Phase 1: fix CI Windows test, repair CodeQL config, clean stale legal wording

.github/codeql/codeql-config.yml

@@ -1,7 +1,6 @@
 paths:
   - src
   - tests
-  - frontend
   - tools
   - .github
 

.github/workflows/ci.yml

@@ -18,14 +18,23 @@ permissions:
 jobs:
   format:
     name: Verify Code Format
-    runs-on: self-hosted
+    runs-on: [self-hosted, Linux]
     timeout-minutes: 15
     steps:
       - name: Checkout Source
         uses: actions/checkout@v7
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v6
+        # actions/setup-dotnet's install script defaults to a system-wide
+        # location (e.g. C:\Program Files\dotnet) that self-hosted runner
+        # service accounts often can't write to. Redirect installs into the
+        # per-step runner temp directory, which is always writable
+        # regardless of runner OS or account. (The `runner` context is
+        # only available inside a step, not at the job- or workflow-level
+        # `env:` -- confirmed via GitHub's own workflow validation error.)
+        env:
+          DOTNET_INSTALL_DIR: ${{ runner.temp }}/.dotnet
         with:
           dotnet-version: '10.0.x'
           cache: true
@@ -34,30 +43,99 @@ jobs:
             NuGet.config
 
       - name: Restore Dependencies
+        shell: bash
         run: dotnet restore Trackdub.slnx -m:1
 
       - name: Verify Format Style Limits
+        shell: bash
         run: dotnet format Trackdub.slnx --verify-no-changes
 
-  build:
-    name: Build & Test (${{ matrix.name }})
+  repository-boundary:
+    name: Verify Repository Boundary
+    runs-on: [self-hosted, Linux]
+    timeout-minutes: 5
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v7
+
+      - name: Scan for stale license/desktop-boundary claims
+        shell: bash
+        run: python3 scripts/ci/check-repository-boundary.py
+
+  build-windows:
+    name: Build & Test (Windows)
+    timeout-minutes: 45
+    runs-on: [self-hosted, Windows]
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v7
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v6
+        env:
+          DOTNET_INSTALL_DIR: ${{ runner.temp }}/.dotnet
+        with:
+          dotnet-version: '10.0.x'
+          cache: true
+          cache-dependency-path: |
+            **/packages.lock.json
+            NuGet.config
+
+      - name: Restore Dependencies
+        shell: bash
+        run: dotnet restore Trackdub.slnx -m:1
+
+      - name: Compile
+        shell: bash
+        run: dotnet build Trackdub.slnx -c Release --no-restore -m:1
+
+      - name: Test
+        shell: bash
+        run: dotnet test Trackdub.slnx -c Release --no-build -m:1
+
+  build-linux:
+    name: Build & Test (Linux)
     timeout-minutes: 45
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: Windows
-            runner: self-hosted
-          - name: Linux
-            runner: self-hosted
+    runs-on: [self-hosted, Linux]
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v7
 
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v6
+        env:
+          DOTNET_INSTALL_DIR: ${{ runner.temp }}/.dotnet
+        with:
+          dotnet-version: '10.0.x'
+          cache: true
+          cache-dependency-path: |
+            **/packages.lock.json
+            NuGet.config
+
+      - name: Restore Dependencies
+        shell: bash
+        run: dotnet restore Trackdub.slnx -m:1
+
+      - name: Compile
+        shell: bash
+        run: dotnet build Trackdub.slnx -c Release --no-restore -m:1
+
+      - name: Test
+        shell: bash
+        run: dotnet test Trackdub.slnx -c Release --no-build -m:1
+
+  build-macos:
+    name: Build & Test (macOS)
+    timeout-minutes: 45
+    runs-on: [self-hosted, macOS]
     steps:
       - name: Checkout Source
         uses: actions/checkout@v7
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v6
+        env:
+          DOTNET_INSTALL_DIR: ${{ runner.temp }}/.dotnet
         with:
           dotnet-version: '10.0.x'
           cache: true
@@ -66,10 +144,13 @@ jobs:
             NuGet.config
 
       - name: Restore Dependencies
+        shell: bash
         run: dotnet restore Trackdub.slnx -m:1
 
       - name: Compile
+        shell: bash
         run: dotnet build Trackdub.slnx -c Release --no-restore -m:1
 
       - name: Test
+        shell: bash
         run: dotnet test Trackdub.slnx -c Release --no-build -m:1

CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing
+
+Trackdub (this repository) is the Apache-2.0 public core: the SDK, CLI,
+pipeline, inference, media processing, infrastructure, and neutral licensing
+mechanisms. See [docs/repository-policy.md](docs/repository-policy.md) and
+[AGENTS.md](AGENTS.md) for organization, dependency-direction rules, and
+build/test commands before opening a change.
+
+## Inbound contribution terms
+
+- Contributions to this repository are submitted under the
+  [Apache License, Version 2.0](LICENSE).
+- By submitting a contribution, you certify that you have the right to submit
+  it under that license (for example, it is your own original work, or you
+  otherwise hold the necessary rights).
+- No separate Contributor License Agreement (CLA) is currently required to
+  contribute here.
+- This forward-looking contribution policy is separate from, and does not
+  affect, any historical intellectual-property ownership review of code
+  already in the repository.
+
+## Before submitting a change
+
+- Run `dotnet build Trackdub.slnx -m:1` and `dotnet test Trackdub.slnx -m:1`.
+- Run `dotnet format Trackdub.slnx --verify-no-changes`.
+- Follow the coding style and dependency-direction rules in
+  [AGENTS.md](AGENTS.md).
+- Use imperative commit titles: `Add ...`, `Fix ...`, `Remove ...`.

