[Legal Governance] Record maintainer-owned release-risk decisions

[KeyffMS]

Decision

SightAdapt does not plan or require external legal, trademark, patent, privacy/DPO or medical-device audits. Release and business-risk decisions are made by the responsible maintainer/publisher using repository evidence, public sources and explicit risk acceptance.

Internal review is not legal advice. The project must not claim legal clearance, non-infringement, trademark availability, patent freedom to operate, MDR approval or professional audit.

Implemented governance

• docs/legal/LEGAL-RELEASE-GATE.md defines the maintainer review process;
• docs/legal/MAINTAINER-RELEASE-REVIEW-TEMPLATE.md defines a reusable internal decision record;
• docs/legal/MAINTAINER-RELEASE-REVIEW-0.5.0.50-alpha-2026-07-30.md records the current alpha decision;
• the decision package covers exact artifacts, checksums, SBOM, notices, privacy, contribution provenance, brand risk, intended purpose, patent risk and public claims;
• each risk is accepted, mitigated, excluded or blocking;
• material scope changes trigger a new maintainer review;
• privileged/external-advice storage and external sign-off are no longer project requirements.

Acceptance criteria

• Identify the responsible publisher and decision owner.
• Identify the current territories, channels, revenue/support model and users.
• Define the exact evidence package for a release decision.
• Include .NET redistribution, dependencies, SBOM, notices and licenses.
• Include trademark/name/logo risk and monitoring.
• Include intended-purpose and medical-claims boundaries.
• Include internal patent-risk treatment.
• Include privacy and support-data handling.
• Include contribution provenance and DCO evidence.
• Record known, accepted, mitigated and excluded risks.
• Add a reusable maintainer decision template.
• Add a current non-confidential decision for the alpha scope.
• Define invalidation and re-review triggers.
• Prohibit unsupported clearance, approval and non-infringement claims.
• Remove external-audit requirements from the project plan.

Implementation

• PR Document formal legal review and release gate #136 created the original evidence package and release gate.
• PR Replace external audit gates with maintainer risk decisions #139 replaced external sign-off with the maintainer-owned process and recorded the current alpha decision.

[KeyffMS]

PR #136 prepares the complete formal legal-release gate, counsel review package and non-confidential sign-off template. No qualified-counsel review has been performed, and the repository does not claim complete legal clearance. Closing this issue as not planned for the current free/open-source alpha stage. Reopen it before any production-ready claim, paid distribution or licensing, major-store production release, enterprise warranty/indemnity, or complete legal/regulatory/non-infringement representation.

[KeyffMS]

Wynik audytu uzupełniającego — 2026-07-30

Ocena: przygotowano proces, ale właściwy target state nie został wykonany; ponownie otwarte.

Repozytorium zawiera counsel review package, bramkę i szablon niepoufnego sign-offu. Nie odbył się jednak formalny przegląd kwalifikowanego counsel, nie zatwierdzono exact artifact/launch scope i nie istnieje ważny sign-off record. Zamknięcie jako not planned odraczało zadanie, ale nie realizowało jego celu.

Pozostałe prace

• ustalić dokładny podmiot publikujący, terytoria, kanały, revenue model, customer types oraz warunki wsparcia;
• dostarczyć counsel dokładny artefakt, checksum, SBOM, raporty licencji, notice’y, privacy, DCO/provenance, brand, claims i marketing;
• uzyskać wymagane specjalistyczne decyzje dotyczące .NET redistribution, trademark, MDR, patent FTO, privacy i end-user terms;
• zapisać ryzyka, warunki i finalną decyzję w prywatnym review file;
• opublikować niepoufny sign-off związany z dokładnym commit/tag/artifact checksum i zakresem launchu;
• technicznie blokować non-alpha/paid/store/enterprise release bez ważnego sign-offu.

Do czasu spełnienia tych warunków zabronione pozostają production-ready claims, płatna dystrybucja/licensing, duży store oraz enterprise warranties/indemnities.

[KeyffMS]

Triage priority — P2

Reason: the counsel package, gate and sign-off template are prepared, but no qualified-counsel review or valid public sign-off record exists. This does not block the current free/open-source alpha, but it blocks production, paid and warranted distribution.

Close only when:

• the exact final artifact, checksum, SBOM, notices, policies and marketing materials are supplied to qualified counsel;
• applicable specialist reviews are completed;
• mandatory conditions and accepted risks are evidenced;
• a non-confidential sign-off record identifies exact version, artifact, territories, channels, revenue model, customer groups and decision.

Escalation: immediately move to P0 before any production-ready claim, paid distribution/licensing, major-store production release or enterprise warranty/indemnity.