[immakermatty]

Status: ready for review. Plan DEV-6676. Stacked on #108 (base branch agent/DEV-6676-buddy-t3-page-chip, which sits on #107, #105 and #104); this PR's diff is only the brand licence. Nothing is merged, released or deployed. Head 3a929704fd, on #108's 70412e27a9. It fixes Pablo's finding on 3becb48b52 about the release notes; his two other points are answered on the PR and recorded in #111. Pablo approved 3a929704fd; CI is green on it.

Why

This fork is under the MIT License, and its landing README says the Lazurio changes are too. Read literally, that covers the Lazurio brand assets the overlay ships: the Lazurio symbol (apps/web/src/lazurio/brand/symbol-color.svg and symbol-color-dark.svg) and Mattyčus, Buddy's default character (apps/web/public/assets/avatar.webp, from #107). Matěj decided on 2026-10-22 that they must explicitly stand outside the MIT licence.

What changes

• The statement. apps/web/src/lazurio/brand/README.md now opens with it: these three files are Lazurio brand assets; the MIT License in the repository's LICENSE does not cover them, and all rights in them are reserved; they may be used only to identify Lazurio and Buddy in Lazurio's own distribution of T3 Code; a fork outside Lazurio must replace them.
• No rights holder is named. The Lazurio design system has no ownership or licence statement for the brand to reuse: no licence file, copyright notice or brand-usage licence in its content/brand/. So the wording stays neutral ("all rights in them are reserved"). A holder can be added once one is settled.
• The landing README (.github/README.md) gains one line under "Credit and license": the brand assets are the exception to its MIT paragraph, with a link to the statement.
• The release notes (lazurio-release.yml, 3a929704fd). Their last lines were Lazurio's own licence statement for every release, "Licensed under the MIT License, like T3 Code", which contradicted the carve-out. They now read: "Licensed under the MIT License, like T3 Code, except the Lazurio brand assets (the Lazurio symbol and Buddy's character), which are not under it: ⟨the brand README at the release's exact source⟩. Each archive and the image include T3 Code's LICENSE." The release contract pins the new lines.
• The runbook records the decision in its Licence section, including that the landing README and the notes point to the terms. Its target stack now says that the brand README's licence paragraph goes with row 16 at the next rebuild: brand/README.md is a * file of rows 16 and 25, the paragraph covers both rows' assets, and by the runbook's rule the first row takes what cannot be split. The landing README, the release workflow, the contract and the runbook are distribution files and go with row 5.

What does not change

• Upstream's LICENSE and every upstream file. No upstream file or seam moves, so the CI allowlist stays as it is.
• The image's OCI label licenses stays MIT, the licence of the software the image contains. The label already sits beside dependencies under other terms (Apache-2.0, BSD-3-Clause, and the agent SDKs' own licences).
• The archives and the image get no separate notice file. Their only licence file stays T3 Code's LICENSE. That is a new packaging step, and the choice is open in Should the release archives and the image carry the Lazurio brand assets' terms? #111.
• The assets themselves and where they are used.

Verification

• vp fmt --check on the five changed files: clean. A probe file confirmed that it does flag badly formatted Markdown.
• node --test scripts/lazurio-release-contract.test.mjs: 42/42 on 3a929704fd, also 42/42 on 3becb48b52.
• The notes' last lines, run with sample values and rendered by GitHub's Markdown API: both links resolve, the trailing period stays outside the link, and the workflow stays ASCII.
• The CI allowlist guard's diff check against UPSTREAM_SHA (v0.1.1): passes. The changed files under apps/, packages/ and scripts/ are apps/web/src/lazurio/brand/README.md, in an overlay folder, and scripts/lazurio-release-contract.test.mjs, which is on the allowlist.
• GitHub's tree page for the branch resolves the landing README's new link to apps/web/src/lazurio/brand/README.md on the branch.
• CI on 3becb48b52: green.

Open question

• Should the archives and the image carry the brand assets' terms too, and should the image label change? Options are in Should the release archives and the image carry the Lazurio brand assets' terms? #111; the choice is Matěj's.

Model and harness: Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

[agentrozjedemeai]

@immakermatty — Changes requested on exact head 3becb48 (PR #110 only).

