ContextualWisdomLab · seonghobae · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
@@ -42,7 +42,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          # Atheris supports CPython 3.6 - 3.12.
+          # The pinned Atheris artifacts support CPython 3.12 - 3.14.
           python-version: "3.12"
       - name: Install Atheris
         run: pip install --require-hashes -r fuzz/requirements-fuzz.txt

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,5 +10,6 @@
 - 순수 영숫자 토큰은 정규식 호출을 건너뛰되 다국어·문장부호 토큰화 결과는 기존 의미와 동일하게 유지합니다. 근거, 한계, APA 7 참고문헌은 [`docs/doctoring/token-fast-path-equivalence.md`](docs/doctoring/token-fast-path-equivalence.md)에 기록했습니다.
 
 ### Fixed
+- Python 3.14 coverage 검증이 설치할 수 없던 Atheris 3.0.0 lock을 3.1.0의 공식 Python 3.12–3.14 wheel digest로 갱신했습니다.
 - 단일·일괄 대상 크기 입력을 비웠을 때 이전 custom validity와 `aria-invalid` 상태를 즉시 초기화해 현재 필수 입력 상태를 정확히 전달합니다.
 - 업로드 파일명의 경로 구분자를 정규화하여 POSIX에서도 Windows 형식의 클라이언트 경로가 일관된 basename으로 기록되도록 수정했습니다.
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -35,7 +35,7 @@ docker build -t codec-carver . && docker run -p 8000:8000 codec-carver
 # MCP server
 python mcp_driver.py
 
-# Fuzzing (Atheris; CPython <= 3.12, not Windows)
+# Fuzzing (Atheris; CPython 3.12-3.14, not Windows; CI uses 3.12)
 pip install --require-hashes -r fuzz/requirements-fuzz.txt
 python fuzz/fuzz_parse_silencedetect.py -max_total_time=60 fuzz/corpus/parse_silencedetect
 ```

diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Codec Carver contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
diff --git a/docs/advanced-operations.md b/docs/advanced-operations.md
diff --git a/docs/index.md b/docs/index.md
@@ -0,0 +1,64 @@
+# Codec Carver
+
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/ContextualWisdomLab/codec-carver)
+
+Codec Carver turns long recordings into durable, metadata-preserving audio artifacts and provides evidence-aware tooling for organizing, transcribing, and reconciling recording libraries.
+
+## What it does
+
+- Converts supported recordings to FLAC or size-bounded Opus while preserving source metadata.
+- Splits long recordings at safe duration boundaries, preferring detected silence when possible.
+- Offers a Python CLI, an optional FastAPI upload surface, and an MCP integration.
+- Provides a Rust-backed library-curation workflow for hashing, inventory, duplicate quarantine, TMK/VAD reconciliation, and bounded mutations.
+- Supports optional transcription and evidence-backed description workflows while keeping source recordings intact.
+
+## Quick start
+
+Prerequisites are Python 3.10+ and `ffmpeg`/`ffprobe` on `PATH`.
+
+```bash
+pip install -e .
+codec-carver /path/to/recordings --execute --output-dir under_2gb
+```
+
+For the optional web service:
+
+```bash
+pip install -e ".[web]"
+docker build -t codec-carver .
+docker run -p 8000:8000 codec-carver
+```
+
+Use the repository README for the product overview and common workflow. Detailed configuration, duration-splitting controls, metadata tagging, transcription, iCloud/TMK handling, and GPU/Rust library-curation procedures are preserved in the [advanced operations reference](advanced-operations.md).
+
+## Architecture and operating model
+
+The CLI owns conversion planning and execution. The library-curation path combines Python orchestration with a Rust backend for byte-heavy scanning and mutation work. Evidence and provenance are kept explicit so later TMK or transcription information can be reconciled without silently rewriting source history.
