licensing: Demucs pretrained weights are scientific-use only; block commercial packaging

[seonghobae]

Commercial-release blocker

BandScope currently uses the pretrained Demucs htdemucs checkpoint (955717e8-8726e21a.th) for real stem separation. The Demucs source code is MIT, but the upstream maintainer explicitly states that the model weights are not covered by MIT and are provided only for scientific purposes.

Primary upstream evidence: facebookresearch/demucs#327, maintainer adefossez, issue comment 1134828611:

The model weights are not covered by the MIT license, and are provided only for scientific purposes.

The issue was specifically opened by a user asking about distributing a pretrained Demucs model as part of a commercial project. A 2024 follow-up asking about converted/rehosted weights did not receive a superseding maintainer grant. Third-party mirrors or labels therefore cannot establish BandScope's commercial redistribution/use rights.

Current BandScope evidence

• services/analysis-engine/pyproject.toml depends on Demucs on supported platforms.
• services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py uses htdemucs as the production separation model.
• The upstream Demucs remote manifest identifies 955717e8-8726e21a.th; htdemucs.yaml maps htdemucs to signature 955717e8.
• fix(project): stage saves before atomic publication #970 is tightening local checkpoint integrity/network-fail-closed behavior, but technical integrity does not create commercial model rights.

Required outcome

Do not ship, bundle, auto-download, or represent the upstream pretrained htdemucs weights as commercially licensed in a BandScope release unless ContextualWisdomLab obtains an explicit commercial-use/redistribution grant that covers the exact model artifact.

Commercial readiness requires one of:

1. documented explicit rights from the relevant rights holder(s) for the exact Demucs weights and intended BandScope use/distribution; or
2. replacement with a model whose weights and training-data-derived rights are commercially permitted and traceable; or
3. a CWL-owned/retrained separation model with documented training-data rights, model license, reproducibility, recognized source-separation metrics, and Windows/macOS package evidence.

Any replacement must preserve or improve the real-audio rehearsal contract. Synthetic arrays or heuristic FFT masks are not scientific acceptance.

Acceptance

• Commercial model-use and redistribution basis is documented with primary evidence.
• Exact model artifact/version/full digest and provenance are immutable release inputs.
• Package/SBOM/supplemental component inventory/NOTICE and updater rollback reflect the admitted model.
• Ordinary local analysis has no hidden model download or paid/network fallback.
• Rights-cleared real decoded audio demonstrates separation quality using recognized MIR/source-separation metrics with uncertainty/claim boundaries.
• Mandatory Windows and macOS packaged builds pass offline audible acceptance.
• Public/release documentation does not imply rights broader than the actual grant.

Relationship

This is distinct from #1129 (libsndfile LGPL runtime path). #1129 governs the audio I/O dependency license; this issue governs pretrained model-weight rights. Both block commercial release independently.