1.0: drop every runtime dependency, enforce the licensing claims, add MulanPSL-2.0

.github/CODEOWNERS

@@ -1,4 +1,4 @@
 # SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-# SPDX-License-Identifier: MIT OR Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 
 * @paudley @ErinAudley

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-# SPDX-License-Identifier: MIT OR Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 
 name: Bug report
 description: Report a reproducible defect in emojihash, randomart, docs, or release tooling.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-# SPDX-License-Identifier: MIT OR Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 
 blank_issues_enabled: false
 contact_links:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-# SPDX-License-Identifier: MIT OR Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 
 name: Feature request
 description: Propose an enhancement to visual-hashing.

.github/copilot-instructions.md

@@ -1,5 +1,5 @@
 <!-- SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca> -->
-<!-- SPDX-License-Identifier: MIT OR Apache-2.0 -->
+<!-- SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0 -->
 # GitHub Copilot Instructions
 
 This repository contains the `visual-hashing` Rust crate.

.github/dependabot.yml

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-# SPDX-License-Identifier: MIT OR Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 version: 2
 updates:
   - package-ecosystem: cargo

.github/pull_request_template.md

@@ -1,6 +1,6 @@
 <!--
 SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-SPDX-License-Identifier: MIT OR Apache-2.0
+SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 -->
 ## Summary
 

.github/workflows/ci.yml

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-# SPDX-License-Identifier: MIT OR Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 name: CI
 
 on:
@@ -30,7 +30,7 @@ jobs:
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           components: clippy, rustfmt
-          targets: wasm32-unknown-unknown
+          targets: wasm32-unknown-unknown, thumbv7em-none-eabihf
 
       - name: Cache Cargo dependencies
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
@@ -56,6 +56,39 @@ jobs:
         if: runner.os == 'Linux'
         run: cargo build --lib --target wasm32-unknown-unknown
 
+      # Proves the `no_std` claim on a target that has no `std` to fall back on.
+      - name: Bare-metal library build
+        if: runner.os == 'Linux'
+        run: cargo build --lib --target thumbv7em-none-eabihf
+
       - name: Package dry-run
         if: runner.os == 'Linux'
         run: cargo publish --locked --dry-run
+
+  licensing:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      - name: Cache Cargo dependencies
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+
+      # SPDX headers, licence-text digests, and the no-runtime-dependencies
+      # claim. Kept as a first-party script rather than a third-party action:
+      # every action here is SHA-pinned, and adding one to run a grep would
+      # widen the supply chain for no gain.
+      - name: License and dependency claims
+        run: python3 scripts/check-licenses.py
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@76c2e6406e52637deed7160d77bded76bd83e06e # v2.87.14
+        with:
+          tool: cargo-deny
+
+      - name: Dependency licences, advisories and sources
+        run: cargo deny check

.github/workflows/release.yml

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-# SPDX-License-Identifier: MIT OR Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 name: Release
 
 # Requires a crates.io Trusted Publisher for:

.gitignore

@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-# SPDX-License-Identifier: MIT OR Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 
 /target/
 /.venv/

CHANGELOG.md

@@ -1,13 +1,66 @@
 <!--
 SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-SPDX-License-Identifier: MIT OR Apache-2.0
+SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 -->
 # Changelog
 
