hanzoai · zeekay · Aug 3, 2026 · Aug 4, 2026
diff --git a/LLM.md b/LLM.md
@@ -28,3 +28,53 @@ with quantization (GGUF/GGML/AFQ/GPTQ/AWQ). The compute core beneath Hanzo infer
 - **Zen** models are our own family — don't present upstream model names as ours.
 
 Spec: `~/work/hanzo/SDK-ARCHITECTURE.md` — the canonical one-way SDK model.
+
+## Licensing — read before touching a manifest
+
+Fork of **candle** (huggingface/candle), **MIT OR Apache-2.0**. `NOTICE` is the
+full record. The layout is flat (`hanzo-ml/`, `hanzo-nn/`, …) because candle's
+is flat — there is no `crates/` directory and its absence is not a bug.
+
+- **Never edit `LICENSE-MIT` or `LICENSE-APACHE`.** They are upstream's texts and
+  they are what actually grant rights.
+- **Every crate declares `MIT OR Apache-2.0`.** One exception, deliberate:
+  `hanzo-bindgen-cuda` declares `MIT`, because it is a fork of `bindgen_cuda`
+  by Nicolas Patry (github.com/Narsil/bindgen_cuda) which is MIT upstream, and
+  its manifest retains his authorship. Do not "normalise" it — that would
+  relicense a third party's work.
+
+### The bug that shipped 191 times
+
+From 2026-01-16 to 2026-08-03 the manifests declared a licence candle never
+granted. `216fae85` flipped 24 manifests to `BSD-3-Clause OR Apache-2.0` and
+added `LICENSE-BSD`; `16fabaed` later deleted `LICENSE-BSD` as "stray" without
+touching a single manifest. For seven months the repo *offered* BSD-3-Clause
+while shipping no BSD text, and `hanzo-kernel` and `hanzo-3d` offered
+`BSD-3-Clause` with no Apache fallback at all.
+
+All 27 manifests were corrected to `MIT OR Apache-2.0` on 2026-08-03. The **191
+already-published versions across 12 crates** are **not** being yanked:
+crates.io metadata is immutable per version, the LICENSE files inside each
+package are what govern, and yanking would break every consumer to fix a label.
+(25 of those — all of `hanzo-kernel`, `hanzo-kernel-macros`, `hanzo-3d` — went
+out as `BSD-3-Clause` with no Apache fallback at all.)
+
+Verify the count yourself rather than trusting a number in a doc; crates.io
+rejects anonymous requests, so send a User-Agent:
+
+    curl -s -A "you@hanzo.ai" https://crates.io/api/v1/crates/hanzo-ml \
+      | jq '[.versions[].license] | group_by(.) | map({(.[0]): length}) | add'
+
+The lesson worth keeping: `license =` in a manifest is a *claim*, and the
+LICENSE files are the *fact*. When they disagree, the files win — and a
+find-and-replace across manifests is a licensing change, not a chore.
+
+### Open item — the root `LICENSE` is ours, not candle's
+
+candle ships no `/LICENSE` (only `LICENSE-MIT` + `LICENSE-APACHE`). Ours was
+added by `225e590f` and is a **modified** Apache-2.0: the APPENDIX is replaced
+with a `Copyright 2024 Hanzo AI Inc` line and several sentences are reworded.
+Because it is the only file named `LICENSE`, GitHub reads it and reports this
+repo as Apache-2.0 rather than dual-licensed. Left untouched pending a
+decision — altering a file named LICENSE is a licensing call, not a metadata
+fix. Flagged, not resolved.
diff --git a/NOTICE b/NOTICE
@@ -95,3 +95,78 @@ Changes from upstream candle in this fork:
   Hanzo/zen model hubs.
 - Dependency and layout changes: cudarc pinned at 0.19.4; an orphaned duplicate
   crate cluster is excluded from the workspace build.
+
+LICENSE METADATA CORRECTION (2026-08-03)
+
+Between 2026-01-16 and 2026-08-03 the crate manifests in this repository
+declared a license that upstream candle never granted, and that this repository
+did not ship the text of. This section records that, because published crate
+metadata is immutable and old versions still carry it.
+
+What happened:
+
+- Commit 216fae85 (2026-01-16) changed 24 manifests from "MIT OR Apache-2.0" to
+  "BSD-3-Clause OR Apache-2.0" and added a LICENSE-BSD file. candle is licensed
+  "MIT OR Apache-2.0" and offers no BSD-3-Clause option, so BSD-3-Clause was
+  never ours to offer over candle-derived code.