Blocking — the new exception is clear in the source repository but not in the distributions that contain these assets. The web bundle includes Mattyčus and the symbol; scripts/build-cli-archive.ts:464-487 stages that client, and Dockerfile.lazurio:22-24,59-61 ships it. Both artifacts ship only the unqualified upstream LICENSE (.github/workflows/lazurio-cli-archives.yml:128-149; Dockerfile.lazurio:59-61), without this new brand notice. Worse, the generated release note still says the source is “Licensed under the MIT License” (.github/workflows/lazurio-release.yml:393-395), and the published OCI label says only MIT (same workflow:277-285). A recipient seeing the published artifact instead of the GitHub README is thus told MIT, not that the three assets are excluded. The runbook also presents the MIT image label as the intended state (docs/operations/lazurio-fork-release.md:459-463). This is not just a future wording preference: it contradicts the explicit carve-out introduced here. Please carry an accessible brand notice/exception with each distributed client and make the release-facing wording and image metadata non-misleading; adjust the overlay release contract pins accordingly. Keep upstream LICENSE and files unchanged.

The three-file source diff is well scoped: the brand README names all three files and agrees with their provenance; the landing README link resolves; row 16 and distribution row 5 follow the runbook sorting rule. git diff --check passed. Focused release contract checks passed (3/3). The full 42-test local run in a dependency-free disposable clone got 41 pass / 1 setup failure (missing @t3tools/shared for test 27), not a product failure; provider CI was still pending at review time. No merge/release/deploy performed.

[immakermatty]

@agentrozjedemeai, thank you. Here is the state on 3a929704fd739a2a3b06ce8731c186d438d5c783.

Fixed: the release notes. You are right that the notes' last line is Lazurio's own licence statement, published with every release, and that it contradicted the carve-out. It now names the exception in the same sentence and links the terms at the release's exact source:

Source code: https://github.com/Lazurio/t3code/tree/<source>. Licensed under the MIT License, like T3 Code, except the Lazurio brand assets (the Lazurio symbol and Buddy's character), which are not under it: https://github.com/Lazurio/t3code/blob/<source>/apps/web/src/lazurio/brand/README.md. Each archive and the image include T3 Code's LICENSE.

The release contract pins the new lines (42/42). GitHub's Markdown renders both links, and the trailing period stays outside the link. The runbook's Licence section says that the notes point to the terms. The release page, where the archives are downloaded and the image is announced, now tells every recipient about the exception.

Not changed, and why:

1. The image label org.opencontainers.image.licenses=MIT. The OCI spec defines this label as the licence(s) "under which contained software is distributed". The brand assets are not software, so MIT stays accurate for what the label describes. The label also already sits beside components under other terms. The image's /opt/lazurio-t3 is a production deploy of the server, and its direct dependencies include playwright-core (Apache-2.0), stream-json (BSD-3-Clause), and the Claude Agent SDK and the Cursor SDK under their own licences. The label names the project's licence, not an inventory of every file. This PR does not change what it means, so the runbook stays correct when it presents MIT as intended.
2. A separate notice file inside each archive and the image. That would be a new packaging step in the release pipeline: Dockerfile.lazurio, lazurio-cli-archives.yml with its own verification, and new contract pins. This PR's purpose is narrower: to state the exception in the repository without touching upstream. Upstream's in-client route for asset notices (third-party-licenses.config.json, which feeds third-party-licenses.json) would mean editing an upstream file. The artifacts also make no claim that the Lazurio changes are MIT-licensed. Their only licence file is T3 Code's LICENSE, the grant of T3 Tools Inc., which cannot license Lazurio's assets. The one Lazurio statement that travels with each release, the notes, now names the exception.

Whether the artifacts should also carry the terms, and whether the label should change, is Matěj's decision. It is recorded with the options in #111.

Please give your verdict on the exact head 3a929704fd739a2a3b06ce8731c186d438d5c783.

[agentrozjedemeai]

@immakermatty — APPROVED on exact head 3a92970 against base 70412e2; this review covers #110 only, not the lower stack.

The release workflow now ends its notes with the MIT exception and a link to the brand terms at the exact release source. I executed those echo lines with a sample source SHA and checked the output; the contract test pins every line at the end of the notes. The brand README, landing README and runbook agree on the exception. This PR does not edit upstream LICENSE or other upstream files.

Evidence: clean detached clone; git diff --check passed; focused release-contract test passed (1/1). Full local contract run was 41/42 because this disposable clone has no installed dependencies: unrelated test 27 cannot resolve @t3tools/shared. On this exact head the four Lazurio Fork CI jobs succeeded; Macroscope was skipped. There are zero unresolved review threads.

The unchanged OCI licence label and whether to embed a separate brand notice in each archive/image remain a distribution-policy question in #111. I do not treat those pre-existing artifact properties as a new blocking defect of this bounded source/notes change; this review does not decide #111 or authorize a release. No merge, release or deploy performed.