Implement Microsoft .NET redistribution obligations

MICROSOFT-DOTNET-REDISTRIBUTION.txt

@@ -0,0 +1,98 @@
+SIGHTADAPT MICROSOFT .NET REDISTRIBUTION NOTICE
+
+Reviewed release configuration
+
+SightAdapt version: 0.5.0.50-alpha
+.NET SDK used to build: 8.0.423
+.NET Runtime: 8.0.29
+Windows Desktop Runtime: 8.0.29
+Target framework: net8.0-windows10.0.19041.0
+Runtime identifier: win-x64
+Publication: self-contained, single-file Windows application
+Maintainer review date: 2026-07-29
+
+1. Separate licenses
+
+SightAdapt's own source code is licensed under the MIT License in LICENSE.txt.
+That license does not replace, expand or modify the separate terms governing
+Microsoft .NET components included in the binary distribution.
+
+The Microsoft license text and exact release evidence are provided in:
+
+- DOTNET-LICENSE-NOTICE.txt
+- THIRD-PARTY-NOTICES.txt
+- DOTNET-NOTICE-METADATA.json
+
+If this summary conflicts with those files or Microsoft's authoritative terms,
+the authoritative Microsoft terms control for Microsoft components.
+
+2. How Microsoft components are distributed
+
+Microsoft .NET components are included in object-code form only as part of the
+SightAdapt application. They are not offered, branded or distributed by the
+SightAdapt project as a standalone Microsoft .NET product.
+
+SightAdapt and its distributors must preserve this notice, the imported
+Microsoft license text and all applicable third-party notices in every copy of
+the application package.
+
+3. Recipient conditions for Microsoft components
+
+To the extent permitted by applicable law, recipients and downstream
+distributors must not:
+
+- remove, minimize, block or alter Microsoft or supplier notices;
+- work around technical limitations in Microsoft components;
+- reverse engineer, decompile or disassemble Microsoft components except where
+  applicable law or third-party licensing terms expressly permit it;
+- use Microsoft trademarks in a product name or imply that SightAdapt is made,
+  sponsored, certified or endorsed by Microsoft;
+- redistribute Microsoft components as a standalone offering;
+- use or distribute Microsoft components unlawfully or contrary to applicable
+  export-control restrictions;
+- impose source-disclosure or reciprocal-license conditions on Microsoft
+  distributable code where Microsoft's terms prohibit doing so.
+
+A downstream distributor may redistribute the included Microsoft components
+only as part of an intact SightAdapt application distribution, under terms that
+protect those components at least as much as Microsoft's applicable agreement.
+The downstream distributor is responsible for claims arising from its own
+packaging, representations, modifications or distribution, except to the extent
+a claim is based solely on unmodified Microsoft distributable code.
+
+4. No Microsoft endorsement or support
+
+Microsoft does not publish, sponsor, certify or endorse SightAdapt. Microsoft
+trademarks and product names identify compatibility or included components only.
+Support for SightAdapt is provided, if at all, by the SightAdapt project and not
+by Microsoft.
+
+5. Warranty and liability for Microsoft components
+
+Microsoft components are licensed on an "as-is" basis under Microsoft's terms.
+Microsoft provides no additional warranty, guarantee or support through
+SightAdapt. Microsoft's warranty exclusions and limitations of remedies apply
+subject to mandatory consumer and other rights that cannot lawfully be excluded
+in the recipient's jurisdiction.
+
+6. Authoritative sources
+
+Microsoft .NET product-distribution licensing model:
+https://github.com/dotnet/core/blob/main/license-information.md
+
+Microsoft .NET Library License Terms:
+https://dotnet.microsoft.com/en-us/dotnet_library_license.htm
+
+The exact source package, version mapping and checksums used by this build are
+recorded in DOTNET-NOTICE-METADATA.json.
+
+7. Review status and release gate
+
+This notice records the project's technical compliance implementation and a
+maintainer review of the identified distribution terms. It is not a legal
+opinion and does not claim review by qualified legal counsel.
+
+Before any official production or paid distribution, the complete resulting
+text and package must receive the qualified legal review required by SightAdapt
+Issue #93. Until that sign-off exists, production and paid distribution remain
+blocked.

