Redis 7.4+ is RSALv2/SSPL and 8.0+ adds AGPLv3, none of which a
closed-source commercial product can ship. Valkey is BSD-3-Clause and
speaks the same RESP protocol, so the `redis` crate works unchanged -
`CONTINUUM_REDIS_URL` becomes `CONTINUUM_VALKEY_URL`, `Config.redis_url`
becomes `valkey_url`, and `Reporter`'s connection field follows.
The `redis://` scheme and the `redis` crate itself deliberately stay:
both name the RESP wire protocol rather than the server we deploy, and
redis-rs has no `valkey://` scheme to use instead. Commented in place so
the inconsistency reads as intentional.
Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. This crate carried
`license = "UNLICENSED"`, which is not valid SPDX and made `cargo deny`
fail outright; `LicenseRef-Proprietary` with `publish = false` is what
marks it first-party instead.
The note in deny.toml matters more than the allow list here: the ONNX
model weights this worker will load are licensed independently of the
`ort` crate, and `cargo deny` cannot see them at all. Ultralytics YOLO
and Obico's print-failure model are both AGPL-3.0 and cannot ship in a
commercial product - see continuum-common's docs/LICENSES.md, and pick a
permissive architecture before collecting training data rather than
retraining because of a licence.
Removed ort/ndarray/image (ONNX Runtime inference) and sqlx (Postgres audit
write). inference::detect() and the Postgres half of reporter::report() are
now stubs with a comment for what real code goes there. Redis Streams
XREADGROUP loop and the Redis pub/sub alert stay real.
Verified with a clean cargo check --all-targets (0 warnings).
octoturge