docs: make README product-first and commercial-license aware

[seonghobae]

Outcome

Replace Codec Carver's implementation/runbook-heavy repository landing with a concise product surface for users, maintainers, buyers, and integrators, while making the existing MIT source grant executable at the repository/package boundary and refusing to hide the current FFmpeg commercial-policy blocker.

• add the exact-cased Ask DeepWiki entry;
• lead with the local-first audio-curation value proposition and source/evidence/mutation boundary;
• separate bounded carving, evidence preservation, library curation, and optional local understanding;
• replace hundreds of lines of machine-specific iCloud/model/backend procedure with task-oriented setup, CLI/Web/MCP/library entry points, safety principles, architecture, and durable documentation links;
• keep detailed TMK/VAD, Rust/GPU, File Provider, model pinning and mutation mechanics in existing architecture documents;
• add docs/index.md as a compact public documentation landing source without claiming Pages publication;
• add the missing root MIT license matching pyproject.toml and explicitly include it in setuptools package artifacts.

Licensing due diligence

Protected main@a8e4956fc667782a15276eb04b8f379b4887201f is an organization-owned, non-fork repository. Existing package metadata already declares MIT and author Seongho Bae; repository search found no inherited root outbound license or GPL/LGPL/AGPL/noncommercial header governing Codec Carver original source. The missing root license is therefore metadata/file drift, not a reason to leave the source grant ambiguous.

The repository MIT grant does not make every runtime commercially approved. The primary conversion/probing path requires FFmpeg/FFprobe, whose LGPL/GPL-family licensing conflicts with ContextualWisdomLab's inbound policy. Existing issue #513 owns replacement. README therefore does not present the current FFmpeg-backed path as an approved commercial deployment or treat process/container separation as a license exception.

Optional packages/native runtimes/model weights remain separately licensed and require profile-specific approval; a model name in source is not procurement authority.

Review repairs

The first current-head semantic review found three real README contract defects and all are source-addressed on the current head:

1. audio-library examples now build the required release Rust backend before invoking codec-carver-library;
2. local verification now mirrors CI's six-module py_compile, unittest suite, and console-entry smoke rather than checking only one Python module;
3. README now states that base package metadata already declares current web/MCP dependencies and that [web] / [mcp] extras are compatibility/grouping aliases, not feature-unlocking prerequisites.

All three corresponding inline threads were replied to and resolved after verifying the repair.

Public truth boundary

• pyproject.toml version 0.1.0 is source metadata; GitHub currently has zero published releases.
• No production deployment, released artifact, benchmark superiority, certification, customer adoption, or commercially complete runtime is claimed.
• docs/index.md is source documentation only; GitHub Pages currently reports disabled.
• Open ADR PR docs(adr): accepted SHA-256, Whisper, and TMK/VAD decisions #476 remains a separate decision-record lane and is not copied into this branch; README links only current-branch files.

Exact-head authority — 2026-09-02

Exact current head is 88fb77444c139da6e8c36d5b7366f5d4327f49b6; GitHub reports open, non-Draft and mechanically mergeable. Every workflow result from predecessor 92661f09... is historical after the review repairs.

Fresh exact-head runs are queued and therefore non-passing:

• CI 33579331274;
• fuzz 33579331309;
• SAST Semgrep 33579331303;
• Security Scan 33579331276.

Scope and merge boundary

Changed product surface is limited to README.md, root LICENSE, docs/index.md, and package license-file metadata. No conversion, probing, transcription, web, MCP, Rust backend, mutation, model, workflow, dependency version, or release behavior changes.

Do not merge or enable auto-merge while exact-head checks are queued. Merge only through normal protected governance after the unchanged head has terminal required checks, zero valid unresolved findings, current base/mergeability, and then-live rules. #513 remains a separate commercial-runtime blocker and is not waived by this documentation/source-license lane. No self-approval, routine administrator bypass, force-push, gate weakening, or predecessor-evidence transfer is requested.

