# Release Compliance (AGPL-3.0) — checklist & manifest spec

> Preparation document. Fill `[ADD: …]` per release. The LICENSE text controls;
> this is an operational checklist to meet AGPL-3.0 obligations when the
> Community Edition is distributed or offered over a network, including beside
> any commercial product.

Each release MUST record / provide:

- **Exact core source commit, release version, and binary/container digest.**
  - Source commit: `[ADD: SHA]` · Version: `[ADD: vX.Y.Z]`
  - Binary/container digest(s): `[ADD: sha256:…]`
- **Corresponding-source archive and checksum** — a pinned source archive for the
  exact released commit (not a moving branch), with its checksum:
  `[ADD: archive URL + sha256]`.
- **Required source, dependency material, build/install scripts, and notices** —
  the Corresponding Source includes build/install scripts, the generated
  `THIRD_PARTY_GO.txt` (transitive Go licenses), frontend license inventory,
  NOTICE, and LICENSE.
- **A source download accompanying binary delivery** — wherever a binary/image is
  offered for download, offer the matching Corresponding Source **beside it, at
  no additional charge** (or an equivalent valid written offer).
- **A prominent, exact-version source link in commercial deployments** — any
  commercial/hosted deployment that runs or exposes the AGPL core shows a clear
  link to the exact-version Corresponding Source (AGPL §13 remote-interaction).
- **Preserve any existing source-offer functionality** already in the product
  (in-app "get source" links, `--version` source references, etc.).
- **EULA carve-out** — any commercial EULA preserves users' rights in the
  open-source components (the EULA does not purport to restrict AGPL rights).
- **Release manifest** — a per-release record of source availability + third-party
  notices, archived with the release.

Do **not**:
- use a moving `main`-branch URL as the only source reference;
- promise that a generic GitHub ZIP always constitutes complete Corresponding
  Source (it may omit submodules/build metadata — verify per release);
- include credentials or unrelated proprietary deployment secrets in any bundle.

**Human review required** if a release introduces an appliance / "User Product"
(installation-information / Installation Information obligations), or a modified
or tightly-combined architecture — route to counsel before shipping.