Repository navigation
licensing: Demucs pretrained weights are scientific-use only; block commercial packaging #1181
Description
Commercial-release blocker
BandScope currently uses the pretrained Demucs htdemucs checkpoint (955717e8-8726e21a.th) for real stem separation. The Demucs source code is MIT, but the upstream maintainer explicitly states that the model weights are not covered by MIT and are provided only for scientific purposes.
Primary upstream evidence: facebookresearch/demucs#327, maintainer adefossez, issue comment 1134828611:
The model weights are not covered by the MIT license, and are provided only for scientific purposes.
The issue was specifically opened by a user asking about distributing a pretrained Demucs model as part of a commercial project. A 2024 follow-up asking about converted/rehosted weights did not receive a superseding maintainer grant. Third-party mirrors or labels therefore cannot establish BandScope's commercial redistribution/use rights.
Current BandScope evidence
services/analysis-engine/pyproject.tomldepends on Demucs on supported platforms.services/analysis-engine/src/bandscope_analysis/separation/audio_separator.pyuseshtdemucsas the production separation model.- The upstream Demucs remote manifest identifies
955717e8-8726e21a.th;htdemucs.yamlmapshtdemucsto signature955717e8. - fix(project): enforce crash-safe revision-bound persistence #970 is tightening local checkpoint integrity/network-fail-closed behavior, but technical integrity does not create commercial model rights.
Required outcome
Do not ship, bundle, auto-download, or represent the upstream pretrained htdemucs weights as commercially licensed in a BandScope release unless ContextualWisdomLab obtains an explicit commercial-use/redistribution grant that covers the exact model artifact.
Commercial readiness requires one of:
- documented explicit rights from the relevant rights holder(s) for the exact Demucs weights and intended BandScope use/distribution; or
- replacement with a model whose weights and training-data-derived rights are commercially permitted and traceable; or
- a CWL-owned/retrained separation model with documented training-data rights, model license, reproducibility, recognized source-separation metrics, and Windows/macOS package evidence.
Any replacement must preserve or improve the real-audio rehearsal contract. Synthetic arrays or heuristic FFT masks are not scientific acceptance.
Acceptance
- Commercial model-use and redistribution basis is documented with primary evidence.
- Exact model artifact/version/full digest and provenance are immutable release inputs.
- Package/SBOM/supplemental component inventory/NOTICE and updater rollback reflect the admitted model.
- Ordinary local analysis has no hidden model download or paid/network fallback.
- Rights-cleared real decoded audio demonstrates separation quality using recognized MIR/source-separation metrics with uncertainty/claim boundaries.
- Mandatory Windows and macOS packaged builds pass offline audible acceptance.
- Public/release documentation does not imply rights broader than the actual grant.
Relationship
This is distinct from #1129 (libsndfile LGPL runtime path). #1129 governs the audio I/O dependency license; this issue governs pretrained model-weight rights. Both block commercial release independently.
Activity
docs(security): correct Demucs torch exception evidence
seonghobae commentedon Sep 14, 2026
Enforcement update from the current Distribution owner #1126 exact
a6e48e0f63e0eaa87e6304abb629fac80a66cd89:The legal blocker in this issue is now represented as fail-closed release policy instead of an informational note.
release/model-artifact-policy.jsonrecords upstreamdemucs/htdemucs/955717e8-8726e21a.thasblockedforcommercial-rights-not-established, cites this issue's primary upstream evidence, and has no admitted artifact. A version-tag release preflight therefore fails until the policy names exact commercially admissible model bytes with immutable evidence.This is enforcement, not a rights conclusion. Nothing in #1126 grants commercial use or redistribution rights to the upstream weights, and no mirror/conversion/checksum is treated as a substitute for a grant. A future admitted artifact must bind exact size/full SHA-256 plus rights/provenance/loader-policy evidence, and the tag packager executes that preflight before writing release artifacts.
Keep this issue open/blocked until there is primary evidence for the exact artifact or a commercially admissible replacement/CWL-owned model with traceable rights. #770 scientific acceptance and #1180 Distribution packaging/provenance/update acceptance remain independent.
seonghobae commentedon Sep 29, 2026
2026-09-29 source-separation commercial-rights review — actionable alternative evidence, NOT release approval
Reviewed protected
develop@314ddeae7b775a4957594b599358c8255617eb2e, current open related PR/issue search, Distribution #1126 (528ba04cbaf2228bd819e3313f06f849ab027fac), supply-chain correction #1184 (75e767945a07d610ad03b78f5cafbb3fba86b6b4), and Signal/MIR #828 (0ba16b192b66773f52df2af544896e3c2a432142). No reviewed successor supplies an admitted commercially licensed model plus exact-artifact real-audio/package evidence. #1126 still explicitly hasreleaseStatus: blockedandadmittedArtifact: null; #1184 corrects evidence rather than licensing weights; #828 remains Draft with no passing authorized live exact-candidate score. Draft loader hardening is not protected/released truth.New primary evidence: evaluate official Spleeter four-stem weights, not a third-party MIT mirror
The Spleeter authors' own official paper source states: “Spleeter source code and pre-trained models are available on github and distributed under a MIT license.” This is materially stronger than inferring a weights license from the repository's code license.