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 0ed68dcc-ae38-4e30-9d11-2be8d60629e2

📥 Commits

Reviewing files that changed from the base of the PR and between a8e4956 and 88fb774.

📒 Files selected for processing (4)

• LICENSE
• README.md
• docs/index.md
• pyproject.toml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cwl-noema-review]

Noema LLM review

Documentation-focused PR that adds a root MIT LICENSE, wires it into setuptools via license-files, rewrites README.md to be product-first and commercial-license aware, and adds docs/index.md. All three prior review threads are addressed on the head SHA: the audio-library quickstart now builds the Rust backend before any codec-carver-library command, the verification section mirrors CI's six-module py_compile plus unittest and console smoke, and the web/MCP extras wording correctly states they are aliases of base dependencies. The diff contains no source or test changes, so no behavioral regression is possible. The license text is standard MIT and matches pyproject metadata. The only residual concern is that third-party model license claims (MOSS Apache-2.0, Whisper MIT) are stated without a source citation, which is a documentation accuracy risk rather than a blocker.

Reviewed changed lines

• LICENSE:1 (RIGHT): Standard MIT license text with correct copyright line. Matches pyproject license = "MIT" and is now included via license-files = ["LICENSE"].
• README.md:84 (RIGHT): Audio-library quickstart now includes cargo build --release --manifest-path rust-core/Cargo.toml before any codec-carver-library command, resolving the prior bug thread.
• README.md:46 (RIGHT): Verification section now runs py_compile on six modules (media_shrinker, config_file, presets, saas_web, mcp_driver, job_store), matching CI coverage, plus unittest and console smoke.
• README.md:67 (RIGHT): Web/MCP extras wording correctly states the base package already declares those dependencies and that [web]/[mcp] are compatibility/grouping aliases, not feature-unlocking prerequisites.
• pyproject.toml:78 (RIGHT): Added license-files = ["LICENSE"] under [tool.setuptools], ensuring the new LICENSE file is packaged with the distribution.

Adversarial validation

• README.md:84 (RIGHT) falsified: The library quickstart omits the Rust backend build, so codec-carver-library commands would fail after the documented install. — Diff shows cargo build --release --manifest-path rust-core/Cargo.toml immediately before the codec-carver-library inventory/plan/apply commands.
• README.md:46 (RIGHT) falsified: The verification command compiles only one module and understates CI coverage. — README lists media_shrinker.py, config_file.py, presets.py, saas_web.py, mcp_driver.py, job_store.py — six modules, matching the prior thread's CI claim.
• pyproject.toml:78 (RIGHT) falsified: The new LICENSE file is not included in the built package metadata. — license-files = ["LICENSE"] was added under [tool.setuptools], so the LICENSE is packaged.
• Residual risk: low

Findings

• [low] README.md:100 (RIGHT): The README states that the MOSS-Transcribe-Diarize model is Apache-2.0 and the pinned Whisper conversion advertises MIT terms, but no source or link is provided. These are factual license claims about third-party assets; consider adding a citation or link to the upstream license to avoid unverifiable assertions.

• Result: APPROVE
• Head SHA: 88fb77444c139da6e8c36d5b7366f5d4327f49b6
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[seonghobae]

Overlap reconciliation: #516 is now the canonical public-surface writer. I re-read both PRs and carried the valid unique deltas from this PR into #516 rather than discarding them: pyproject.toml on #516 now includes license-files = ["LICENSE"], and docs/index.md now preserves the explicit FFmpeg/FFprobe commercial-runtime blocker owned by #513, including the no-container/process-separation-as-license-exception boundary. #516 also retains the former long README as docs/advanced-operations.md, so it preserves more operator knowledge than this branch while still carrying the exact DeepWiki badge, root MIT license, product-first README, and Pages-source landing. Exact successor head at this reconciliation is 8f4fc67004cd834928b342b77a9697003b81ab18; its fresh CI/fuzz/SAST/Security runs are queued. This comment records the carryover rationale before retiring the overlapping writer; no valid public-surface delta from #514 is being dropped.