dtourolle/JRay-public-server
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(licence): contributed manifests are CC0 1.0

Browse Source 
Contributed manifests were in no declared condition at all, which left §9a
replication with no grant flowing through it: peers mirror each other's
catalogues wholesale, and every hop of that was unlicensed.

CC0 rather than a share-alike licence, because a share-alike works by asserting
a right in the data and then conditioning its use. The position in
docs/legal-posture.md §3 is that presence timings are facts rather than
protectable expression — asserting copyright in them in order to license them
would contradict that argument in the same repository, and that contradiction is
worth more to an opponent than the licence is worth to us. CC0 also waives the
sui generis database right by name, closing the EU-specific residual exposure
from the contributor's side.

The grant is taken at token issuance, and that is not incidental. There are no
accounts, so there is no sign-up to attach terms to, and a manifest arrives over
POST /manifests with no channel to negotiate over. Acquiring the contribute
capability is the only moment a grant can be made, so POST /tokens now returns
the licence and its terms alongside the token — a licence the server publishes
but never delivers is one no contributor agreed to.

The test pins the scope limit as well as the identifier. Bounding the grant to
the manifest is the half that can fail silently: a reworded term reading onto
the underlying work would purport to grant what no contributor can.

Also records the settled code-licence position across all four repositories in
the legal posture, correcting an earlier claim there that the plugin and
extraction repos declared nothing. Both already carried LICENSE files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: UR-019 | PR-006
This commit is contained in:
dtourolle
2026-07-31 10:43:43 +02:00
co-authored by Claude Opus 5
parent d5dd8113ef
commit 4afa36e7a2
8 changed files with 298 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/legal-posture.md
+44 -17
View File
@@ -333,10 +333,15 @@ inapplicable for the simple reason that there are no links.
## 6. The licence Jmanifests are published under
**Recommended: CC0 1.0 Universal.** This matches MusicBrainz core data and
**Adopted: CC0 1.0 Universal** — recorded in SPEC §5b, full text in
[`LICENSE-DATA`](../LICENSE-DATA). This matches MusicBrainz core data and
AcousticBrainz exactly, and it is the one choice consistent with the rest of this
document.
Note the separation, which must not be blurred: the **code** is
`GPL-3.0-or-later`, the **data** is CC0. The code licence says nothing about the
manifests, and the manifests are the part that replicates between instances.
**Why CC0 and not a share-alike licence.** AcoustID uses CC BY-SA 3.0, and the
temptation is to follow it — but a share-alike licence works by *asserting* a
right in the data and then conditioning its use. §3 argues at length that
@@ -365,12 +370,13 @@ position §3 actually takes.
closed commercially — which is the failure mode this whole ecosystem learned
from.
**The grant must be taken at upload.** A licence the server declares is worth
nothing if contributors never granted it. The contribution terms must state that
submitting a manifest places its content under CC0, and the JRay plugin's
contribution opt-in (SPEC §9) is where a user encounters that — it is already an
**The grant is taken at token issuance.** A licence the server declares is worth
nothing if contributors never granted it, so `POST /tokens` returns the licence
and its terms alongside the token — there are no accounts, so acquiring the
contribute capability is the only moment at which a grant can be made. The JRay
plugin's contribution opt-in (SPEC §9) is where a user encounters it: already an
explicit, off-by-default choice, so this adds a sentence to a decision the user
is already making rather than a new one.
is making anyway rather than a new one.
**Scope, stated precisely.** The licence covers *the manifest* — the timings,
identifiers and signature contributed. It does not and cannot purport to license
@@ -378,10 +384,30 @@ the underlying film, which is not the contributor's to license and which the
server does not hold. This distinction is the whole of §§1–4 restated in a
sentence, and it belongs in the terms in exactly that form.
> **Status: recommended, not yet adopted.** No repository currently carries a
> `LICENSE` file, and nothing outside this document states a data licence.
