Add third-party model licensing, attribution, and download acknowledgement

[brxs]

Summary

Create one auditable licensing, attribution, and download-acknowledgement flow for every third-party model and runtime asset used by LSDJ. LSDJ is fully open-source and non-commercial, but the model weights and related assets remain governed by their own licenses and terms.

This issue centralizes the user-facing compliance work so backend and platform issues can focus on engineering. It is not a request for legal advice and should avoid putting sensitive business information in a public issue.

Relationship to other work

• Can proceed in parallel with engineering work.
• Must be complete before the Linux (Ship Linux x86_64 + NVIDIA support #112) and Windows (Ship Windows 11 x64 + NVIDIA support #113) releases are published.
• Owns the user-facing license, attribution, and acknowledgement requirements referenced by the MRT2 spike/backend (Spike: validate Apolinario's PyTorch MRT2 port for LSDJ #109 and Add a production PyTorch MRT2 backend for Linux and Windows #110), Stable Audio TFLite backend (Add a portable Stable Audio 3 TFLite backend #111), and optional Windows CUDA backend (Add optional PyTorch/CUDA acceleration for Stable Audio 3 on Windows #114).

Scope

1. Build a revision-specific asset inventory

For every shipped, downloaded, or officially discoverable asset, record:

• upstream project and canonical URL;
• exact package/tag/commit/model revision;
• code license;
• weights/model license and applicable terms;
• required copyright and attribution notices;
• acceptable-use, privacy, or gated-access links that must be shown;
• whether LSDJ redistributes the asset or downloads it from upstream;
• whether credentials or upstream account acceptance are required.

At minimum, cover:

• Magenta RealTime 2 code and weights;
• Apolinario's magenta-realtime-2 PyTorch package/port and its relationship to the underlying model;
• Stable Audio 3 code and weights;
• T5Gemma/Gemma components and terms;
• each built-in or officially downloadable LoRA independently;
• LSDJ's own code license and bundled third-party notices.

2. Record the applicable project-use path

• Project owners should record that the current product is open-source and non-commercial and confirm the applicable upstream license path for each restricted asset.
• Do not put revenue, account, contract, credential, or other sensitive details in the public issue.
• Treat a future change in distribution or commercial status as a release gate requiring re-review.

3. Define distribution and access rules

• Do not bundle restricted model weights in application installers unless redistribution has been explicitly confirmed for that exact asset/revision.
• Prefer pinned downloads from the canonical upstream source with verified technical provenance.
• Support gated Hugging Face or equivalent access when the upstream requires a user token or prior acceptance of terms.
• An optimized or anonymously downloadable artifact does not remove its underlying license obligations.
• Never log access tokens or store them in plaintext application data; use an appropriate OS credential store or an intentionally ephemeral flow.

4. Add user-facing disclosure and acknowledgement

• Add an About/Licenses surface listing model/runtime names, revisions, upstream links, licenses, notices, and acknowledgements.
• Before a first download, show the applicable model terms and required links when upstream terms require acknowledgement.
• Record acknowledgement against the relevant license/model revision and timestamp so changed terms can be presented again.
• Make clear that LSDJ's license does not relicense third-party weights.
• Keep acknowledgement separate from telemetry or marketing consent.

5. Cover LoRA provenance

• Show provenance and license metadata for LSDJ-provided downloads.
• Show a clear responsibility/provenance notice when users import their own LoRA files.
• Do not mirror or redistribute a LoRA without confirmed permission for that specific artifact.

6. Documentation and tests

• Document where notices live in the repository, application, packaged artifacts, and release notes.
• Add tests for acknowledgement versioning, gated-download blocking, offline/error behavior, and credential redaction.
• Add a release checklist that verifies the inventory matches the revisions actually shipped or downloaded.

Acceptance criteria

• Project owners have recorded the applicable use/license path for every supported model family without publishing sensitive information.
• A complete revision-specific inventory exists for MRT2, the upstream PyTorch port, Stable Audio 3, T5Gemma/Gemma, and every official LoRA.
• Required notices and links appear in the app and packaged third-party notices.
• Downloads that require acknowledgement cannot begin until the current terms are acknowledged.
• Changed license/model revisions trigger a fresh acknowledgement when required.
• Credentials are neither logged nor stored in plaintext application data.
• Installers contain no model weights whose redistribution has not been confirmed.
• Release documentation explains the separation between LSDJ's code license and third-party asset licenses.

Out of scope

• Providing legal advice.
• Enterprise or commercial license procurement unless the project's status changes.
• Reviewing the contents or licensing of users' private imported files.