restructure licenses.yaml: self + runtime deps + dev deps

Three sections instead of one flat list. `self:` carries clide's own
MIT license (rendered first in the About screen so the user knows
what they're running before the dependency list). `dependencies:`
covers artefacts that actually ship in the binary — JetBrainsMono,
JosefinSans, yaml. `dev_dependencies:` tracks build-time tooling
(mocktail, alchemist, flutter_lints, lints, test) for audit
completeness without polluting the user-facing About panel.

Also backfilled the two root-package dev deps that were missed the
first pass: `lints: 5.0.0` and `test: 1.25.8` (root pubspec, not
app/). Root LICENSE mirrored into app/assets/LICENSE + declared as
a bundled asset so the About screen can read it at runtime (Flutter
can't reference paths above the package root).

D-042 updated to describe the three-section split and the dev-vs-
runtime distinction.

Co-Authored-By: Claude <noreply@anthropic.com>

app/assets/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jeroen Schweitzer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

app/assets/licenses.yaml

@@ -1,20 +1,48 @@
-# clide — bundled-dependency manifest.
+# clide — licensing manifest.
 #
-# Every third-party artefact that ships in the clide binary is listed
-# here: fonts, Dart packages, native supporter tools, bundled data.
-# The About screen reads this file and renders the entries verbatim.
+# Three sections:
+#   - `self:` — clide's own license (MIT). Rendered first in the About
+#     screen so the user knows what they're running before they see
+#     the list of things it depends on.
+#   - `dependencies:` — third-party artefacts that SHIP in the clide
+#     binary: fonts, runtime Dart packages, native supporter tools,
+#     bundled data. The About screen renders these verbatim.
+#   - `dev_dependencies:` — build-time-only tooling: test runners,
+#     mocks, lints, golden-test harness. These never enter the shipped
+#     binary, so the About screen does not render them, but they're
+#     tracked here for audit completeness alongside the real list.
 #
-# Adding a new bundled dependency is a two-step commit:
+# Adding a new runtime dependency is a two-step commit:
 #   1. Add the dependency itself (font file, `pubspec.yaml` entry, etc.)
-#   2. Add the entry below in the same commit, so the About screen stays
-#      accurate and the prefer-zero-deps guardrail is enforced by the
-#      obvious visible consequence: an extra row in the list.
+#   2. Add the entry under `dependencies:` below in the same commit, so
+#      the About screen stays accurate and the prefer-zero-deps
+#      guardrail is enforced by the obvious visible consequence: an
+#      extra row in the list.
+#
+# Adding a new dev-only dependency is the same two-step commit, just
+# under `dev_dependencies:` instead. The guardrail still applies —
+# dev deps are supply-chain risk too — but they don't pollute the
+# user-facing About screen.
 #
 # See CLAUDE.md "Dependencies & supply chain" for the full rule, and
 # `decisions/tooling.md` for the D-record that pins it.
 
 schema_version: 1
 
+# clide itself. Listed first so the About screen can render "You're
+# looking at clide vX, MIT-licensed" at the top of the panel before
+# the bundled-dependency list underneath. The root LICENSE is the
+# authoritative copy; `app/assets/LICENSE` is a mirror bundled so the
+# About screen can read it at runtime.
+self:
+  name: clide
+  version: "2.0.0-dev"
+  homepage: https://git.schweitz.net/jpmschweitzer/clide
+  license: MIT
+  license_file: assets/LICENSE
+  copyright: "© 2026 Jeroen Schweitzer"
+
+# Runtime dependencies — ship in the clide binary.
 dependencies:
   - name: JetBrains Mono
     kind: font
@@ -47,15 +75,17 @@ dependencies:
       YAML parser for theme files and extension manifests. The one
       justified exception to prefer-zero-deps; Dart-team maintained.
 
+# Build-time-only dependencies — test runners, mocks, lints. Tracked
+# here for audit completeness; NOT rendered in the About screen.
+dev_dependencies:
   - name: mocktail
     kind: dart-package
     version: "1.0.4"
     homepage: https://pub.dev/packages/mocktail
     license: MIT
     purpose: >-
-      Test-only. Mocks at IO / IPC boundaries. ChangeNotifier facades
-      use hand-rolled fakes instead of mocks (D-025).
-    scope: dev
+      Mocks at IO / IPC boundaries. ChangeNotifier facades use
+      hand-rolled fakes instead of mocks (D-025).
 
   - name: alchemist
     kind: dart-package
@@ -63,14 +93,31 @@ dependencies:
     homepage: https://pub.dev/packages/alchemist
     license: MIT
     purpose: >-
-      Test-only. Golden-test framework; Ahem-font rendering for
-      cross-platform pixel stability on widget primitives (D-024).
-    scope: dev
+      Golden-test framework; Ahem-font rendering for cross-platform
+      pixel stability on widget primitives (D-024).
 