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 tonythethompson
+   Copyright 2024-2026 Trackdub LLC
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

docs/legal/LICENSE-HISTORY.md

@@ -0,0 +1,19 @@
+# License History
+
+Trackdub is split into two repositories with different licenses:
+
+- **`trackdubllc/Trackdub`** (this repository) — the public core: SDK, CLI,
+  pipeline, inference, media processing, infrastructure, and neutral
+  licensing mechanisms. Licensed under [Apache License, Version 2.0](../../LICENSE)
+  (see the root [NOTICE](../../NOTICE)).
+- **The Trackdub desktop product** — a separate, private repository that
+  depends on this public core. It owns the desktop application shell,
+  product policy (export tiers, watermarking, entitlements), activation,
+  packaging, and release signing. It is proprietary and is not covered by
+  the Apache-2.0 license in this repository.
+
+This repository was established with a fresh root history as the public
+core. It carries only Apache-2.0-compatible source and does not contain
+desktop product code, activation-server code, or proprietary packaging
+logic. Detailed historical ownership evidence for code predating this split
+is retained privately and is out of scope for this public document.

docs/legal/THIRD_PARTY_NOTICES.md

@@ -28,17 +28,6 @@ Each entry should include:
 - attribution required?
 - notes
 
-## Inter
-
-- name: Inter
-- version / revision: 4.1
-- source URL: https://github.com/rsms/inter/releases/download/v4.1/Inter-4.1.zip
-- license: SIL Open Font License 1.1
-- commercial use allowed? yes
-- redistribution allowed? yes
-- attribution required? license notice retained in `src/Trackdub.App/Assets/Fonts/Inter-LICENSE.txt`
-- notes: Packaged as `InterVariable.ttf` and `InterVariable-Italic.ttf` for Trackdub UI typography.
-
 ## FFmpeg / ffprobe Windows x64 binaries
 
 - name: FFmpeg / ffprobe Windows x64 binaries (BtbN FFmpeg-Builds, `lgpl-shared`)
@@ -70,40 +59,7 @@ Each entry should include:
 - commercial use allowed? yes
 - redistribution allowed? yes, provided LGPL-2.1 obligations are met (dynamic linking, no source modifications)
 - attribution required? yes
-- notes: .NET bindings for the LibVLC media framework. The application links to LibVLC dynamically (LGPL compliance). No modifications are made to the LibVLC or LibVLCSharp source. Used in `Trackdub.Media.Playback` and `Trackdub.App.Avalonia`.
-
-## LibVLCSharp.Avalonia
-
-- name: LibVLCSharp.Avalonia
-- version / revision: centrally pinned in Directory.Packages.props
-- source URL: https://www.nuget.org/packages/LibVLCSharp.Avalonia
-- license: LGPL-2.1-or-later
-- commercial use allowed? yes
-- redistribution allowed? yes, same terms as LibVLCSharp
-- attribution required? yes
-- notes: Avalonia-specific VideoView control for rendering LibVLC video output. Used in `Trackdub.App.Avalonia` only.
-
-## VideoLAN.LibVLC.Windows (LibVLC native runtime — Windows)
-
-- name: VideoLAN.LibVLC.Windows
-- version / revision: centrally pinned in Directory.Packages.props
-- source URL: https://www.nuget.org/packages/VideoLAN.LibVLC.Windows
-- license: LGPL-2.1-or-later
-- commercial use allowed? yes
-- redistribution allowed? yes, provided LGPL-2.1 notice and dynamic-linking obligations are met
-- attribution required? yes
-- notes: Bundled LibVLC native runtime for Windows (~100 MB). Extracted at build time into the application output directory. The application links dynamically — no static linking or source modification. Scoped to the Avalonia app project.
-
-## VideoLAN.LibVLC.Mac (LibVLC native runtime — macOS)
-
-- name: VideoLAN.LibVLC.Mac
-- version / revision: centrally pinned in Directory.Packages.props
-- source URL: https://www.nuget.org/packages/VideoLAN.LibVLC.Mac
-- license: LGPL-2.1-or-later
-- commercial use allowed? yes
-- redistribution allowed? yes, same terms as the Windows runtime package
-- attribution required? yes
-- notes: Bundled LibVLC native runtime for macOS. Extracted at build time into the application output directory. The application links dynamically — no static linking or source modification. Scoped to the Avalonia app project.
+- notes: .NET bindings for the LibVLC media framework. Trackdub links to LibVLC dynamically (LGPL compliance). No modifications are made to the LibVLC or LibVLCSharp source. Used in `Trackdub.Media.Playback` as one of two composited playback backends (libmpv is the primary compositor; LibVLC is the fallback). Bundling the native LibVLC runtime and any Avalonia-specific video-rendering control is a packaging concern of the consuming desktop product, not the public core, and is documented in that product's own third-party notices.
 
 ## LibVLC on Linux (system-installed)
 
@@ -114,7 +70,7 @@ Each entry should include:
 - commercial use allowed? yes
 - redistribution allowed? n/a — not bundled; users install via their system package manager
 - attribution required? yes (license notice in documentation)
-- notes: On Linux, no NuGet runtime package is available. The application uses the system-installed `libvlc.so` located by `LibVlcRuntimeLocator`. Users must install VLC (e.g., `sudo apt install vlc` or equivalent) for playback to function.
+- notes: On Linux, no NuGet runtime package is available. `Trackdub.Media.Playback`'s `LibVlcRuntimeLocator` falls back to the system-installed `libvlc.so`. End users must install VLC (e.g., `sudo apt install vlc` or equivalent) for the LibVLC playback backend to function.
 
 ## Trackdub.OnnxRuntime.Dnnl.Native (generated package)