 All notable changes to `visual-hashing` are recorded here.
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-09-17
+
+### Added
+
+- **A third licence option: `MulanPSL-2.0`.** The crate is now offered under
+  `MIT OR Apache-2.0 OR MulanPSL-2.0` — pick any one. Note that MulanPSL-2.0 is
+  bilingual and its §6 makes the Chinese text controlling where the versions
+  diverge; `LICENSING.md` covers what else differs between the three. The
+  pinned bilingual text ships as `LICENSE-MULAN`, digest-verified in CI.
+- `no_std` support. The library needs only `alloc` and builds for bare-metal
+  targets (CI proves it on `thumbv7em-none-eabihf`) as well as `wasm32`.
+- `scripts/check-licenses.py` and `deny.toml`, which turn this project's
+  licensing and dependency claims into CI gates rather than assertions.
+
+### Removed
+
+- **Every runtime dependency.** `blake3` was the last one, and with it went a
+  build script, a C-compiler requirement and nine transitive crates. The crate
+  now carries the part of BLAKE3 it needs in `src/blake3.rs` — unkeyed,
+  one-shot, extendable output, `#![forbid(unsafe_code)]`.
+
+  Output is unchanged: the frozen conformance vectors pass byte-for-byte, and
+  `tests/blake3_equivalence.rs` diffs the implementation against the upstream
+  `blake3` crate (now a dev-only oracle) across every block, chunk and subtree
+  boundary on each CI run.
+
+  Being portable rather than SIMD, it favours auditability over throughput. If
+  you hash large inputs in bulk, hash them with `blake3` directly and pass the
+  digest in.
+
+- The `serde_json` dev-dependency, replaced by a strict reader for the
+  generated vector format.
+
+### Stability
+
+`1.0` makes the wire contract binding. The 64-emoji alphabet, the randomart
+character ramp and the public API will not change: a fingerprint already
+printed in a log, a CLI banner or a user's notes has to keep meaning what it
+meant, so a change to either rendering would be a new crate rather than a new
+major version.
+
+### Note for existing users
+
+`0.1.3 → 1.0.0` is a semver-incompatible jump, so a `visual-hashing = "0.1.3"`
+requirement will **not** pick this up — for a `0.x` crate the minor slot is the
+breaking one, giving `>=0.1.3, <0.2.0`. Update the requirement to
+`visual-hashing = "1"` deliberately.
+
+Nothing about the output changed: the public API is identical and every
+rendering is byte-for-byte the same, as the frozen vectors demonstrate. What
+changed is the shape of the crate around it — no runtime dependencies, no build
+script, `no_std`, and a third licence option.
+
 ## [0.1.3] - 2026-06-22
 
 ### Changed

CITATION.cff

@@ -11,11 +11,12 @@ authors:
   - family-names: "Audley"
     given-names: "Patrick"
     orcid: "https://orcid.org/0000-0003-4382-7625"
-version: "0.1.3"
-date-released: "2026-06-22"
+version: "1.0.0"
+date-released: "2026-09-17"
 license:
   - Apache-2.0
   - MIT
+  - MulanPSL-2.0
 repository-code: "https://github.com/Blackcat-Informatics/visual-hashing"
 keywords:
   - blake3

CODE_OF_CONDUCT.md

@@ -1,6 +1,6 @@
 <!--
 SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-SPDX-License-Identifier: MIT OR Apache-2.0
+SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 -->
 # Contributor Code of Conduct
 

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 <!--
 SPDX-FileCopyrightText: 2026 Blackcat Informatics® Inc. <paudley@blackcatinformatics.ca>
-SPDX-License-Identifier: MIT OR Apache-2.0
+SPDX-License-Identifier: MIT OR Apache-2.0 OR MulanPSL-2.0
 -->
 # Contributing to visual-hashing
 
@@ -19,11 +19,24 @@ cargo clippy --all-targets -- -D warnings
 cargo test --locked
 RUSTDOCFLAGS="-D warnings" cargo doc --no-deps
 cargo build --lib --target wasm32-unknown-unknown
+cargo build --lib --target thumbv7em-none-eabihf
+cargo deny check
+python3 scripts/check-licenses.py
 cargo package --locked --list
 cargo publish --locked --dry-run
 ```
 
+The library must keep **zero runtime dependencies** — that claim is in the
+README and is the reason the dependency licence surface stays small, so
+`scripts/check-licenses.py` fails the build if one appears. `src/blake3.rs`
+exists for the same reason; if you change it, `tests/blake3_equivalence.rs`
+must still agree with the upstream `blake3` crate, and the frozen vectors must
+still pass byte-for-byte.
+
 The vector scripts live under `python/scripts/`. Regenerate vectors only when
 the public rendering contract intentionally changes, then review the JSON diff.
 
-Contributions are accepted under **Apache-2.0 OR MIT**.
+Contributions are accepted under **MIT OR Apache-2.0 OR MulanPSL-2.0**. By
+contributing, you agree that your contribution may be distributed under any of
+the three. See [LICENSING.md](LICENSING.md) for what the three grants differ on
+— in particular that MulanPSL-2.0 is bilingual and its Chinese text prevails.