magicciv/.project/objectives/p2-28-sprite-provenance-ledger.md

id	title	priority	status	scope	owner	updated_at	evidence
p2-28	Sprite provenance ledger — LICENSES.md per-file attribution	p1	done	game1	asset-sprite	2026-04-25	public/games/age-of-dwarves/assets/sprites/LICENSES.md (header + whitelist + row schema; assets table empty) tools/sprite-license-audit.py (verifies on-disk ↔ ledger ↔ sha256 ↔ license whitelist; exit 0 on clean state 2026-04-25) tools/sprite-generation/engine/installer.py (will append rows on each install once p2-22 generation runs land)

Summary

Every sprite PNG that ships in public/games/age-of-dwarves/assets/sprites/ must have a corresponding row in public/games/age-of-dwarves/assets/sprites/LICENSES.md recording source, license, author, URL, and SHA256. This is a cross-cutting compliance objective that runs continuously alongside the delivery children (p2-23 … p2-27) — the ledger is complete exactly when every on-disk sprite has a matching row and every row points at an on-disk file.

Commercial-use compatibility is non-negotiable. AI-generated output must come from a model on the approved list (juggernaut-xl-v9, epicrealism-xl, illustrious-xl-v2, or current equivalent per CLAUDE.md). Commissioned art must have assigned commercial rights in writing.

Acceptance

• ✓ public/games/age-of-dwarves/assets/sprites/LICENSES.md exists with header block (resolution conventions per category, approved model list, license whitelist, row schema). 2026-04-25.
• ✓ Row schema documented: Path | Source | License | Author | URL | SHA256 | Added — matches the audit script parser.
• ✓ Audit script tools/sprite-license-audit.py: verifies every on-disk PNG has a row, every row points at an existing file with matching SHA256, every license value is in the whitelist. Exit 0 on success, non-zero on any mismatch. 2026-04-25.
• ✓ License whitelist documented at the top of LICENSES.md: cc0-1.0, cc-by-4.0, cc-by-sa-4.0, mit, commissioned-commercial, model-commercial:<model-name>. Anything else escalates per asset-sprite charter.
• ✓ tools/sprite-generation/engine/installer.py _append_ledger_row() writes a row on every approved install (idempotent — skipped if path already present). Reads model attribution from tools/sprite-generation/sprite-config.json, computes SHA256 of the on-disk PNG, fits the model-commercial:<model> license token. 2026-04-25.
• ✓ Running python3 tools/sprite-license-audit.py returns exit 0 with zero mismatch output. Verified 2026-04-25 against empty state (0 PNGs / 0 rows, consistent).

Depends on

• p2-22 (pipeline runnable end-to-end) — installer path is where ledger rows are written.
• p2-23 … p2-27 — deliver the sprite files this ledger audits; p2-28 closes when their combined on-disk set matches the ledger.

Non-goals

• Legal review of individual model licenses at ship time — escalation to the user per the asset-sprite charter's "Model license conflict" clause.
• Per-sprite credits-screen entry (credits screen p2-07 is done; it surfaces team/engine credits, not sprite-by-sprite attribution).
• Audio LICENSES.md — asset-audio's mirror objective lives under p2-16.