   - name: flutter_lints
     kind: dart-package
     version: "6.0.0"
     homepage: https://pub.dev/packages/flutter_lints
     license: BSD-3-Clause
-    purpose: Test-only. Flutter-team-recommended analyzer lint set.
-    scope: dev
+    purpose: Flutter-team-recommended analyzer lint set (app/).
+
+  - name: lints
+    kind: dart-package
+    version: "5.0.0"
+    homepage: https://pub.dev/packages/lints
+    license: BSD-3-Clause
+    purpose: >-
+      Dart-team-recommended analyzer lint set for the Flutter-free
+      core package at the repo root.
+
+  - name: test
+    kind: dart-package
+    version: "1.25.8"
+    homepage: https://pub.dev/packages/test
+    license: BSD-3-Clause
+    purpose: >-
+      Dart test runner for the core package (Flutter-free; the app
+      uses flutter_test from the Flutter SDK for widget + golden
+      coverage).

app/pubspec.yaml

@@ -53,11 +53,15 @@ flutter:
   assets:
     - lib/kernel/src/theme/themes/
     - lib/kernel/src/i18n/catalog/
-    # Bundled-dependency manifest — read by the About screen.
+    # Licensing — read by the About screen. `licenses.yaml` is the
+    # manifest (self + runtime deps + dev deps); each `license_file`
+    # pointer must also be a bundled asset so the About screen can
+    # display each dependency's full license text at runtime.
+    # Root LICENSE is mirrored into assets/LICENSE for the same reason
+    # (root paths can't be referenced from a Flutter package's assets).
     # See CLAUDE.md "Dependencies & supply chain" and D-042.
     - assets/licenses.yaml
-    # License files referenced by licenses.yaml must be bundled too so
-    # the About screen can display each dependency's full license text.
+    - assets/LICENSE
     - assets/fonts/jetbrains_mono/OFL.txt
     - assets/fonts/josefin_sans/OFL.txt
 

decisions/tooling.md

@@ -18,10 +18,10 @@ Toolchain, supply chain, CI, ignore strategy.
 - **Cost:** PRs don't run CI yet; `make push-check` is the gate until activation.
 - **Raised by:** 2026-04-21 planning.
 
-### D-042: Bundled dependencies documented in `licenses.yaml`
+### D-042: Dependencies documented in `licenses.yaml`
 - **Date:** 2026-04-22
-- **Decision:** Every third-party artefact bundled into the clide binary — Dart packages, fonts, native supporter tools, bundled data — has an entry in `app/assets/licenses.yaml` with name, kind, version, homepage, license identifier, relative path to the bundled license text, and a one-line purpose. The file is shipped as a Flutter asset and rendered by the About screen (Tier 6). Adding a bundled dependency is a two-step commit: add the artefact **and** the corresponding `licenses.yaml` entry in the same changeset.
-- **Rationale:** Complements [D-031](#d-031-prefer-zero-deps-exact-pin). Prefer-zero-deps is a *budget*; `licenses.yaml` is the *visible consequence*. An extra row in the About screen is a review-time signal that the budget just grew. It also discharges the redistribution obligations bundled licenses impose (OFL, MIT, BSD all require preserving the license text alongside the binary) without ad-hoc NOTICE files.
+- **Decision:** `app/assets/licenses.yaml` has three sections: `self:` (clide's MIT license, rendered first in the About screen so the user knows what they're running), `dependencies:` (third-party artefacts that **ship in the binary** — fonts, runtime Dart packages, native supporter tools, bundled data), and `dev_dependencies:` (build-time-only tooling — test runners, mocks, lints, golden harness — tracked for audit but **not rendered** in the About screen because they don't reach the user). Each entry has name, kind, version, homepage, license identifier, and a one-line purpose; runtime entries also carry a `license_file:` pointer to the bundled license text so the About screen can display it verbatim. Adding any dependency is a two-step commit: add the artefact **and** the corresponding `licenses.yaml` entry in the same changeset, under the correct section.
+- **Rationale:** Complements [D-031](#d-031-prefer-zero-deps-exact-pin). Prefer-zero-deps is a *budget*; `licenses.yaml` is the *visible consequence*. An extra row in the About screen is a review-time signal that the shipped-binary surface grew. Splitting dev deps out keeps the user-facing list small and honest — a test framework is not something the user needs to see in About — while still documenting every supply-chain input for audit completeness. The runtime entries discharge the redistribution obligations bundled licenses impose (OFL, MIT, BSD all require preserving the license text alongside the binary) without ad-hoc NOTICE files.
 - **Cost:** One extra edit per dep. Zero tolerance for drift — an un-listed dep is a contributor-visible bug. Until the About screen lands at Tier 6, `licenses.yaml` is accurate but not rendered; the discipline applies from now regardless so Tier 6 inherits a clean list.
 - **Raised by:** 2026-04-22 planning (user-directed best practice).