Finding
Eleven crates in this workspace functionally descend from mouseion — an in-repo, self-declared
GPL-3.0-or-later derivative of Radarr that was retained as reference material during the Rust rewrite
and then deleted, with its attribution never carried forward into the code that descends from it.
Deleting an attribution does not extinguish the obligation it recorded. If the descendant code is
derivative, the GPL lineage still applies and nothing in the repo now says so.
Evidence
The descendant set, identified by functional correspondence to mouseion's scope:
eksetasis, ergasia, kritike, syntaxis, syndesmos, exousia, apotheke, archon, kathodos,
komide, epignosis.
mouseion declared GPL-3.0-or-later itself and its retention was explicitly justified as preserving
reference material for the rewrite. It is no longer present, and no successor crate carries an upstream
attribution.
Crates with no derivation signal found, so the finding is bounded rather than repo-wide in substance:
akouo-core, syndesis, theatron/theatron-core, akouo-android, harmonia-convert, prostheke,
paroche, aggelmata, horismos — audio DSP, a custom QUIC transport, desktop and mobile UI, ebook
conversion, subtitles, and the streaming API have no analogue in Radarr's movie-only scope and trace to
a separate lineage or appear to be net-new.
Why this matters
Two consequences, and the second is the one that would have caused real harm:
Attribution. GPL-3.0-or-later requires the notice and source offer be preserved. If these crates are
derivative, the repo is distributing derived work with the attribution removed.
This repo's AGPL-3.0 is load-bearing, not incidental. A fleet-wide licensing normalisation was about
to move harmonia to a noncommercial source-available license on the reasoning that AGPL "never
restricted commercial use, so it never provided what it was chosen for." That reasoning is correct in
general and wrong here: AGPL-3.0 is what satisfies the GPL lineage. Relicensing away from it would
have been the violation, and the sweep would have performed it as tidying.
That is the sharper lesson. A license that looks arbitrary may be doing work that only its provenance
explains, and a consistency pass cannot tell the difference without asking.
Desired correction
Establish, per crate, whether the descendant code is genuinely derivative of mouseion/Radarr or an
independent reimplementation. Functional correspondence is not derivation — a media manager written from
scratch will resemble other media managers.
Then one of:
- Derivative — restore attribution naming Radarr and the GPL-3.0-or-later lineage, and record that
this repo's license is obligation-bound rather than chosen, so no future sweep normalises it.
- Independent — record the finding and the evidence that settles it, so the question is answered once
rather than re-opened by every audit.
Prefer the mechanism aletheia already runs for the same class: a per-file provenance ledger with a
CI check that fires on drift. That converts "someone should look into this" into a gate, and aletheia's
own experience shows the detector catching a real case rather than merely existing.
Done when: each of the eleven crates has a recorded provenance verdict with evidence; attribution is
restored wherever the verdict is derivative; and a check exists that fails if a derived file loses its
attribution again — which is exactly how this arose.
Provenance of this finding
Surfaced by a fleet-wide copyleft-provenance audit run before relicensing any repo away from copyleft.
It is a read-only source audit, so it establishes what the tree and its history say — not a legal
opinion, and not proof either way about whether the descendant code is derivative.
Finding
Eleven crates in this workspace functionally descend from
mouseion— an in-repo, self-declaredGPL-3.0-or-later derivative of Radarr that was retained as reference material during the Rust rewrite
and then deleted, with its attribution never carried forward into the code that descends from it.
Deleting an attribution does not extinguish the obligation it recorded. If the descendant code is
derivative, the GPL lineage still applies and nothing in the repo now says so.
Evidence
The descendant set, identified by functional correspondence to mouseion's scope:
eksetasis,ergasia,kritike,syntaxis,syndesmos,exousia,apotheke,archon,kathodos,komide,epignosis.mouseiondeclared GPL-3.0-or-later itself and its retention was explicitly justified as preservingreference material for the rewrite. It is no longer present, and no successor crate carries an upstream
attribution.
Crates with no derivation signal found, so the finding is bounded rather than repo-wide in substance:
akouo-core,syndesis,theatron/theatron-core,akouo-android,harmonia-convert,prostheke,paroche,aggelmata,horismos— audio DSP, a custom QUIC transport, desktop and mobile UI, ebookconversion, subtitles, and the streaming API have no analogue in Radarr's movie-only scope and trace to
a separate lineage or appear to be net-new.
Why this matters
Two consequences, and the second is the one that would have caused real harm:
Attribution. GPL-3.0-or-later requires the notice and source offer be preserved. If these crates are
derivative, the repo is distributing derived work with the attribution removed.
This repo's AGPL-3.0 is load-bearing, not incidental. A fleet-wide licensing normalisation was about
to move harmonia to a noncommercial source-available license on the reasoning that AGPL "never
restricted commercial use, so it never provided what it was chosen for." That reasoning is correct in
general and wrong here: AGPL-3.0 is what satisfies the GPL lineage. Relicensing away from it would
have been the violation, and the sweep would have performed it as tidying.
That is the sharper lesson. A license that looks arbitrary may be doing work that only its provenance
explains, and a consistency pass cannot tell the difference without asking.
Desired correction
Establish, per crate, whether the descendant code is genuinely derivative of mouseion/Radarr or an
independent reimplementation. Functional correspondence is not derivation — a media manager written from
scratch will resemble other media managers.
Then one of:
this repo's license is obligation-bound rather than chosen, so no future sweep normalises it.
rather than re-opened by every audit.
Prefer the mechanism aletheia already runs for the same class: a per-file provenance ledger with a
CI check that fires on drift. That converts "someone should look into this" into a gate, and aletheia's
own experience shows the detector catching a real case rather than merely existing.
Done when:each of the eleven crates has a recorded provenance verdict with evidence; attribution isrestored wherever the verdict is derivative; and a check exists that fails if a derived file loses its
attribution again — which is exactly how this arose.
Provenance of this finding
Surfaced by a fleet-wide copyleft-provenance audit run before relicensing any repo away from copyleft.
It is a read-only source audit, so it establishes what the tree and its history say — not a legal
opinion, and not proof either way about whether the descendant code is derivative.