Licences

Reference implementation for this whole manifest system. LICENSE (unmodified GPL-3.0 text) + MODIFICATIONS.md (GPL-3.0 §5(a) change notice) both present in the repo. Corresponding source for the exact deployed version is also bundled with the built app itself (source.tar.gz alongside index.html, produced by pulse-dashboard/scripts/build_mesh_clients.sh). Intended deploy target per pulse-crowdsense-events#53 is client.crowdsense.events, but that issue's 'build + deploy' sub-task is still unchecked — live status not confirmed, property_url left null until verified.

MODIFICATIONS.md content read in full via `gh api repos/artefactgroup/web-flasher-crowdsense/contents/MODIFICATIONS.md` (previously only confirmed present, not re-read). It matches the proven client-web-crowdsense pattern exactly: GPL-3.0 §5(a) change notice stating visual-rebrand-only scope, explicit list of what was deliberately left intact, and a corresponding-source pointer to source.tar.gz bundled alongside the deployed static build (produced by pulse-dashboard/scripts/build_mesh_clients.sh). LICENSE also diffed byte-for-byte against upstream meshtastic/web-flasher's LICENSE via GitHub API and confirmed identical, unmodified GPL-3.0-only text. Both required GPL-3.0 obligations (unmodified licence text + §5(a) change notice) are met and were actually read this pass, not assumed.

Independently re-verified the same way as scout.json (not just copied over): pulled agno-agi/context's and wesleypearson/context's root listings via GitHub API — no NOTICE file in either, so nothing to retain. `diff` of both LICENSE files confirms byte-identical unmodified Apache-2.0 text. No rebrand performed yet. Same upstream org (agno-agi) as scout, same finding, checked separately.

LICENSE diffed byte-for-byte against upstream camthink-ai/NeoMind's LICENSE via GitHub API — identical, unmodified Apache-2.0 text. Upstream has no NOTICE file (confirmed via repo root content listing), so there is nothing to retain. Apache-2.0 permits stripping visible branding as long as licence/copyright text in the source tree survives, which it does — obligations met and actually checked, not assumed.

The previously-flagged meshtastic-bridge extension HAS now landed (present at extensions/meshtastic-bridge/ as of this pass, was absent last check) — re-checked it directly rather than re-flagging blind. It's a first-party, from-scratch Rust implementation (own src/tests/tools, no protoc/build-time dependency on Meshtastic's own code) that talks the Meshtastic wire protocol over MQTT/serial; its Cargo.toml declares `license = "Apache-2.0"` and has no dependency on any Meshtastic-published crate. It does not vendor GPL-3.0 Meshtastic source, so the copyleft-contamination concern flagged earlier does not apply — no MODIFICATIONS.md is needed for that subdirectory. Separately, LICENSE (MIT) diffed byte-for-byte against upstream camthink-ai/NeoMind-Extensions via GitHub API and confirmed identical, including the 'Copyright (c) 2026 CamThink Team' line — retained unmodified. Marketplace itself is unbranded (see unbranding.scope), so this is a straightforward pass: unmodified MIT licence text retained, nothing vendored that would need extra treatment.

Verified via GitHub API: neither agno-agi/scout (upstream) nor wesleypearson/scout (our fork) ship a NOTICE file at repo root — full root listing pulled for both, no NOTICE present in either, so there is nothing for Apache-2.0 §4(d)'s NOTICE-passthrough obligation to apply to. `diff` of both repos' LICENSE files (fetched via `gh api repos/.../contents/LICENSE`) confirms byte-identical, unmodified Apache-2.0 text. No visual rebrand has been done yet (SSO gating + reverse proxy only), so no change-notice or re-branding obligation is triggered either. Apache-2.0's obligations for our current usage are fully met and were actually checked, not assumed.

Checked locally (repo present at ~/Documents/GitHub/scan-admitme-io). LICENSE diffed byte-for-byte against upstream alfio-event/Alf.ioBackoffice's LICENSE via GitHub API — identical, unmodified Apache-2.0 text. Upstream has no NOTICE file (confirmed via repo root listing), so there's nothing to retain. Since no modifications have been made at all, every Apache-2.0 obligation (retain licence text, retain copyright notices, carry a NOTICE file if one exists) is trivially met today — unlike its GPL-3.0 sibling admitme-ticketing, Apache-2.0 doesn't require a change-notice when a rebrand eventually does land here, only that LICENSE stays intact.

Verified by cloning getnao/nao (main, 2026-08-06) and reading LICENSE in full: it's dual — Apache-2.0 for the project overall, except files with a leading `/* @license Enterprise */` comment, which fall under a separate nao Labs Commercial License requiring a paid Enterprise subscription to use in production. `grep -r '@license Enterprise'` across the whole tree found the marker only in apps/frontend (OIDC/Microsoft SSO, white-label branding, the enterprise settings route) and apps/backend (license.service.ts, license-startup.ts, branding.service.ts, license-endpoints.ts) — i.e. the hosted product's auth/branding/licensing layer. None of it touches cli/nao_core/config/**, which is what ingest/nao_config.snippet.yaml actually exercises (the `databases:` postgres-registration fields cited in that file's own source comments all resolve to cli/nao_core/config/databases/{postgres,base}.py and config/secrets.py — plain Apache-2.0 Python, no Enterprise marker present in any of those files). GitHub reports the repo's licence as 'Other/NOASSERTION' rather than Apache-2.0, consistent with the dual-licence split rather than a red flag. Since (a) we run the vendor's own unmodified getnao/nao:latest image with no code changes of our own, and (b) our only customisation (nao_config.yaml's databases: entry) lives entirely in the Apache-2.0 portion of the tree, no Enterprise-gated functionality is invoked by our usage pattern. Caveat: this holds only as long as OIDC/Microsoft SSO, white-labeling, or other apps/frontend|backend Enterprise features stay unconfigured — re-check if any of those get turned on.