Carry each Source's attribution obligation through to every surface that displays it

[jacobdrees]

Parent

CAN-17 v1: the walking skeleton in production, then the founding case

What to build

One mechanism that carries each Source's attribution obligation to every surface that displays its
values — replacing four hardcoded TMDB attribution criteria with something that can express a logo,
a notice and share-alike.

ADR-0014
Decision 9 — per-field provenance on every displayed value names attribution as the first of three
obligations one mechanism discharges. This ticket is the attribution half;
CAN-110 Carry per-field provenance to every displayed value
is the mechanism underneath it.

The four criteria this replaces

TMDB's attribution is currently written into four separate tickets as a hardcoded product
requirement:

• CAN-26 Import a series from TMDB, with the overlay behind it
• CAN-57 Make a public Ordering discoverable and shareable
• CAN-30 GDPR export and erasure
• CAN-17 v1: the walking skeleton in production, then the founding case, user story 16

Each of them names TMDB. Under Decision 1 — the app is a shell the application must not, and
under Decision 3 there are keyless Sources coming whose obligations range from CC BY-SA to none at all, rather than
TMDB's. Four hardcoded copies of one Source's rule cannot express any of them.

What the obligation has to be able to say

• A logo, not only text. TMDB §3 prescribes the logo, and §1.B lists attribution among the
  Additional License Conditions, so failing it is a licence breach with §1.D as the remedy.
• A per-source notice, including "none". Of the roster: TVmaze and the Grand Comics Database are CC BY-SA 4.0, tardis.wiki is CC BY-SA 3.0 (licence-only since 16 August — the versions differ materially: only 4.0's §4(b) deems a database Adapted Material), ISFDB is CC BY 4.0, and Open Library and MusicBrainz core are CC0 — no attribution duty at all (Open Library's grant is additionally unverifiable on any live page, recorded in the research doc). So the declared obligation must express none, must name the licence and its version, and attribution renders per source rather than in aggregate.
• Share-alike, which no single credit block can express, and which research §11 shows cannot be
  reconciled with proprietary terms in one undifferentiated aggregate.

There is no About or Credits page

TMDB's FAQ requires the attribution to be in one, and the product does not have one. That is a
page this ticket has to create, not a slot it can fill. Note also ADR-0014's cautionary example:
Radarr, on the same shipped-key model, carries no TMDB notice in any of its 2,051 localisation
strings and no logo asset.

Prior art worth taking, from ADR-0014: Sonarr's Metadata Source settings page is inert and holds
TheTVDB's required attribution in the slot where an API key field would sit. Put attribution where
the interface forces the question rather than in a footer nobody owns.

Acceptance criteria

• Attribution is read from the Source's declared obligation, never from a constant naming TMDB.
• The obligation can express a logo asset, a prescribed notice text, and a share-alike condition.
• Every surface displaying a Source's values carries that Source's attribution: the public Ordering page, the Story page, the owner's pages and the GDPR export file.
• An About or Credits page exists, since TMDB's FAQ requires attribution to appear in one and there is none today.
• The four hardcoded criteria in the tickets named above are replaced by a reference to this mechanism, so the requirement is stated once.
• A composed read drawing fields from two Sources attributes both, per source, rather than crediting whichever one won the first field.
• A test asserts that displaying a value whose Source declares an attribution obligation, without rendering that attribution, fails.

Blocked by

• CAN-7 Provider contract: define and publish it — the obligation arrives through the contract or it is hardcoded again.

Amended 16 August 2026

The licence roster above was corrected by the verification sweep — the previous text called all five keyless Sources CC BY-SA, which was wrong for three of them — and TMDB's prescribed texts are two, not one: §3's notice and the FAQ's differ, and the FAQ requires an About or Credits section plus the permitted names ("TMDB" or "The Movie Database"). The declaration should carry the notice text verbatim per Source rather than assume one canonical string. Under CAN-116 Make the tracker agree with the 16 August verification sweep.