+- Commit 16fabaed (2026-07-02) deleted LICENSE-BSD as "stray" but did not touch
+  a single manifest. From that date the repository offered BSD-3-Clause in 27
+  manifests while shipping no BSD license text at all.
+- Meanwhile LICENSE-MIT, LICENSE-APACHE and this NOTICE all correctly said
+  "MIT OR Apache-2.0". The license files and the manifests disagreed for
+  nearly seven months, and the license files are the ones that govern.
+
+What was corrected on 2026-08-03: every affected manifest now declares
+"MIT OR Apache-2.0", matching LICENSE-MIT and LICENSE-APACHE. That is 27
+manifests -- 24 that said "BSD-3-Clause OR Apache-2.0", plus hanzo-kernel,
+hanzo-kernel-macros and hanzo-3d, which said "BSD-3-Clause" alone. Those three
+are first-party Hanzo work rather than candle-derived, so the choice of license
+was ours to make; they are aligned here so that every crate offers what the
+repository actually ships.
+
+A 28th manifest, hanzo-ml-wasm-tests, declared no license at all. It is a
+workspace member without `publish = false`, so it was one `cargo publish` away
+from going out unlicensed; it has never been published (crates.io has no such
+crate). It now declares "MIT OR Apache-2.0" like the rest. Every manifest in
+the repository now carries a license field, and hanzo-bindgen-cuda's "MIT" is
+the only value that differs -- deliberately, for the reason below.
+
+hanzo-bindgen-cuda is deliberately left at "MIT". It is a fork of bindgen_cuda
+by Nicolas Patry (https://github.com/Narsil/bindgen_cuda), which is MIT
+upstream, and its manifest already retains his authorship. Changing it would
+have relicensed a third party's work.
+
+Published versions are NOT being yanked. 191 published versions across 12
+crates on crates.io carry the incorrect SPDX, measured against the crates.io
+API on 2026-08-03:
+
+    hanzo-ml 87, hanzo-kernel 22, hanzo-kernels 19, hanzo-metal-kernels 17,
+    hanzo-nn 15, hanzo-flash-attn 10, hanzo-ug 9, hanzo-transformers 4,
+    hanzo-datasets 3, hanzo-onnx 2, hanzo-kernel-macros 2, hanzo-3d 1
+
+Of those, 25 versions -- all of hanzo-kernel, hanzo-kernel-macros and hanzo-3d
+-- were published as "BSD-3-Clause" alone, with no Apache-2.0 fallback. The
+remaining 166 were published as "BSD-3-Clause OR Apache-2.0", so an Apache-2.0
+grant was at least always available for them.
+
+Two crates are unaffected and were already correct: tensor-tools (11 versions,
+"MIT OR Apache-2.0", inherited from the workspace) and hanzo-bindgen-cuda
+(1 version, "MIT", matching its own upstream).
+
+crates.io metadata is immutable per
+version, so the label on those releases cannot be edited; yanking them would
+break every downstream consumer in order to correct a label. The LICENSE files
+distributed inside each of those crates are, and always were, LICENSE-MIT and
+LICENSE-APACHE, and those are what actually grant rights. Anyone auditing an
+older release should read the license files in the package rather than the
+crates.io metadata field.
+
+Open item, not resolved here: the root LICENSE file is not upstream's. candle
+ships no /LICENSE (only LICENSE-MIT and LICENSE-APACHE), and this file was
+added by commit 225e590f (2026-02-14). It is a modified Apache-2.0 text -- the
+APPENDIX is replaced with a single "Copyright 2024 Hanzo AI Inc" line and
+several sentences are reworded. Because it is the only file named LICENSE, it
+is the one GitHub reads, so this repository is reported as Apache-2.0 rather
+than dual-licensed. It has been left untouched pending a decision, since
+altering a file named LICENSE is a licensing determination rather than a
+metadata fix.
diff --git a/hanzo-3d/Cargo.toml b/hanzo-3d/Cargo.toml
@@ -2,7 +2,7 @@
 name = "hanzo-3d"
 version = "0.1.0"
 edition = "2021"
-license = "BSD-3-Clause"
+license = "MIT OR Apache-2.0"
 description = "3D representations, geometry, and mesh/point-cloud I/O for the Hanzo generative-3D stack (Pixal3D / TRELLIS / TripoSR)."
 repository = "https://github.com/hanzoai/ml"
 

