Step 14a/23 (Phase 3): Signatures — Create data-source licensing matrix + integration plan

[Jordan231111]

Summary

Create a formal licensing matrix for all candidate signature data sources, documenting redistribution rights, API requirements, rate limits, and update cadence. This gates all subsequent integration work.

Depends On: None (can start immediately)
Parent Issue: #12 (Integrate Real-World Malware Signatures)

Context

Before integrating any real-world signatures, we need to verify licensing terms for each source. This is a legal/compliance gate — no code integration should happen until a source is approved in this matrix.

Key Changes

1. Create docs/data-source-matrix.md with a table:
   | Source | Type | License | Redistribution Allowed? | API Key Required? | Rate Limits | Update Cadence | Integration Method |
2. Evaluate at minimum:
   • ClamAV (GPL-2.0, hash-only via sigtool) — file hashes (MD5, SHA1)
   • MalwareBazaar (Free API, attribution required) — file hashes (SHA256)
   • PhishTank (Free, non-commercial) — URL feeds
   • OpenPhish (Community feed) — URL feeds
   • EICAR (Public domain) — test file
3. For each source, document:
   • Whether we can redistribute the data or must fetch client-side only
   • Required attribution text
   • Whether an API key is needed and how users obtain one
4. Mark each source as: Approved / Approved-ClientSideOnly / Rejected / Needs-Review

Acceptance Criteria

• Data source matrix documents all candidate sources with license details
• Each source has a clear redistribution verdict (redistribute vs client-side-only)
• At least two sources are approved for integration
• Required attributions are documented
• API key requirements are noted with instructions for obtaining keys
• Matrix is reviewed and approved before integration work begins