docs/PACKAGING.md

@@ -15,10 +15,11 @@ Every package must place the following files at the package root so they can be
 | File | Purpose |
 |---|---|
 | `SightAdapt.exe` | Application executable |
-| `LICENSE.txt` | SightAdapt MIT License |
+| `LICENSE.txt` | SightAdapt MIT License; applies to SightAdapt project code, not Microsoft redistributables |
 | `THIRD-PARTY-NOTICES.txt` | Exact-version notices imported from the reviewed Microsoft .NET release distribution |
 | `DOTNET-LICENSE-NOTICE.txt` | Exact-version Microsoft .NET license text and source metadata |
 | `DOTNET-NOTICE-METADATA.json` | Machine-readable SDK, runtime, RID, runtime-pack, source and checksum evidence |
+| `MICROSOFT-DOTNET-REDISTRIBUTION.txt` | End-user and downstream-distributor conditions that keep Microsoft components separate from SightAdapt's MIT license |
 | `DEPENDENCIES.md` | Human-readable inventory of shipped, platform and development dependencies |
 | `PRIVACY.md` | Application privacy and local-data notice |
 
@@ -37,11 +38,11 @@ The same legal-document bundle is required for:
 
 Installers and store packages may additionally display or register legal information through platform-specific metadata, but that does not replace including the files in the installed or unpacked application directory.
 
-Release mirrors must copy the verified archive without removing, renaming or replacing the legal files. A third-party repackager must preserve the notices and add any notices required by its own packaging layer.
+Release mirrors must copy the verified archive without removing, renaming or replacing the legal files. A downstream distributor may redistribute Microsoft components only as part of an intact SightAdapt application package and must preserve terms that protect the Microsoft distributable code at least as much as the applicable Microsoft agreement.
 
 ## Publish behavior
 
-`src/SightAdapt/SightAdapt.csproj` copies the legal baseline into the publish directory. `tools/generate-dotnet-notices.ps1` must then replace the baseline .NET files with exact-version material and add the metadata record before packaging.
+`src/SightAdapt/SightAdapt.csproj` copies the legal baseline and redistribution notice into the publish directory. `tools/generate-dotnet-notices.ps1` then replaces the baseline .NET files with exact-version material and adds the metadata record before packaging.
 
 The expected publish layout begins with:
 
@@ -52,6 +53,7 @@ artifacts/win-x64/
 ├── THIRD-PARTY-NOTICES.txt
 ├── DOTNET-LICENSE-NOTICE.txt
 ├── DOTNET-NOTICE-METADATA.json
+├── MICROSOFT-DOTNET-REDISTRIBUTION.txt
 ├── DEPENDENCIES.md
 └── PRIVACY.md
 ```
@@ -74,9 +76,9 @@ Compress-Archive `
 .\tools\test-release-package.ps1 -ArchivePath $archive
 ```
 
-The validation script opens the final ZIP and checks the entries listed in `release/required-files.txt`. Required documents must be readable UTF-8 text. The .NET metadata must match the exact release inputs in `Directory.Build.props`, contain valid checksums and map both required runtime packs.
+The validation script opens the final ZIP and checks the entries listed in `release/required-files.txt`. Required documents must be readable UTF-8 text. The .NET metadata must match the exact release inputs in `Directory.Build.props`, contain valid checksums and map both required runtime packs. The redistribution notice must identify the same product, SDK, runtime, target framework, RID and publish mode, clearly separate Microsoft's terms from MIT, prohibit standalone redistribution and disclaim Microsoft endorsement.
 
-## Microsoft .NET notices
+## Microsoft .NET notices and redistribution position
 
 SightAdapt is a self-contained Windows application. `global.json` pins the SDK, while `Directory.Build.props` records the expected SDK/runtime release mapping. The actual restore graph in `project.assets.json` identifies the exact runtime packs selected by the build.
 