4stems.tar.gz, reported compressed size 146308147 bytes, URLhttps://github.com/deezer/spleeter/releases/download/v1.4.0/4stems.tar.gz.Important limits: the release API currently reports
immutable: falseand this asset'sdigest: null. This review has NOT downloaded or hashed those bytes. An asset ID/tag/size is an acquisition descriptor, not an immutable artifact receipt. Archive the primary rights evidence, preserve the actual MIT notice, obtain the bytes through the approved acquisition process, calculate full digests, record provenance, and obtain the organization's exact-artifact rights-admission decision before setting any release policy to admitted.The current README says the code is MIT; upstream deezer/spleeter#898 requests clarification of weights use/redistribution and its retrieved discussion contains no maintainer answer. Record this narrower wording and the authors' affirmative paper statement together. An unanswered issue is not itself a revocation of the paper's grant, but the ambiguity must not be hidden. The paper says training used internal data that cannot be released for copyright reasons; it does not publish a full chain-of-title dossier or grant rights to end-users' input recordings.
Decision proposal: shortest executable route, with distinct exit criteria
Prioritize route 2's Spleeter four-stem candidate for exact-artifact rights admission and an authorized comparative benchmark in #828/#770. Do not yet make it the production default. This is the lowest-external-dependency next step found, not a measured claim that it already preserves HTDemucs quality.
955717e8-8726e21a.thbytes, commercial local inference, bundling/CDN redistribution, end-user deployment, conversions/quantization, updates and rollback retention, territory/term and licensor authority. No grant, price, or delivery commitment has been found. The 2022 maintainer statement predates HTDemucs v4; keep the conclusion precise: commercial rights to the presently intended artifact have not been established, rather than claiming this review adjudicated every later artifact's legal status.#1180/#1126 continue to own acquisition, immutable publication, local-only loading, SBOM/NOTICE, Windows/macOS signing and update/rollback. #828/#770 own real-audio scientific evidence. This comment introduces no competing implementation lane, model bytes, dependency exception, license approval, purchase, external vendor communication, deployment or release.
Status remains open/blocked. New result: a concrete author-supported alternative rights basis and exact upstream candidate descriptor. Still missing: artifact acquisition/full digest, authorized admission, comparative real-audio results and signed/offline packaged acceptance. Integrity, licensor authority, model permission, input-music rights and scientific validity remain separate claims.
test(analysis): require local-only UMX-HQ candidate contract
test(analysis): add strict offline UMX-HQ reference evaluator
seonghobae commentedon Sep 29, 2026
Executed no-OEM candidate implementation — 2026-09-29
The user's requirement is no separate OEM contract. Publicly granted model rights, not new vendor negotiations, now govern this candidate route.
Fresh original-publisher evidence:
https://zenodo.org/api/records/3370489explicitly describes UMX-HQ weights, version1.0.1, withmetadata.license.id = mit-license. The exact candidate issigsep/umxhq, not the noncommercial upstream defaultumxl. Preserve copyright/permission notices; the grant does not promise third-party training/input-music rights or indemnity. X-UMX-HQ original record10.5281/zenodo.4740378explicitly declares CC BY 4.0; official Spleeter four-stem remains a separate MIT candidate per its authors' paper. No OEM purchase, vendor contact or private contract is needed merely to exercise those public grants.Source contribution, not another proposal-only comment
Existing canonical Signal/MIR #828 was advanced non-force:
3c23b12dfc5ef9397bcc6c822843040079f9eadf;b02ac12f890069d8e7aefe1a8bf801122b87d54d;0ba16b192b66773f52df2af544896e3c2a432142;services/analysis-engine/tests/open_unmix_candidate.pyimplements direct four-target local-byte construction and stereo inference, outside the installed product. Fixed UMX-HQ filenames/full-size/full-SHA consistency, explicit weights_only, strict tensor schema and no download/pretrained-factory/UMXL/paid fallback.tests/model_candidates/umxhq_qualification.jsonrecords the original weight-license evidence and candidate coordinates; it is expressly not a release manifest. ADR:docs/adr/2026-09-29-no-oem-model-qualification.md.Focused local controls: 58 passed; candidate module statements 100/100 and branches 34/34. A separate actual-library unit smoke exercised four full Open-Unmix architectures and restricted checkpoint loading on Open-Unmix 1.3.0 / torch+torchaudio 2.10.0+cpu. It used random UNIT weights and synthetic UNIT audio, not pretrained quality evidence. Read-only exact-head review was requested on #828.
Still not release admission
Explicit original Zenodo acquisition failed in the container. No original UMX-HQ weights or full model digests were acquired. Null full digests/size in the candidate record stay null, never fabricated. Original-state compatibility, authorized four-stem real-audio performance and signed Windows/macOS packages are not yet verified. #1180/#1126 still own acquisition/provenance/packaging; #828/#770 own actual quality. Existing #828 reconciliation, full CI, Ruff and independent approval remain open.
Keep this issue open. The unresolved next work is now exact artifact acquisition and technical/scientific delivery evidence for an identified publicly licensed candidate—not an invented OEM negotiation requirement. This does not retroactively license Demucs or turn integrity/unit tests into a rights determination or commercial release.
test(release): specify explicit UMX-HQ acquisition contracts
feat(release): acquire UMX-HQ weights through explicit pinned tooling