Pillar: co-development.
WHY — Highest credibility-per-hour item available, and it is defensive as well as generous: a GPL-3.0-or-later crate statically linked into a proprietary binary would force source disclosure of the whole appliance. That is a five-minute check that can save a downstream integrator a quarter. Symmetrically, WAVE's own crate cannot be accepted into anyone's binary unless WAVE can prove its licence posture mechanically — the gate is a prerequisite for the egress trait crate being linkable, not a nicety.
GROUNDED — cargo add cuda-oxide resolves to Protryon v0.4.0 (2021), GPL-3.0-or-later (crates.io API, 2026-07-24); NVlabs' cuda-oxide is a different project — Apache-2.0, repo created 2026-04-22, self-described alpha, pinned to Rust nightly-2026-04-03 and LLVM 21+ (GitHub API). Two projects, one name. Separately, the ndi crate 0.1.2 (last published 2022-08-14) is flagged non-standard license on crates.io. WAVE precedent for exactly this discipline: wave-silicon/northstar/BOUNDARY-POLICY.md classifies every artifact PROCEED vs HOLD pending clean-room review and counsel, and puts a 4.7 GB vendored GPL kernel tree on HOLD.
Scope correction that must land in this node: cargo deny cannot see the two obligations that actually matter. (a) libsrt (Haivision SRT) is MPL-2.0, not BSD — weak copyleft at file granularity, which propagates into exactly the "third-party binary links it" scenario — and it is a native dependency, invisible to a crates.io licence scan. (b) The NDI SDK is not a crates.io dependency at all, so a deny-list of GPL/AGPL/SSPL would pass MPL-2.0 silently and never see NDI. A non-crates.io native-dependency licence review is therefore part of this gate, not an optional extra.
BOUNDARY — WAVE is authoritative on WAVE's own crates and advisory on anyone else's. This is not legal advice, and WAVE must never audit a third party's dependency tree without being handed the manifest — absent a Cargo.toml/Cargo.lock, any statement about what a downstream tree contains is UNVERIFIED. Frame the memo as "two projects share this name; here are both URLs; which one is in your lockfile?" — a question, never a correction.
TAXONOMY — Any downstream integrator whose proprietary binary would link a WAVE crate, and their counsel; Rust engineers on both sides of such an integration; WAVE legal and release engineering; the CI agent class that enforces the gate on every PR.
GATE — Entry G0 for the CI gate (no Rust licence gate exists today); the memo's factual content is already G1 GROUNDED, since both crates were verified via crates.io and GitHub APIs → target G3.
DONE-WHEN — cargo deny check runs on every WAVE Rust crate in CI with GPL, AGPL and SSPL denied and unlicensed set to deny; plus a native-dependency licence manifest covering every non-crates.io library any WAVE crate links (libsrt to MPL-2.0, NDI SDK to proprietary and sidecar-only, and any others), reviewed and committed; a green run captured as a dated receipt; and a one-page memo naming both cuda-oxide projects with their crates.io and GitHub URLs, publication dates and licences.
DEPENDENCIES — Blocks the egress trait crate's linkability claim. Consumes the licence findings from the SRT/RTMP implementation node.
Pillar: co-development.
WHY — Highest credibility-per-hour item available, and it is defensive as well as generous: a GPL-3.0-or-later crate statically linked into a proprietary binary would force source disclosure of the whole appliance. That is a five-minute check that can save a downstream integrator a quarter. Symmetrically, WAVE's own crate cannot be accepted into anyone's binary unless WAVE can prove its licence posture mechanically — the gate is a prerequisite for the egress trait crate being linkable, not a nicety.
GROUNDED —
cargo add cuda-oxideresolves to Protryon v0.4.0 (2021), GPL-3.0-or-later (crates.io API, 2026-07-24); NVlabs'cuda-oxideis a different project — Apache-2.0, repo created 2026-04-22, self-described alpha, pinned to Rust nightly-2026-04-03 and LLVM 21+ (GitHub API). Two projects, one name. Separately, thendicrate 0.1.2 (last published 2022-08-14) is flagged non-standard license on crates.io. WAVE precedent for exactly this discipline:wave-silicon/northstar/BOUNDARY-POLICY.mdclassifies every artifact PROCEED vs HOLD pending clean-room review and counsel, and puts a 4.7 GB vendored GPL kernel tree on HOLD.Scope correction that must land in this node:
cargo denycannot see the two obligations that actually matter. (a) libsrt (Haivision SRT) is MPL-2.0, not BSD — weak copyleft at file granularity, which propagates into exactly the "third-party binary links it" scenario — and it is a native dependency, invisible to a crates.io licence scan. (b) The NDI SDK is not a crates.io dependency at all, so a deny-list of GPL/AGPL/SSPL would pass MPL-2.0 silently and never see NDI. A non-crates.io native-dependency licence review is therefore part of this gate, not an optional extra.BOUNDARY — WAVE is authoritative on WAVE's own crates and advisory on anyone else's. This is not legal advice, and WAVE must never audit a third party's dependency tree without being handed the manifest — absent a
Cargo.toml/Cargo.lock, any statement about what a downstream tree contains is UNVERIFIED. Frame the memo as "two projects share this name; here are both URLs; which one is in your lockfile?" — a question, never a correction.TAXONOMY — Any downstream integrator whose proprietary binary would link a WAVE crate, and their counsel; Rust engineers on both sides of such an integration; WAVE legal and release engineering; the CI agent class that enforces the gate on every PR.
GATE — Entry G0 for the CI gate (no Rust licence gate exists today); the memo's factual content is already G1 GROUNDED, since both crates were verified via crates.io and GitHub APIs → target G3.
DONE-WHEN —
cargo deny checkruns on every WAVE Rust crate in CI with GPL, AGPL and SSPL denied and unlicensed set to deny; plus a native-dependency licence manifest covering every non-crates.io library any WAVE crate links (libsrt to MPL-2.0, NDI SDK to proprietary and sidecar-only, and any others), reviewed and committed; a green run captured as a dated receipt; and a one-page memo naming bothcuda-oxideprojects with their crates.io and GitHub URLs, publication dates and licences.DEPENDENCIES — Blocks the egress trait crate's linkability claim. Consumes the licence findings from the SRT/RTMP implementation node.