> Adopting this means a recorded decision, a `LICENSE` file, a line in the
> contribution terms, and a sentence in the plugin's contribution opt-in.
> **Status: adopted.** Recorded in SPEC §5b as `UR-019`, with the text in
> [`LICENSE-DATA`](../LICENSE-DATA) and the grant delivered by `POST /tokens`.
### Code licences, for completeness
Distinct from the above, and settled across all three repositories:
| Repository | Code licence | File |
|---|---|---|
| `JRay-public-server` | `GPL-3.0-or-later` | `LICENSE` — verified byte-identical to the FSF text |
| `jRay` (plugin) | `GPL-3.0` | `LICENSE` |
| `scene-actor-extraction` | `MIT`, with a model/third-party addendum | `LICENSE` |
Two notes an operator or contributor may need:
- **The MIT/GPL split is directionally fine.** MIT-licensed extraction output and
code can be used by the GPL components; the reverse would not hold. Nothing in
the current data flow runs the wrong way.
- **`scene-actor-extraction`'s addendum is the one to actually read.** It records
that some bundled models are licensed for **non-commercial research use only**,
which is a restriction on *deploying the extraction pipeline* and has no
bearing on the manifests it produces or on this server. The distinction matters
precisely because CC0 manifests could otherwise be mistaken for a statement
about the tooling that generated them.
---
@@ -500,13 +526,14 @@ than as incremental features:
6. **Keep the kill switch usable.** SPEC §5a makes delisting a single `UPDATE`:
one manifest, every manifest from a token, or every manifest for a title.
Delisting is instant and reversible; deletion is a separate, logged action.
7. **Adopt a data licence and add a `LICENSE` file.** §6 recommends CC0 1.0.
No repository currently carries one, and the server's `GPL-3.0-or-later`
covers the *code* only — it says nothing about the manifests, which are the
thing that actually replicates between instances. This is the largest
outstanding gap in the posture.
8. **State the licence in the contribution terms**, so contributors grant it
rather than the server merely declaring it (§6).
7. **Do not modify the contribution terms without re-reading §6.** The data
licence is CC0 1.0 (SPEC §5b), delivered by `POST /tokens`. Its scope limit —
the manifest, never the underlying work — is the operative half, and a
reworded term that blurs it grants something no contributor can grant.
8. **Ship both licence files with any distribution.** `LICENSE` (code,
`GPL-3.0-or-later`) and `LICENSE-DATA` (manifests, CC0 1.0) answer different
questions, and a package containing only the first leaves the question that
actually matters for federation unanswered.
---
docs/requirements.md
+2
View File
@@ -45,6 +45,7 @@ requirement and no fixture-generation step, unlike `scene-actor-extraction`.
| UR-016 | Accept and store `extraction.gallery_scope`; rank on it (§7) | SR-003 | Medium | Done |
| UR-017 | Accept per-window belief and identification route; `scenes` are objects | SR-003 | High | Done |
| UR-018 | Exclude belief and route from `content_id`, replicating them as attributes | SR-003 | High | Done |
| UR-019 | Contributed manifests are CC0 1.0; the grant is delivered with the token, not merely published | PR-006 | High | Done |
### Notes on status
@@ -133,6 +134,7 @@ topology is the point, so this is a deliberate choice rather than an oversight.
| UR-012 | T2 | No endpoint accepts embeddings or image data | An `embedding` or `crop` field is an unknown-field `400` |
| UR-013 | T1 | Stored windows are byte-identical to those submitted | Adjacent windows never merged; a window is never trimmed to a shorter one |
| UR-014 | T1 | Unknown `jmanifest_version` rejected | Version `2` and version `0` both refused, naming the field |
| UR-019 | T2 | `POST /tokens` returns the licence and its terms | The terms **bound the grant to the manifest** — a reading that covers the underlying work is the failure, not a missing field |
| DR-001 | T1 | Unknown field at any nesting depth fails to parse | `movie` and `jellyfin_id` named in the error |
| DR-003 | T1 | Concurrent writes serialize rather than returning `SQLITE_BUSY` | Failed transaction rolls back fully |
| DR-005 | T1 | Jobs lease once, reschedule with backoff, survive restart | Stranded lease released at startup; future job not leased early |
docs/traceability.md
+17 -9
View File
@@ -3,7 +3,7 @@
<!-- GENERATED FILE - do not edit by hand. -->
<!-- Regenerate: scripts/traceability/traceability-gate.sh -->
