[Legal/.NET] Document and implement Microsoft .NET redistribution obligations

[KeyffMS]

Decision

SightAdapt documents and implements its Microsoft .NET redistribution approach through maintainer-owned technical and business-risk controls. No external legal audit is required or planned.

This is an internal project decision. It does not claim legal clearance or outside-counsel review.

Implemented state

• exact SDK/runtime/TFM/RID/publish configuration is recorded in release/dotnet-redistribution-review.json;
• the reviewed redistribution wording is stored as a checksum-protected template;
• MICROSOFT-DOTNET-REDISTRIBUTION.txt is generated from canonical release metadata;
• exact Microsoft license and third-party notice material is imported from a hash-verified official SDK package;
• Microsoft terms remain separate from SightAdapt's MIT License;
• final packages preserve the complete notice bundle;
• configuration or template drift fails before packaging;
• deliberately stale redistribution wording is rejected by CI;
• the compliance report records the maintainer decision and generated-notice checksum.

Acceptance criteria

• Identify Microsoft-origin component families included in the self-contained output.
• Identify authoritative license/redistribution sources for the pinned release train.
• Record redistribution conditions and project treatment.
• Confirm that Microsoft components are distributed only as part of SightAdapt.
• Include required notices, warranty/support boundaries and attribution language.
• Keep Microsoft terms separate from SightAdapt's MIT License.
• Record review date, configuration, sources and template checksum.
• Require a new maintainer review when SDK/runtime/TFM/RID/publish mode, component inventory or notice wording changes.
• Record an explicit maintainer decision for the current distribution scope.
• Do not claim external legal clearance or professional audit.

Implementation

• PR Implement Microsoft .NET redistribution obligations #128 introduced the redistribution analysis and package notice.
• PR Generate and enforce the reviewed .NET redistribution notice #137 generated and enforced the reviewed notice against canonical release metadata.
• PR Replace external audit gates with maintainer risk decisions #139 replaced the unused external-audit gate with the maintainer-owned decision policy.

Re-review triggers

Reopen or update the review record when the runtime/toolchain, publish configuration, Microsoft components, distribution channels, compatibility claims or Microsoft terms materially change.