docs: add IP-PROVENANCE.md asserting ownership and dependency licenses - #309
Conversation
Public statement of provenance: personal project of Kyle Adomavicius, Apache-2.0, developed outside employment scope on personal hardware. Dependency license identifiers recorded from PyPI metadata as of 2026-07-19. Model weights noted as not distributed (manifest only). Co-Authored-By: Claude <noreply@anthropic.com>
|
CI PASS — flake8 + pytest fast suite ( |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5a4ff8a966
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Optional, per [requirements-extra.txt](requirements-extra.txt): | ||
|
|
||
| | Package | License | | ||
| |---|---| | ||
| | boxmot | AGPL-3.0 | |
There was a problem hiding this comment.
For Docker deployments, requirements-extra.txt is not optional: Dockerfile lines 36-43 install it unconditionally, so every built image includes boxmot and its AGPL-3.0 obligations even when [tracker] reid_enabled stays false. Labeling this dependency as optional in the IP provenance doc understates what is actually distributed in the deployed artifact; either document that container builds include it or make the install conditional.
Useful? React with 👍 / 👎.
1 participant
Summary
Adds a top-level
IP-PROVENANCE.mdrecording ownership and development provenance: personal project of Kyle Adomavicius under Apache-2.0 (matching LICENSE), developed outside employment scope on personal time and personally owned hardware, with the public commit history as the contemporaneous record. Lists runtime / optional / dev dependencies from the actual requirements files with license identifiers as published on PyPI (2026-07-19), notes the container base image and external services, and states that model weights are not distributed (checksum manifest only).Test plan
Adversarial review
adversarial-requiredCI job decides.Risk
Docs-only. Every claim is sourced from files in this repo (LICENSE, requirements manifests, models/manifest.json) or live PyPI metadata; revert-safe.