License Attribution Compliance

License Attribution Compliance

TT-Studio is Apache-2.0 © Tenstorrent AI ULC and ships under a strict regime. This skill keeps third-party attribution correct when dependencies or bundled assets change. There are two layers:

• Deterministic gate — dev-tools/check_license_attribution.py, meant for CI on every PR. It catches mechanical drift: a stale frontend license file, or a newly added dependency that nobody attributed.
• Judgment review (this skill) — classify the actual license, flag NonCommercial / copyleft / provenance risks, and write the attribution in the right place using the repo's established patterns.

Run the gate first, then reason about whatever it surfaces.

The repo's attribution surfaces

Step 1 — run the gate

python3 dev-tools/check_license_attribution.py            # both checks
python3 dev-tools/check_license_attribution.py --check-frontend
python3 dev-tools/check_license_attribution.py --check-new-deps --base origin/main

• Frontend freshness FAIL → cd app/frontend && npm run generate-license, commit the result. (Needs node; the check SKIPs where node is absent.)
• New-dep attribution FAIL → continue to Step 2 for each named dep.

Tool pin: generate-license-file is pinned to 4.0.0 in app/frontend/package.json. 4.1.0+ silently drops react/react-dom from the output. The script regenerates with @4.0.0 explicitly. Do not loosen the pin.

Step 2 — classify the license

Find each dependency's real license (npm: its package.json/repo; pip: PyPI/repo). Models, datasets, and weights often carry a different, more restrictive license than the code that loads them — check both.

You are not a lawyer — for anything copyleft, NonCommercial, or of uncertain provenance, flag it to whoever owns IP/legal rather than silently attributing it.

Step 3 — attribute in the right place

• Frontend prod dep → already handled by regenerating third-party-licenses.txt. Add a root-LICENSE bullet too if it's notable/headline.
• Notable / distributed dep (any language) → add a bullet to the "Third-Party Dependencies" list in the root LICENSE, matching the existing form: - <Name> (<SPDX>) [License available here](<upstream-license-url>).
• Runtime-only backend dep, not distributed → acknowledge in dev-tools/license_attribution_allowlist.txt (one name per line). This is the "considered, no LICENSE entry needed" escape hatch the gate honors.

Step 4 — bundled binaries / models / weights (the high-risk case)

A checked-in .onnx/.bin/weights file is distributed, so its license travels with the repo, and you can't put an SPDX header inside a binary. Convention:

• Add a sidecar README.md next to the file stating exactly how it was produced (self-trained vs. derived/fine-tuned from an upstream model) and under what license.
• If it's derived from a NonCommercial-licensed model, it inherits that license (e.g. ShareAlike) — that's a blocker for commercial use, not a notice you can write your way out of. Confirm provenance before shipping.

Worked example — Wake mode (the case this skill was built from)

• openWakeWord package: Apache-2.0 code ✅ — but its pre-trained models are CC BY-NC-SA 4.0 (NonCommercial). The Apache link attributes the code only.
• Silero VAD (MIT) + @ricky0123/vad-web (ISC) — frontend, permissive ✅, covered by third-party-licenses.txt + a LICENSE bullet.
• hey_quiet_box.onnx (checked in) — needs a sidecar README: self-trained → Apache-2.0 ✅; derived from an openWakeWord model → inherits CC BY-NC-SA 🛑.
• Smell: code that download_models([...]) an NC-licensed asset at runtime onto a deployed box even when only the Apache-2.0 preprocessing models are used — fetch only what you use, or document it.

Wiring into GitHub Actions (when ready)

Run the gate on pull_request (mirror the triggers in .github/workflows/backend-license-checker.yml). The runner needs node for the frontend check:

# license-attribution.yml (sketch)
on:
  pull_request:
    branches: [main, staging, dev]
    types: [opened, reopened, synchronize]
jobs:
  attribution:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }            # need base ref for --check-new-deps
      - uses: actions/setup-node@v4
        with: { node-version: 22 }
      - run: cd app/frontend && npm ci       # installs pinned generate-license-file@4.0.0
      - run: python3 dev-tools/check_license_attribution.py --base "origin/${{ github.base_ref }}"

To "tag this skill to run" in Actions (judgment review on the diff, beyond the deterministic gate), invoke Claude Code headless in a job step, e.g. claude -p "/license-attribution-compliance review this PR's dependency changes", after checkout — keep the deterministic gate as the always-on blocking check.