licensing: replace bundled libsndfile LGPL runtime path

[seonghobae]

Commercial-policy defect

BandScope's analysis engine directly depends on soundfile>=0.13.1. The Python soundfile package itself is BSD-3-Clause, but its documented binary-wheel/runtime path relies on libsndfile; platform wheels bundle libsndfile, whose license is LGPL. ContextualWisdomLab does not accept GPL/LGPL/AGPL components as an inbound default for the commercial ecosystem.

Exact evidence

• services/analysis-engine/pyproject.toml declares soundfile>=0.13.1 in the runtime dependency set.
• python-soundfile 0.13.1 documentation states that SoundFile is BSD-3-Clause while audio I/O is provided by libsndfile, an LGPL library; modern platform-specific wheels preferentially load and can bundle a current libsndfile copy.
• Therefore checking only the top-level Python package license is insufficient for the actual distributed/runtime dependency boundary.

Required outcome

Replace or remove the libsndfile-backed runtime path from the commercially supported BandScope product without weakening real-audio behavior.

Acceptance must include:

1. a commercially permitted, organization-approved audio I/O boundary with exact transitive/native license provenance (prefer Apache-2.0/MIT/BSD-class permissive licensing);
2. equivalent or stronger decoding/encoding semantics for the formats BandScope actually supports, with realistic audio fixtures and platform validation;
3. removal of the LGPL native dependency from lock/build/package/SBOM/release inputs rather than merely changing the Python wrapper;
4. updated dependency policy, architecture, README/public docs, SBOM/NOTICE/third-party evidence where applicable;
5. validation on the mandatory Windows and macOS product lanes before commercial readiness is claimed.

Do not solve this by suppressing native dependency inventory, pinning a different LGPL libsndfile build, or treating wheel/container/process separation as a waiver of organization policy.

[seonghobae]

Canonical implementation ownership should stay in the existing #781 Resource Admission & Decode vertical, currently PR #985 (feat/canonical-audio-resource-policy-781), rather than spawning another decoder micro-PR.

Fresh code review confirms the compliance defect is broader than the direct soundfile declaration: protected/current #985 production decoding still reaches librosa.load from temporal analysis, stem separation, and bass transcription, while the metadata preflight directly uses soundfile.info with audioread fallback. Removing only the direct soundfile line therefore cannot prove libsndfile is absent from packaged/runtime inputs.

Replacement decision boundary:

• Do not use audioread→ffmpeg/GStreamer as a hidden workaround; it changes neither the requirement for exact native/transitive license provenance nor the supported-path acceptance contract.
• Symphonia is the strongest single Rust technical candidate found for WAV/MP3/FLAC/AAC/MP4 coverage, but its MPL-2.0 license is explicitly review-class under the current organization SBOM/license control plane. It must not be silently treated as approved.
• Dropping M4A/AAC would simplify a permissive pure-Rust decoder set but is a buyer-visible format regression and needs an explicit product decision.
• The default engineering route that avoids a new reciprocal-code dependency is a dedicated Resource Admission & Decode Rust port using Windows Media Foundation and macOS AVFoundation on the product's mandatory Windows/macOS targets, exposed to Python only through a bounded typed adapter. Keep DSP/math ownership separate from the existing bandscope_numeric crate. This route still requires exact SDK/binding provenance and real Windows/macOS decode parity/resource evidence before licensing: replace bundled libsndfile LGPL runtime path #1129 can close.

Acceptance for #985/#1129 must remove libsndfile from the actual lock/build/package/SBOM/release graph, route metadata probe and PCM decode through the same admitted decoder authority, preserve WAV/MP3/FLAC/M4A behavior unless the product owner explicitly changes the format contract, and exercise rights-safe real fixtures on mandatory Windows/macOS lanes. No predecessor checks/reviews transfer after that branch changes.

