Documentation

Commercial Compliance Report

This document tracks whether StratoSort Stack is ready for commercial distribution.

Current Decision

Decision: Go (subject to per-platform binary completion and ongoing license-attribution upkeep)
Date: 2026-09-14
Reason: The repository license is PolyForm Noncommercial 1.0.0 for personal/noncommercial use; commercial rights are sold separately. All bundled npm dependencies and model artifacts that remain in the catalog have explicit, commercially-compatible licenses or are covered by a documented attribution obligation surfaced in the installer (THIRD_PARTY_NOTICES.md shipped as extraResources).

Scope Covered

npm dependencies (direct + transitive) via package-lock.json
Runtime and packaging configuration via electron-builder.json
Downloaded model artifacts in src/shared/modelRegistry.js
Bundled runtime binaries (llama-server, FFmpeg) shipped under assets/runtime/
Asset and documentation licensing consistency

Evidence Artifacts

Project license: LICENSE (PolyForm Noncommercial 1.0.0; commercial license sold separately)
Machine-readable inventory: docs/commercial-use-inventory.json
Model license matrix: docs/commercial-model-licenses.json
Temporary legal waivers: docs/commercial-compliance-waivers.json
Dependency audit process notes: see Appendix A below
Third-party attribution shipped with installer: docs/THIRD_PARTY_NOTICES.md
FFmpeg LGPL attribution shipped with installer: assets/runtime/ffmpeg/NOTICE.md

Risk Summary (Current Snapshot)

Project license risk: allowed (PolyForm Noncommercial 1.0.0 with commercial licenses sold separately; classified by scripts/compliance/commercial-compliance-lib.js#classifyProjectLicense).
Dependency risk counts as of 2026-10-27 (regenerated by npm run compliance:commercial:build; see dependencySummary in docs/commercial-use-inventory.json for live figures):
- allowed: 2330
- review_required: 31 (sharp/libvips Apache-2.0 + LGPL-3.0-or-later, MPL-2.0 packages — obligations satisfied by THIRD_PARTY_NOTICES.md + LGPL source-offer link)
- high_risk: 0
- unknown: 0 (commercial-compliance-waivers.json is currently empty)
Model risk counts as of 2026-10-27 (modelSummary):
- allowed: 10
- review_required: 1 (Llama 3.2 — Llama Community License obligations met by shipping the license text in THIRD_PARTY_NOTICES.md plus "Built with Llama" attribution)
- high_risk: 0
- unknown: 0

Per-Platform Bundling Status

Component	Windows	macOS	Linux
All npm deps + native modules	bundled	bundled	bundled
Vision runtime (`llama-server`)	bundled	bundled	bundled
Tesseract.js WASM + lang data	bundled	bundled	bundled
FFmpeg (LGPL)	bundled	bundled (self-hosted build)	bundled (BtbN static)
LLM/embedding/vision GGUF models	user-fetched at first run	user-fetched at first run	user-fetched at first run

End-user post-install setup is limited to selecting and downloading model files. No other manual installation steps are required. Linux x64/arm64 dist builds bundle a static LGPL FFmpeg (BtbN); Windows arm64 ships without a bundled FFmpeg (no upstream LGPL build) and falls back to a system ffmpeg on PATH. The PATH fallback also applies when SKIP_FFMPEG_RUNTIME=true.

Required Ongoing Discipline

Keep THIRD_PARTY_NOTICES.md in sync with bundled binaries and dependencies.
Keep assets/runtime/ffmpeg/NOTICE.md source-offer link pointing at the exact build SHA in use.
Run npm run compliance:commercial:verify before each release; the CI gate (npm run ci) already enforces it.
Re-evaluate model catalog additions through commercial-model-licenses.json before exposing them to users.
Monitor Llama 3.2 Additional Commercial Terms (700M MAU threshold) — not a current concern at our scale.

Ongoing Verification

Run:

npm run compliance:commercial:build
npm run compliance:commercial:verify

The verify step fails on high_risk and unknown dependency/model entries that are not explicitly listed in docs/commercial-compliance-waivers.json.

Appendix A: Pre-Release License Audit Process

Before each major release, verify production dependency licenses remain compatible with the intended distribution model.

Regenerate the report

npm run licenses:production

Review the JSON for GPL, AGPL, SSPL, or other strong copyleft terms that may conflict with a commercially licensed distribution of this app. Native addons (sharp, better-sqlite3, node-llama-cpp, @napi-rs/canvas, lz4-napi) often pull MIT/BSD/Apache-style licenses; still confirm transitive packages.

For complete commercial-readiness status (dependencies + models + binaries + waivers), use:

npm run compliance:commercial:build
npm run compliance:commercial:verify

docs/licenses-production.json is gitignored. It is derived from package-lock.json through the same inventory as the compliance gate: every package that is not dev: true, plus the BUNDLED_RENDERER_DEPS closure (scripts/compliance/commercial-compliance-lib.js) that webpack compiles into the renderer bundle despite living in devDependencies. Generate it locally or in CI before each release and review for new copyleft entries. npm run audit:bundled (part of npm run ci) applies the same closure to npm audit, which --omit=dev would otherwise skip.

Standing notes from the 2026-05 review

Project license: Root LICENSE is PolyForm Noncommercial 1.0.0. Commercial rights are sold separately (docs/COMMERCIAL.md). Third-party obligations attach to the components inventoried in THIRD_PARTY_NOTICES.md.
sharp / @img/sharp-*: Reported as Apache-2.0 AND LGPL-3.0-or-later. LGPL-3.0 obligations (license text + written offer of source for libvips) are satisfied by THIRD_PARTY_NOTICES.md, which ships with the installer via extraResources in electron-builder.json.
jszip: (MIT OR GPL-3.0-or-later) — dual license; we elect the MIT path. Recorded in THIRD_PARTY_NOTICES.md.
Unknown-license transitive entries: None as of 2026-10-27. If one appears, verify its license upstream and record a waiver in docs/commercial-compliance-waivers.json (with a follow-up to remove it once the upstream SPDX metadata is fixed); the file's own notes describe the requirements.
Bundled FFmpeg: LGPL-3.0 binary on Windows (x64), macOS (x64/arm64), and Linux (x64/arm64); Windows arm64 relies on a system ffmpeg on PATH. Attribution and source-offer live in assets/runtime/ffmpeg/NOTICE.md, also shipped via extraResources.

Appendix B: Third-Party Attribution

For the canonical list of bundled third-party components, their licenses, and attribution text shipped to end users, see THIRD_PARTY_NOTICES.md.

That file is the source of truth and is bundled into the installer via extraResources in electron-builder.json. The in-app "Legal Notices" view loads it at runtime (src/main/ipc/system.js). Do not rename or move it without updating both references.

Edit this page on GitHub