+
+Architecture reference:
+
+- [Segmentation and reconciliation](architecture/segmentation-reconciliation.md)
+- [GPU transcription / Rust backend](architecture/gpu-transcription-rust-backend.md)
+
+## Documentation
+
+- [Repository README](https://github.com/ContextualWisdomLab/codec-carver/blob/main/README.md)
+- [Advanced operations reference](advanced-operations.md)
+- [GitHub Releases](https://github.com/ContextualWisdomLab/codec-carver/releases)
+- [Ask DeepWiki](https://deepwiki.com/ContextualWisdomLab/codec-carver)
+
+Follow the architecture and doctoring material under `docs/` for specific operational and safety contracts.
+
+## Status and verification
+
+The package metadata currently identifies source version `0.1.0`. Treat GitHub Releases and protected-branch history as the authority for shipped versions and release evidence; a source version or documentation commit alone is not a release. Likewise, this `docs/index.md` file is only a Pages source prerequisite until repository settings, deployment, and the live HTTPS page are independently verified.
+
+## Commercial runtime boundary
+
+Codec Carver-authored source is MIT-licensed, but the current conversion/probing implementation requires FFmpeg/FFprobe. FFmpeg builds can carry LGPL/GPL-family obligations that are outside ContextualWisdomLab's supported commercial inbound baseline. Issue [#513](https://github.com/ContextualWisdomLab/codec-carver/issues/513) owns replacement of that execution boundary. Until that replacement is integrated and released, do not present the current FFmpeg-backed conversion path as a commercially approved deployment, and do not treat process or container separation as a license exception.
+
+Optional packages, native runtimes, models, weights, and provider services retain their own licenses and require profile-specific approval.
+
+## License
+
+Codec Carver source declares the MIT license in `pyproject.toml`; this branch completes that existing source-license lineage with the root [MIT LICENSE](https://github.com/ContextualWisdomLab/codec-carver/blob/main/LICENSE) and includes the license file in setuptools package artifacts. The MIT grant applies to Codec Carver-authored source and documentation. External tools and dependencies—including `ffmpeg`/`ffprobe`, Python/Rust packages, model runtimes, model weights, and provider services—retain their own licenses and terms and are not relicensed by this repository.
diff --git a/fuzz/README.md b/fuzz/README.md
@@ -12,7 +12,8 @@ in-process data structures.
 | [Atheris](https://github.com/google/atheris) | coverage-guided (libFuzzer) fuzzing | Apache-2.0 |
 | [Hypothesis](https://hypothesis.readthedocs.io/) | property-based tests in the normal suite | MPL-2.0 |
 
-Both are permissive (no GPL/AGPL). Atheris supports CPython 3.6–3.12.
+Both are permissive (no GPL/AGPL). The pinned Atheris artifacts support
+CPython 3.12–3.14; CI uses Python 3.12 for deterministic fuzz runs.
 
 ## Targets
 

diff --git a/fuzz/fuzz_build_segments.py b/fuzz/fuzz_build_segments.py
@@ -15,7 +15,7 @@
 Malformed inputs are expected to raise ``ValueError`` (a documented guard);
 any other exception is a defect.
 
-Run locally (Python 3.8 - 3.12)::
+Run locally (Python 3.12 - 3.14)::
 
     python fuzz/fuzz_build_segments.py -atheris_runs=200000 fuzz/corpus/build_segments
 """

diff --git a/fuzz/fuzz_parse_probe_payload.py b/fuzz/fuzz_parse_probe_payload.py
@@ -10,7 +10,7 @@
 project's own ``MediaShrinkerError`` — never an unhandled ``KeyError`` /
 ``TypeError`` / ``ValueError``.
 
-Run locally (Python 3.8 - 3.12)::
+Run locally (Python 3.12 - 3.14)::
 
     python fuzz/fuzz_parse_probe_payload.py -atheris_runs=200000 fuzz/corpus/parse_probe_payload
 """

diff --git a/fuzz/fuzz_parse_silencedetect.py b/fuzz/fuzz_parse_silencedetect.py
@@ -7,7 +7,7 @@
 arbitrary byte strings and asserts the parser never raises and only ever
 produces well-formed, ordered silence intervals.
