NOTICES

CoordiNode Third-Party Notices
================================

CoordiNode is published under AGPL-3.0-only (see LICENSE and COPYRIGHT).
This file records what in the tree comes from elsewhere, and under which
terms.


## Dependencies

Every crate this workspace depends on keeps its own licence. The licences
accepted for dependencies are declared in `deny.toml` and checked in CI with
`cargo deny`. Binary packages (RPM, DEB, container images) combine those
crates into one AGPL-3.0-only program; the full text of each dependency's
licence is available from its source distribution or crates.io page.

Each embedded library release after 0.9.0 carries, as GitHub release assets, a licence
inventory (`crates-io-<toolchain>-<features>-licenses.json`) and a CycloneDX
SBOM (`…-sbom.cdx.json`) of the graph an application installing it from
crates.io builds: per toolchain, feature set and target, with registry
checksums and the licence and notice files each package ships. Check that the
toolchain, target and features match the build being used; an application's
own lockfile may resolve other allowed versions. A server dependency report
does not by itself describe the dependencies of an embedding application.

The storage engine is `coordinode-lsm-tree` (Apache-2.0), consumed from
crates.io. It is a maintained fork of `fjall-rs/lsm-tree`; the attribution to
the original authors is carried in that crate's own repository and source
headers, not here.


## Embedded data

`crates/coordinode-search/data/jieba/dict.txt.zst` is jieba's default Chinese
dictionary, `src/data/dict.txt` of `jieba-rs` 0.11.0 (MIT, Copyright (c)
2018 - 2019 messense, Copyright (c) 2019 Paul Meng; the dictionary comes from
the jieba project, MIT, Copyright (c) 2013 Sun Junyi), recompressed with zstd.
Both licences, in full, are in `crates/coordinode-search/data/jieba/LICENSE`
beside it. It is unmodified: it
decodes to the original byte for byte, which the crate's tests check. It is
built into binaries with the `cjk-zh` feature.


## Provenance

During private development, before the first public release (April 2026),
CoordiNode consumed a set of storage modules derived from `fjall-rs/fjall`
(Apache-2.0). Those modules were replaced by `coordinode-lsm-tree` before the
public tree was created: no fjall-derived source is present in this
repository, and none was present in its published history. This paragraph is
kept as a record of that lineage.