[nulluserid]

What and why

Address the missing third-party license/notice report from @HANCORE-linux:
omacom/omarchy-plugin-marketplace#12276 (comment)

• Ship backend/THIRD_PARTY_NOTICES.txt with the existing bundled daemon: gRPC's Apache-2.0 LICENSE and NOTICE.txt, genproto/rpc's Apache-2.0 license, protobuf and Go/x/* BSD licenses, upstream patent grants/AUTHORS where present, and the Go amd64 runtime's Inferno-derived assembly attribution.
• Add a review-pinned license check to the release gate. The actual executable's compiler/module inventory must match the reviewed versions; bundled texts must match upstream files from those exact modules/toolchain.
• Add isolated rejection tests for missing/altered notices, dependency/version/compiler drift, replacements, and a missing upstream gRPC NOTICE. Failed generation preserves the existing notices file.
• Clarify that the root MIT license covers Dishy's own code, not its bundled dependencies.

This is a distribution/process correction only. Runtime/QML/manifest and the v1.5.2 executable are unchanged; no new versioned release or tag rewrite. The same gate still verifies a byte-identical rebuild. Notices must also accompany any separately redistributed executable. The explicit inventory is a reviewed baseline, not automatic legal analysis of arbitrary future dependencies.

Verification

Verification results and exact commit identity will be recorded before publication. No production deployment or live UI change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T03:35:40.934025Z	f2b851e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.