Add licence audit and attribution

LICENSING.md

@@ -0,0 +1,70 @@
+# Licensing & attribution — Sauti Swahili TTS public release
+
+Audit performed 2026-07-28 ahead of the public community release. Every training
+source and base model was checked against its published licence page.
+
+**Bottom line: a public release is viable.** Every verified source is CC-BY-4.0,
+MIT, or Apache-2.0 — all permit redistribution and commercial use, and CC-BY
+requires only attribution, which this file provides. One source (Common Voice)
+is unresolved; see *Open items*.
+
+## Base models
+
+| Model | Licence | Notes |
+|---|---|---|
+| [nari-labs/Dia-1.6B](https://huggingface.co/nari-labs/Dia-1.6B) | Apache-2.0 | Model card adds a **responsible-use disclaimer**: no impersonation of real people without consent, no deceptive content; states research/educational intent. Mirror this in our card. |
+| [openbmb/VoxCPM2](https://huggingface.co/openbmb/VoxCPM2) | *verify before release* | Only needed if VoxCPM is released publicly too. |
+
+## Training data (`sw_voxcpm_corpus_v1`)
+
+| Source | Dataset | Licence |
+|---|---|---|
+| waxal_swa_tts | google/WaxalNLP | CC-BY-4.0 |
+| fleurs_sw_ke | google/fleurs | CC-BY-4.0 |
+| afrivoice_swahili_{agriculture,education,financial,government,health} | DigitalUmuganda/Afrivoice_Swahili | CC-BY-4.0 |
+| swahili_speech_400hr | badrex/swahili-speech-400hr | CC-BY-4.0 |
+| yodalingua_swahili | Thomcles/YodaLingua-Swahili | CC-BY-4.0 (states commercial use allowed) |
+| bateesa_kiswahili_tts | Bateesa/kiswahili-tts-dataset | CC-BY-4.0 |
+| jacksonwambali_swahili_tts | jacksonwambali/swahili-tts-dataset | CC-BY-4.0 |
+| cdli_kenyan_swahili_nonstandard | cdli/kenyan_swahili_nonstandard_speech_v1.0 | CC-BY-4.0 |
+| swahili_words_parallel | michsethowusu/swahili-words-speech-text-parallel | CC-BY-4.0 — audio originally published by the International Bible Association |
+| stem_swahili_speech | stem-content-ai-project/swahili-speech | MIT |
+| openslr25_sw | OpenSLR SLR25 (ALFFA) | MIT |
+| common_voice_sw | mozilla-foundation/common_voice_17_0 | **UNRESOLVED — see below** |
+
+### Deliberately excluded at corpus-build time
+
+`scripts/prepare_voxcpm_swahili_corpus.py` already refuses these for unclear
+licensing — keep them excluded:
+
+- `Kofi24/luganda-kiswahili-tts` — licence unclear on HF tags
+- `NjeriKahoro/Swahili-Clips-Audio-3` — licence unclear on HF tags
+
+## Open items (must close before publishing)
+
+1. **Common Voice.** Mozilla moved Common Voice to the Mozilla Data Collective
+   (effective Oct 2025); the HF dataset page no longer displays a licence.
+   Historically CC0-1.0, but do not assert that without checking current terms.
+   **Resolve by either:** (a) confirming from `corpus_summary.csv` that
+   `common_voice_sw` contributed no clips (or dropping them and re-checking the
+   model is unaffected — it is already trained, so this means documenting the
+   contribution honestly), or (b) verifying current Mozilla Data Collective terms
+   permit model training and redistribution.
+2. **VoxCPM2 base licence** — only if VoxCPM is also published.
+3. **Per-source clip/hour counts** — pull `corpus_summary.csv` from the cluster
+   so attribution can state actual contribution per source.
+
+## Recommended release terms
+
+- **Weights:** CC-BY-4.0. It satisfies the CC-BY inheritance from the training
+  data, is compatible with the Apache-2.0 base model, and permits commercial use.
+  (Apache-2.0 alone would not carry the CC-BY attribution requirement forward.)
+- **Attribution:** ship this file, or its table, in the model repo. CC-BY-4.0
+  requires attribution of every contributing dataset.
+- **Responsible use:** carry over Dia's disclaimer — no impersonation without
+  consent, no deceptive audio. Standard and expected for a public TTS release.
+
+## Disclaimer
+
+This is an engineering audit of published licence tags, not legal advice. Have
+someone with authority sign off before publishing.