 
-Run locally (Python 3.8 - 3.12)::
+Run locally (Python 3.12 - 3.14)::
 
     python fuzz/fuzz_parse_silencedetect.py -atheris_runs=200000 fuzz/corpus/parse_silencedetect
 

diff --git a/fuzz/requirements-fuzz.txt b/fuzz/requirements-fuzz.txt
@@ -1,7 +1,6 @@
 # Hash-pinned dependency for the coverage-guided fuzzing job (Atheris).
 # Regenerate with: uv pip compile fuzz/requirements-fuzz.in --generate-hashes
-atheris==3.0.0 \
-    --hash=sha256:1f0929c7bc3040f3fe4102e557718734190cf2d7718bbb8e3ce6d3eb56ef5bb3 \
-    --hash=sha256:510e502c57b6dc615fb174066407af620d4c7f73cf08a782c86e7761bf12c4eb \
-    --hash=sha256:8a5c8a781467c187da40fd29139784193e2647058831f837f675d0bb8cbd8746 \
-    --hash=sha256:a402cdca8a650d1371050b1f9552eb4cdc488d2db64950d603c4560318365eac
+atheris==3.1.0 \
+    --hash=sha256:ec5e11f21a4c197fe91f7aea2b2de88e623c73a21fc07b105ac6329a1588457b \
+    --hash=sha256:f8a9f51ce8369026e8eb7b7174835e8c4c85a1a6db5d9add36c15100779d2a39 \
+    --hash=sha256:315a0b5c819852b1ffe1ca72efc389c7724881f2c33e4aacb8c6bcec49bd5011
diff --git a/pyproject.toml b/pyproject.toml
@@ -75,6 +75,7 @@ codec-carver = "media_shrinker:main"
 codec-carver-library = "audio_library:main"
 
 [tool.setuptools]
+license-files = ["LICENSE"]
 py-modules = [
     "chapters",
     "config_file",

diff --git a/tests/test_ci_workflow.py b/tests/test_ci_workflow.py
@@ -7,10 +7,28 @@
 ROOT = Path(__file__).resolve().parents[1]
 CI_WORKFLOW = ROOT / ".github" / "workflows" / "ci.yml"
 FUZZ_WORKFLOW = ROOT / ".github" / "workflows" / "fuzz.yml"
+FUZZ_REQUIREMENTS = ROOT / "fuzz" / "requirements-fuzz.txt"
 
 
 class CiWorkflowTests(unittest.TestCase):
-    """Keep Rust CI reproducible on runners without a suitable default toolchain."""
+    """Keep repository CI reproducible across its supported runner toolchains."""
+
+    def test_atheris_lock_supports_fuzz_and_coverage_python_versions(self) -> None:
+        """Pin artifacts installable by the Python 3.12 fuzz and 3.14 coverage lanes."""
+
+        requirements = FUZZ_REQUIREMENTS.read_text(encoding="utf-8")
+        workflow = FUZZ_WORKFLOW.read_text(encoding="utf-8")
+
+        self.assertIn("atheris==3.1.0", requirements)
+        self.assertIn(
+            "sha256:ec5e11f21a4c197fe91f7aea2b2de88e623c73a21fc07b105ac6329a1588457b",
+            requirements,
+        )
+        self.assertIn(
+            "sha256:315a0b5c819852b1ffe1ca72efc389c7724881f2c33e4aacb8c6bcec49bd5011",
+            requirements,
+        )
+        self.assertIn("CPython 3.12 - 3.14", workflow)
 
     def test_rust_job_installs_and_uses_rust_1_88_with_rustfmt(self) -> None:
         """Require edition-2024 Rust and rustfmt before formatting or tests run."""