covers 94 packages including the Flutter SDK BSD-3-Clause
    text.
  - `deny.toml` — `cargo deny` configuration enforcing the
    DEC-020 license posture as a CI guardrail. The `supply-chain`
    job in `.github/workflows/ci.yml` runs `cargo deny check` on
    every push and PR.
* **Reviewer action**:
  - Confirm the `NOTICE` enumeration matches what the build tooling
    actually links by spot-checking against the inventories above.
  - Confirm each direct dependency's attribution obligations are
    satisfied (Apache-2.0 requires a copy of the license text, the
    NOTICE entry, and a list of changes in any modified copies).
  - Confirm no copyleft transitive dependency creeps in via
    `tsclientlib` or `cpal`. The most likely failure mode is a
    crypto / DSP subdep with LGPL coverage; `cargo deny` config
    should refuse those.

### 6. `tsclientlib` posture specifically

The project pins `tsclientlib` to a specific commit
(`04aa249` on `https://github.com/ReSpeak/tsclientlib`). The crate is
upstream-licensed `MIT OR Apache-2.0`. It implements the
TeamSpeak 3 protocol from publicly observed behaviour, not from
TeamSpeak proprietary sources.

* **Reviewer action**:
  - Confirm linking against `tsclientlib` does not by itself create
    a derivative-work obligation under TeamSpeak's own licenses or
    EULAs.
  - Confirm using `tsclientlib` to talk to third-party
    TeamSpeak-protocol servers does not create a trademark or
    contract-tort exposure.

### 7. Crypto + secure-storage compliance

* `chacha20poly1305` (Apache-2.0 OR MIT) provides envelope
  encryption for the identity at rest and bookmark passwords.
* `keyring` (Apache-2.0 OR MIT) hits the platform Secret Service /
  Keychain / Credential Manager for the DEK.
* No symmetric or asymmetric primitive other than the above is
  introduced by Chanora's own code; `tsclientlib` carries its own
  protocol-level crypto.
* **Reviewer action**:
  - Confirm export-control posture for the resulting binary
    (cryptography category determination, ECCN, any EAR self-
    classification needed for store distribution).
  - Confirm any privacy-statement updates required by jurisdictions
    that treat persistent device identifiers as personal data.

### 8. Data handling — DEC-016 / DEC-017

* **DEC-016** No automatic diagnostic upload. The `export_diagnostics`
  bridge function is invoked only on user action and the redacted
  output is local-only (Clipboard or share-sheet).
* **DEC-017** Crash reporting disabled. Repository grep for
  `sentry|crashlytics|bugsnag` returns zero hits as of v1.0.0-rc.1.
* Engineering: diagnostics redaction is enforced at write-time by
  the in-bridge `RedactingLogLayer`; tests
  `chanora_diagnostics::tests::*` cover the policy.
* **Reviewer action**:
  - Confirm privacy policy text aligns: no telemetry, no automatic
    upload, no crash reporting in MVP.
  - Confirm app-store privacy-label entries are consistent.

### 9. Store-listing copy

Out of scope for engineering; reviewer drafts and validates per
DEC-002 staged platform list:

  - Google Play Store (Android arm64-v8a)
  - Apple App Store (iOS, MVP gate)
  - Microsoft Store / direct (Windows)
  - Mac App Store / direct (macOS)
  - Linux (direct distribution; no store)

## Open engineering work blocking sign-off

These are concrete items that engineering must close before the
reviewer's work can complete. They do **not** require legal input
themselves — they are listed here so the reviewer's scope is clear.

| # | Item | Status |
|---|------|--------|
| 1 | `cargo about generate --workspace` output checked into `docs/security/license-inventory.{md,html}` | **Done** (v1.0.0-rc.2 candidate) — generated from `about.toml`. 364 transitive crates enumerated; CI fails on staleness. |
| 2 | Flutter `LicenseRegistry` dump checked into `docs/security/flutter-license-inventory.md` | **Done** (v1.0.0-rc.2 candidate) — generated by `tools/dump_flutter_licenses.sh`; 94 packages enumerated; CI fails on staleness. |
| 3 | `cargo deny check licenses` (with allow-list mirroring DEC-020) | **Done** (v1.0.0-rc.2 candidate) — config at `deny.toml`, CI job `supply-chain` runs `cargo deny check` on every push. |
| 4 | Live iOS and macOS build artefacts | **Open** — DEC-002 staged release allows deferring; today neither has a live build. See `staged-release-plan.md`. |

## Out-of-scope

The following are *not* part of DEC-012 and have their own owners
and decisions:

* Cryptographic primitive selection (`chacha20poly1305`, key sizes,
  KDF choice) — Security Architect; closed by DEC-013.2.
* Codec choice (Opus) — Software Architect.
* TLS / connection security — falls inside `tsclientlib`.