@@ -93,20 +95,21 @@ The package record identifies:
 - SHA-256 values for the imported license and notice text;
 - generation time and product version.
 
-See [Exact-version .NET notice generation](legal/DOTNET-NOTICE-GENERATION.md).
+The reviewed redistribution position is documented in [Microsoft .NET redistribution analysis](legal/DOTNET-REDISTRIBUTION.md). `MICROSOFT-DOTNET-REDISTRIBUTION.txt` implements the recipient and downstream-distributor notice in each binary package. See also [Exact-version .NET notice generation](legal/DOTNET-NOTICE-GENERATION.md).
 
 ## Release checklist
 
 Before publishing or mirroring a binary package:
 
 1. verify the pinned release metadata;
-2. restore, build and test the application;
-3. publish into a clean staging directory;
-4. generate exact-version .NET notices from the hash-verified official SDK package and actual restore graph;
-5. inspect the generated notice metadata and any newly mapped runtime component;
-6. create the final archive or platform package;
-7. validate the final archive with `tools/test-release-package.ps1`;
-8. inspect the package manually to confirm that every legal document opens without running SightAdapt;
-9. publish the same verified bytes to every official mirror.
-
-Do not publish an official binary release when the legal bundle, exact-version generation, package checksum, runtime mapping or final-archive validation is incomplete.
+2. verify the Microsoft .NET redistribution analysis and package notice;
+3. restore, build and test the application;
+4. publish into a clean staging directory;
+5. generate exact-version .NET notices from the hash-verified official SDK package and actual restore graph;
+6. inspect the generated notice metadata and any newly mapped runtime component;
+7. create the final archive or platform package;
+8. validate the final archive with `tools/test-release-package.ps1`;
+9. inspect the package manually to confirm that every legal document opens without running SightAdapt;
+10. publish the same verified bytes to every official mirror.
+
+Do not publish an official binary release when the legal bundle, redistribution notice, exact-version generation, package checksum, runtime mapping or final-archive validation is incomplete. Production or paid distribution additionally remains blocked until the qualified legal review required by Issue #93 is recorded.

docs/README.md

@@ -4,13 +4,15 @@ The documentation describes the current SightAdapt implementation and the canoni
 
 - [Product identity and brand usage](BRAND.md) — canonical name, `™` notation, descriptions, publisher attribution, website URL, and asset rules.
 - [Release naming and attribution](RELEASING.md) — public release-title, tag, artifact, website, publisher, and mark conventions.
-- [Binary packaging standard](PACKAGING.md) — required legal files, exact-version notices, archive validation and distribution-format rules.
+- [Binary packaging standard](PACKAGING.md) — required legal files, redistribution notice, exact-version notices, archive validation and distribution-format rules.
+- [Microsoft .NET redistribution analysis](legal/DOTNET-REDISTRIBUTION.md) — Microsoft-origin component inventory, applicable terms, package implementation, review triggers and professional-review gate.
 - [Exact-version .NET notice generation](legal/DOTNET-NOTICE-GENERATION.md) — pinned SDK/runtime inputs, official package verification, notice import, checksums and update triggers.
 - [Complete functionality](FEATURES.md) — user-visible behavior, profiles, application assignments, overlay scopes, switching, settings, safety, and limitations.
 - [Current architecture](ARCHITECTURE.md) — authorities, sources of truth, settings transaction, foreground switching, overlay lifecycle, geometry, UI boundaries, and failure behavior.
 - [Build and package a standalone EXE](BUILD.md) — step-by-step local self-contained Windows x64 publication and archive verification.
 - [Privacy notice](../PRIVACY.md)
 - [Dependency inventory](../DEPENDENCIES.md)
+- [Microsoft .NET redistribution notice](../MICROSOFT-DOTNET-REDISTRIBUTION.txt)
 - [Third-party notices](../THIRD-PARTY-NOTICES.txt)
 - [Security policy](../SECURITY.md)
 - [Contribution guide](../CONTRIBUTING.md)