# Dependency license compatibility review — Codable 1.0.0

Reviewed: 2026-08-09. This is a release-engineering review, not legal advice. The
upstream license text distributed with each package remains controlling.

## Scope and result

The review covers the 119 Composer production packages, 114 npm packages in the
compiled frontend production graph, and 3 locked runner toolchain packages in
`dependency-inventory.json`. Every component has a non-empty license expression;
the automated architecture gate rejects `NOASSERTION`, `UNKNOWN`, `UNLICENSED`,
and empty values.

| License family | Distribution treatment | Review result |
| --- | --- | --- |
| MIT, ISC, BSD-2-Clause, BSD-3-Clause | Retain copyright, permission, and disclaimer text. Do not relicense the dependency itself as proprietary. | Compatible with proprietary aggregation when its notice conditions are preserved. |
| Apache-2.0 | Retain the license and any upstream notice; preserve patent and attribution terms. | Compatible with proprietary aggregation under the upstream terms. |
| OSL-3.0 | `apimatic/jsonmapper` is shipped as readable source under `application/vendor`, together with its OSL-3.0 text. Any modification, replacement, or deployment-model change requires a fresh review of source and reciprocal obligations. | Accepted only with the retained source/license controls described here; this is not a blanket permissive classification. |
| BSD-3-Clause / GPL-2.0-only / GPL-3.0-only alternatives | `nette/schema` and `nette/utils` expressly offer a choice. Codable uses the New BSD (BSD-3-Clause) option and retains the upstream license files and copyright headers. | Reviewed under the BSD-3-Clause option; no GPL relicensing claim is made. |

## Evidence and conditions

- Composer package source and upstream license/readme files remain inside the
  distributed `application/vendor` tree.
- No copy or fork of APIMatic JsonMapper was found in Codable's `app`, `config`,
  `routes`, `database`, `resources`, or `tests` trees. It remains a transitive
  vendor package rather than first-party product code.
- The full Lucide ISC and Feather MIT text for imported and embedded icons is in
  `notices/lucide-icons-notice.txt`.
- Frontend and runner family notices remain in `notices/frontend-runtime-notice.txt`
  and `notices/runner-toolchain-notice.txt`.
- The exact names, locked versions, license expressions, and available project
  links are recorded in `dependency-inventory.json`; the generated SBOMs add
  hashes and dependency relationships at release build time.
- Package or SDK presence does not enable a feature. Codable 1.0.0 remains
  free-only, and payment gateways are release-disabled.

## Fail-closed re-review triggers

Do not ship until this review and the inventories are regenerated if a lockfile,
bundled asset, embedded icon set, font, vendor patch, license expression, build
pipeline, or preview asset changes. A new unknown license is a release blocker,
not an allowlist candidate.