[seonghobae]

Fresh single-writer reconciliation: live PR state now identifies #866 (fix/audio-resource-policy-781@3a76907dd3df603cc65188fa6d5c97d583f744e4) as the canonical #781 Resource Admission & Decode implementation owner. #985 remains Draft preservation/reference work because its compressed-container M4A fallback and alternate error contract still contain unique behavior not yet transferred; it is not a second canonical writer and must not be closed until that behavior is reconstructed or explicitly retired with product/security evidence. Apply #1129’s libsndfile-removal work to #866/current semantic successor, preserving #985’s valid requirements without copying its path/subprocess authority blindly. The earlier comment naming #985 as canonical is therefore stale ownership metadata, not current implementation authority. No checks/reviews/approvals transfer between #985 and #866.

[seonghobae]

Fresh #1129 decoder-candidate triage, against canonical #866 exact head c5cc94feda19f8c75504abab9731717963309932 and live protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9:

The implementation boundary is still unresolved, but the candidate set is now narrower and materially different from the earlier platform-API-only recommendation.

• Symphonia remains the mature single-stack technical candidate. Its upstream README currently lists AAC-LC, MP3, FLAC, OGG/Vorbis, WAV and ISO/MP4 demux/decoding support and explicitly licenses the project under MPL-2.0: https://github.com/pdeljanov/Symphonia . This preserves the current compressed-format product surface much better than a narrow WAV/FLAC-only replacement, but MPL-2.0 is not within licensing: replace bundled libsndfile LGPL runtime path #1129's current preferred MIT/Apache/BSD-class default. It therefore requires an explicit organization license-policy decision before adoption; do not treat technical fit as license approval.
• RustAudio/audrey is cleanly dual MIT/Apache-2.0 and pure Rust, but upstream supports only FLAC, Ogg Vorbis, WAV and ALAC-in-CAF: https://github.com/RustAudio/audrey . It cannot preserve BandScope's current .mp3, .m4a/AAC, .aac and .opus-adjacent intake contract by itself, so adopting it alone would be a buyer-visible format regression rather than a transparent licensing: replace bundled libsndfile LGPL runtime path #1129 repair.
• OxideAV is now a credible permissive-license candidate worth an executable spike: the organization states every crate is MIT, pure Rust/no C codec libraries for the software path, with MP4 plus AAC/MP3/FLAC/Vorbis/Opus coverage: https://github.com/OxideAV . However its own current workspace status marks Vorbis decode at about 86% and Opus decode at about 95%, and the Opus crate explicitly says its clean-room rebuild is still in progress. Those are release-readiness risks, not cosmetic gaps. Do not replace libsndfile with an immature stack and call commercial parity complete merely because the license is permissive.

Decision consequence: there is currently no evidenced option that is simultaneously (a) already organization-approved under the preferred permissive-license policy, (b) mature across the full advertised compressed-format surface, and (c) ready to replace the current soundfile/librosa graph without real-audio/platform qualification. #1129 should therefore remain blocked on one explicit product/license decision, while engineering can prepare evidence without changing the supported-format contract:

1. approve MPL-2.0 Symphonia for this bounded decoder component and then prove full real-audio parity/resources on Windows/macOS; or
2. approve a BandScope-owned OxideAV qualification/hardening path, with no release claim until rights-cleared WAV/FLAC/MP3/AAC/M4A/Ogg/Opus fixtures, malformed/resource cases, fuzz/corpus evidence and Windows/macOS package/SBOM prove the exact subset; or
3. deliberately reduce the supported-format contract to a permissive mature subset, which is a buyer-visible product decision and must update intake UI/docs/tests before implementation.

Until one of those decisions is accepted, keep #866 as the single Resource Admission & Decode owner, keep #985 open as preservation evidence for the unsuperseded M4A behavior, and do not add a new decoder micro-PR. A technical spike must live in the canonical owner/successor, remain Draft, and must not remove soundfile/librosa or alter public format claims until the replacement proves exact lock/build/package/SBOM absence of libsndfile plus real decoded-audio parity.