**Generated:** 2026-07-31T07:49:04+00:00
**Generated:** 2026-07-31T08:06:49+00:00
Denominators are read from [`requirements.md`](requirements.md) at run time, never hardcoded. Coverage counts a requirement only when it is tagged in source **and** has a verification tier this repo's CI host can execute (`T1, T2, static`).
@@ -14,10 +14,10 @@ Denominators are read from [`requirements.md`](requirements.md) at run time, nev
| Source files scanned | 29 |
| TRACES tags found | 43 |
| EXCEPTION tags found | 0 |
| Requirements defined | 32 |
| Requirements covered | 25 |
| **Coverage** | **78.1%** (25/32) |
| Coverage of CI-executable scope | 78.1% (25/32) |
| Requirements defined | 33 |
| Requirements covered | 26 |
| **Coverage** | **78.8%** (26/33) |
| Coverage of CI-executable scope | 78.8% (26/33) |
| Tagged but unexecuted in CI | 0 |
| Orphan tags | 0 |
@@ -25,7 +25,7 @@ Denominators are read from [`requirements.md`](requirements.md) at run time, nev
| Type | Covered | Tagged but unexecuted | Defined |
|---|---|---|---|
| UR | 15 | 0 | 18 |
| UR | 16 | 0 | 19 |
| DR | 10 | 0 | 14 |
- **PR** tags present (separate taxonomy, not counted in coverage): PR-004, PR-005, PR-006
@@ -77,6 +77,7 @@ _None._
| UR-016 | Done | T2 | SR-003 | untagged | - | Accept and store `extraction.gallery_scope`; rank on it (§7) |
| UR-017 | Done | T1, T2 | SR-003 | covered | `src/model.rs` | Accept per-window belief and identification route; `scenes` are objec… |
| UR-018 | Done | T1 | SR-003 | untagged | - | Exclude belief and route from `content_id`, replicating them as attri… |
| UR-019 | Done | T2 | PR-006 | covered | `src/api/upload.rs` | Contributed manifests are CC0 1.0; the grant is delivered with the to… |
| DR-001 | Done | T1 | SR-004 | untagged | - | Strict parse boundary: unknown fields rejected structurally, not by v… |
| DR-002 | Done | unset | SR-004 | covered | `src/api/fetch.rs`, `src/db/repo.rs` | Fully relational storage — no JSON blob on the write path |
| DR-003 | Done | T1 | PR-004 | covered | `src/db/mod.rs` | Single serialized writer connection, with a read pool alongside |
@@ -178,7 +179,7 @@ _None._
### PR-006
**Locations:** 9
**Locations:** 10
- [`src/api/federation.rs:66`](../src/api/federation.rs#L66) — `pub async fn get_changes(`
- [`src/api/federation.rs:108`](../src/api/federation.rs#L108) — `pub async fn get_manifest_by_content_id(`
@@ -186,6 +187,7 @@ _None._
- [`src/api/fetch.rs:127`](../src/api/fetch.rs#L127) — `pub async fn get_series(`
- [`src/api/upload.rs:29`](../src/api/upload.rs#L29) — `pub async fn post_manifest(`
- [`src/api/upload.rs:101`](../src/api/upload.rs#L101) — `pub async fn post_bundle(`
- [`src/api/upload.rs:245`](../src/api/upload.rs#L245) — `pub async fn post_token(`
- [`src/ingest.rs:50`](../src/ingest.rs#L50) — `pub fn persist(`
- [`src/validate.rs:572`](../src/validate.rs#L572) — `pub fn validate_bundle_envelope(b: &SeriesBundle) -> VResult<()>`
- [`src/worker.rs:107`](../src/worker.rs#L107) — `async fn run_federation_pull(&self, payload: &str) -> Result<(), JobError>`
@@ -233,7 +235,7 @@ _None._
- [`src/api/report.rs:56`](../src/api/report.rs#L56) — `pub async fn post_report(`
- [`src/api/upload.rs:29`](../src/api/upload.rs#L29) — `pub async fn post_manifest(`
- [`src/api/upload.rs:223`](../src/api/upload.rs#L223) — `pub async fn post_token(`
- [`src/api/upload.rs:245`](../src/api/upload.rs#L245) — `pub async fn post_token(`
- [`src/app.rs:26`](../src/app.rs#L26) — `pub fn router(state: AppState) -> Router`
- [`src/auth.rs:22`](../src/auth.rs#L22) — `pub fn hash_token(token: &str) -> String`
- [`src/auth.rs:76`](../src/auth.rs#L76) — `pub fn client_ip(headers: &HeaderMap, peer: Option<IpAddr>, trusted_proxies: &[IpAddr]) -…`
@@ -293,7 +295,7 @@ _None._
**Locations:** 6
- [`src/api/report.rs:56`](../src/api/report.rs#L56) — `pub async fn post_report(`
- [`src/api/upload.rs:223`](../src/api/upload.rs#L223) — `pub async fn post_token(`
- [`src/api/upload.rs:245`](../src/api/upload.rs#L245) — `pub async fn post_token(`
- [`src/auth.rs:22`](../src/auth.rs#L22) — `pub fn hash_token(token: &str) -> String`
- [`src/castcheck.rs:82`](../src/castcheck.rs#L82) — `pub fn evaluate(submitted: &[SubmittedActor], credits: &[CastMember]) -> CastCheckOutcome`
- [`src/castcheck.rs:215`](../src/castcheck.rs#L215) — `pub fn category_guard_violation(matched: &[MatchedActor], title_is_adult: bool) -> Option…`
@@ -379,3 +381,9 @@ _None._
- [`src/model.rs:191`](../src/model.rs#L191) — `Unknown`
- [`src/model.rs:232`](../src/model.rs#L232) — `pub fn from_stored(s: &str) -> Option<Self>`
### UR-019
**Locations:** 1
- [`src/api/upload.rs:245`](../src/api/upload.rs#L245) — `pub async fn post_token(`