Commercial-policy defect
codec-carver currently makes ffmpeg/ffprobe part of the required executable conversion/probing boundary. ContextualWisdomLab's inbound policy does not accept GPL/LGPL/AGPL components as an inbound default for the commercial ecosystem.
Exact evidence
Repository evidence on protected main:
- root README requires
ffmpeg/ffprobe on PATH for the primary CLI and documents direct conversion/silence-splitting/metadata operations around FFmpeg;
- the advanced library path also resolves approved fixed-system
ffmpeg/ffprobe executables and treats those child processes as runtime authority;
- package metadata describes the product as FLAC/Opus carving but does not provide a permissively licensed in-repository codec implementation replacing that external boundary.
Upstream FFmpeg's current official legal page states that FFmpeg is licensed LGPL v2.1-or-later by default and becomes GPL v2-or-later when GPL-covered optional parts are enabled; FFmpeg is not offered under an alternate proprietary/commercial license. That is incompatible with this organization's stated inbound baseline even though LGPL/GPL can permit commercial activity under their own conditions.
Required outcome
Replace or remove the FFmpeg/FFprobe authority from the commercially supported product path without weakening codec correctness, metadata preservation, duration/size caps, splitting, probing, security, or real-audio acceptance.
Acceptance must include:
- a commercially permitted, organization-approved codec/probe implementation or service boundary with exact license provenance (prefer Apache-2.0/MIT/BSD-class permissive licensing);
- equivalent or stronger support for the product's required FLAC/Opus and any intentionally retained AAC/MP3 behavior, metadata preservation, duration/size admission, silence-aware splitting, probing, and safe subprocess/runtime boundaries;
- removal of FFmpeg/FFprobe from customer installation/README recommendations, runtime lookup/allowlists, Docker/build inputs, tests, operability/security docs, and supply-chain inventories where applicable;
- realistic audio fixtures and output validation against the current functional contract before declaring equivalence;
- explicit provenance/NOTICE handling for the replacement.
Do not solve this by relying on a particular LGPL-only FFmpeg build, moving FFmpeg to another container/process, suppressing license inventory, or treating process isolation as an exception to the organization policy. Until this closes, the package metadata's MIT grant can describe ContextualWisdomLab-owned source, but the current FFmpeg-backed execution path must not be represented as satisfying the commercial inbound-license baseline.
Commercial-policy defect
codec-carvercurrently makesffmpeg/ffprobepart of the required executable conversion/probing boundary. ContextualWisdomLab's inbound policy does not accept GPL/LGPL/AGPL components as an inbound default for the commercial ecosystem.Exact evidence
Repository evidence on protected
main:ffmpeg/ffprobeonPATHfor the primary CLI and documents direct conversion/silence-splitting/metadata operations around FFmpeg;ffmpeg/ffprobeexecutables and treats those child processes as runtime authority;Upstream FFmpeg's current official legal page states that FFmpeg is licensed LGPL v2.1-or-later by default and becomes GPL v2-or-later when GPL-covered optional parts are enabled; FFmpeg is not offered under an alternate proprietary/commercial license. That is incompatible with this organization's stated inbound baseline even though LGPL/GPL can permit commercial activity under their own conditions.
Required outcome
Replace or remove the FFmpeg/FFprobe authority from the commercially supported product path without weakening codec correctness, metadata preservation, duration/size caps, splitting, probing, security, or real-audio acceptance.
Acceptance must include:
Do not solve this by relying on a particular LGPL-only FFmpeg build, moving FFmpeg to another container/process, suppressing license inventory, or treating process isolation as an exception to the organization policy. Until this closes, the package metadata's MIT grant can describe ContextualWisdomLab-owned source, but the current FFmpeg-backed execution path must not be represented as satisfying the commercial inbound-license baseline.