diff --git a/hanzo-datasets/Cargo.toml b/hanzo-datasets/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [dependencies]

diff --git a/hanzo-flash-attn-build/Cargo.toml b/hanzo-flash-attn-build/Cargo.toml
@@ -13,7 +13,7 @@ description = "Build-time helper that fetches and resolves the pinned NVIDIA CUT
 repository = "https://github.com/hanzoai/ml"
 keywords = ["cuda", "cutlass", "flash-attention", "build"]
 categories = ["development-tools::build-utils"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [lib]
 name = "hanzo_flash_attn_build"

diff --git a/hanzo-flash-attn-v3/Cargo.toml b/hanzo-flash-attn-v3/Cargo.toml
@@ -7,7 +7,7 @@ description = "FlashAttention-3 (Hopper sm_90a) attention kernels for the Hanzo
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [features]

diff --git a/hanzo-flash-attn/Cargo.toml b/hanzo-flash-attn/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [dependencies]

diff --git a/hanzo-kernel-macros/Cargo.toml b/hanzo-kernel-macros/Cargo.toml
@@ -3,7 +3,7 @@ name = "hanzo-kernel-macros"
 version = "0.1.1"
 edition = "2021"
 description = "The #[kernel(targets(...))] attribute for hanzo-kernel: one Rust fn, declared backends, scoped intrinsic islands."
-license = "BSD-3-Clause"
+license = "MIT OR Apache-2.0"
 repository = "https://github.com/hanzoai/ml"
 
 [lib]

diff --git a/hanzo-kernel/Cargo.toml b/hanzo-kernel/Cargo.toml
@@ -3,7 +3,7 @@ name = "hanzo-kernel"
 version = "0.2.40"
 edition = "2021"
 description = "Hanzo's first-party GPU kernel DSL: one Rust source, lowered to CUDA/ROCm/Vulkan/Metal."
-license = "BSD-3-Clause"
+license = "MIT OR Apache-2.0"
 repository = "https://github.com/hanzoai/ml"
 documentation = "https://docs.rs/hanzo-kernel"
 readme = "README.md"

diff --git a/hanzo-kernels/Cargo.toml b/hanzo-kernels/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 

diff --git a/hanzo-metal-kernels/Cargo.toml b/hanzo-metal-kernels/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 
 [dependencies]

diff --git a/hanzo-ml-book/Cargo.toml b/hanzo-ml-book/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [dependencies]

diff --git a/hanzo-ml-examples/Cargo.toml b/hanzo-ml-examples/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [dependencies]

diff --git a/hanzo-ml-pyo3/Cargo.toml b/hanzo-ml-pyo3/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [lib]

diff --git a/hanzo-ml-wasm-examples/bert/Cargo.toml b/hanzo-ml-wasm-examples/bert/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-examples/blip/Cargo.toml b/hanzo-ml-wasm-examples/blip/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-examples/llama2-c/Cargo.toml b/hanzo-ml-wasm-examples/llama2-c/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-examples/moondream/Cargo.toml b/hanzo-ml-wasm-examples/moondream/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-examples/phi/Cargo.toml b/hanzo-ml-wasm-examples/phi/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-examples/segment-anything/Cargo.toml b/hanzo-ml-wasm-examples/segment-anything/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-examples/t5/Cargo.toml b/hanzo-ml-wasm-examples/t5/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-examples/whisper/Cargo.toml b/hanzo-ml-wasm-examples/whisper/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-examples/yolo/Cargo.toml b/hanzo-ml-wasm-examples/yolo/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { workspace = true }

diff --git a/hanzo-ml-wasm-tests/Cargo.toml b/hanzo-ml-wasm-tests/Cargo.toml
@@ -3,6 +3,7 @@ name = "hanzo-ml-wasm-tests"
 version = "0.11.8"
 edition = "2021"
 description = "WASM tests for hanzo"
+license = "MIT OR Apache-2.0"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
 

diff --git a/hanzo-ml/Cargo.toml b/hanzo-ml/Cargo.toml
@@ -6,7 +6,7 @@ description = "Fast multi-backend tensor & ML framework for Rust (CPU/CUDA/Metal
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [dependencies]

diff --git a/hanzo-nn/Cargo.toml b/hanzo-nn/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [dependencies]

diff --git a/hanzo-onnx/Cargo.toml b/hanzo-onnx/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 hanzo-ml = { path = "../hanzo-ml", package = "hanzo-ml", version = "0.11.8" }

diff --git a/hanzo-training/Cargo.toml b/hanzo-training/Cargo.toml
@@ -6,7 +6,7 @@ description = "Training framework for Hanzo ML models on zen-agentic-dataset"
 repository = "https://github.com/hanzoai/ml"
 keywords = ["machine-learning", "training", "transformer", "llm"]
 categories = ["science", "algorithms"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [dependencies]

diff --git a/hanzo-transformers/Cargo.toml b/hanzo-transformers/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 readme = "README.md"
 
 [dependencies]

diff --git a/hanzo-ug/Cargo.toml b/hanzo-ug/Cargo.toml
@@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz
 repository = "https://github.com/hanzoai/ml"
 keywords = ["blas", "tensor", "machine-learning"]
 categories = ["science"]
-license = "BSD-3-Clause OR Apache-2.0"
+license = "MIT OR Apache-2.0"
 
 [dependencies]
 ug = "0.5.0"