[WEB-54]: add epac asset attributions

[riddim-developer-bot]

Why

WEB-54 is still active, but epac had drifted from the original ticket assumptions: main already contains a root LICENSE, yet the copyright holder was still the generic Riddim Software string and the repo bundled several non-MIT third-party assets without an explicit attribution note. This PR finishes the ticket's remaining compliance work by aligning the MIT holder name with the requested legal entity and documenting the separate terms that still apply to bundled assets.

What changed

• updated the MIT LICENSE copyright line to Riddim Software Inc.
• added ATTRIBUTIONS.md for bundled third-party assets that are not covered by the repo MIT grant
• called out the Apple App Store badge, Cooper Hewitt font files, and House of Commons open-data test fixtures
• added a standard Open Government Licence – Canada attribution note for project-authored files that derive from official government data

Trade-offs not taken

• did not remove or replace any bundled assets; WEB-54 scopes this ticket to audit + attribution, not asset replacement
• did not broaden the audit into a repo-wide legal memo; kept the file focused on concrete shipped assets and their governing terms

Test plan

• Confirm LICENSE remains standard MIT text with only the copyright holder line changed
• Review ATTRIBUTIONS.md and verify each listed path exists in the repo
• Confirm no build or runtime files were modified beyond documentation/legal metadata

Resolves WEB-54

[riddim-reviewer-bot]

⚠️ Autonomous review liveness watchdog

Symphony expected a reviewer-bot review for the current autonomous PR head within the configured SLA window, but none was found.

• PR: [WEB-54]: add epac asset attributions #388
• Repo: RiddimSoftware/epac
• Head SHA: 36203ab1b2b6f37f2af94b52ccff846da8f3f15a
• Suspected missing reviewer owner: RiddimSoftware/epac
• Review SLA window: 300000 ms
• PR last activity: 2026-05-08T01:55:15Z
• Last heartbeat: missing

[riddim-reviewer-bot]

ReviewAutonomousPR

• Verdict: approve
• Reviewer boundary: review_only
• Acceptance criteria coverage: covered=4, missing=0, unclear=1

Summary

Clean, focused PR that completes WEB-54's remaining compliance work. LICENSE copyright holder correctly updated to 'Riddim Software Inc.' and ATTRIBUTIONS.md properly documents the three non-MIT third-party assets (Cooper Hewitt OFL fonts, Apple App Store badge, House of Commons open-data fixtures). All referenced paths verified to exist in the repo. No code or build files modified.

Actionable findings

1. nit — OGL Canada reference URL points to Dept of Finance T&C, not the canonical OGL page (ATTRIBUTIONS.md:36)
   • The 'Government of Canada open-data attribution' section links to https://www.canada.ca/en/department-finance/corporate/terms-conditions.html which is the Department of Finance terms-and-conditions page. The canonical Open Government Licence – Canada URL is https://open.canada.ca/en/open-government-licence-canada. The current link will confuse anyone trying to verify the licence terms.
2. nit — House of Commons fixtures section does not name the specific Open Parliament Licence (ATTRIBUTIONS.md:24)
   • The House of Commons data is governed by the 'Open Parliament Licence' (https://www.ourcommons.ca/en/open-data/licence), which is distinct from the Open Government Licence – Canada referenced in the section below. ATTRIBUTIONS.md currently says to treat the fixtures as 'House of Commons source data' without naming the licence. A direct link to https://www.ourcommons.ca/en/open-data/licence and naming 'Open Parliament Licence' would make the attribution unambiguous and aid future auditors.

Acceptance criteria coverage

• covered — LICENSE file at repo root contains the standard MIT text with copyright holder 'Riddim Software Inc.'
  • Verified at HEAD SHA 36203ab: LICENSE is standard MIT text; copyright line reads 'Copyright (c) 2026 Riddim Software Inc.' — single-character change from the prior 'Riddim Software' string.
• covered — GitHub recognizes the license (visible in repo home page sidebar as 'MIT License')
  • The license body is the verbatim OSI MIT text; GitHub's license detector matches on body content, not the copyright line. The change does not affect detectability.
• covered — Asset audit performed: walk the repo and flag any third-party asset that is NOT MIT-compatible
  • ATTRIBUTIONS.md identifies Cooper Hewitt fonts (SIL OFL), Apple App Store badge (Apple marketing licence), and House of Commons open-data fixtures (Open Parliament Licence / OGL-Canada). All three paths were confirmed to exist in the repo: ios/epac/Fonts/.otf (14 files), website/app-store.svg, ios/epacTests/fixtures/.XML and Members*.csv.
• covered — If incompatible assets exist: add ATTRIBUTIONS.md listing them with their licenses
  • ATTRIBUTIONS.md added at repo root. Each entry includes path glob, source, licence terms summary, and a reference URL. The file also adds a general OGL-Canada attribution note for project-authored content derived from Government of Canada sources.
• unclear — If no blocker assets: planning comment on the Linear ticket recording the audit summary
  • The PR description states the asset audit found no blockers (all assets are either SIL OFL, Apple marketing licence, or open-government data — none prevent MIT release). However, the acceptance criteria requires a planning comment on the Linear ticket (WEB-54) recording the audit summary. The PR description covers this narratively but it is not possible to confirm the Linear comment was posted from the diff alone.