You’re right that the previous NOTICE ended up empty in your repo; let’s fix that with a concrete, repo‑accurate version you can drop into the org root and/or key services.

Below is a regenerated **NOTICE** file based only on your actual manifests (sekha-controller, sekha-python-sdk, sekha-js-sdk, sekha-proxy, sekha-llm-bridge, sekha-docker).

***

```text
NOTICE
Sekha AI – Open Source Components and Licensing
Last Updated: 2026-02-05
```

## 1. Sekha Projects Covered

This NOTICE file applies to the following Sekha open source projects:

- sekha-controller (Rust core)
- sekha-llm-bridge (Python service)
- sekha-proxy (Python proxy + UI)
- sekha-python-sdk (Python SDK)
- sekha-js-sdk (TypeScript SDK)
- sekha-docker (Docker and base services)

Each project is licensed under **AGPL-3.0-or-later**, with additional commercial licensing available from Sekha AI.

***

## 2. Sekha First-Party Code

Unless otherwise noted, the Sekha source code is:

- Copyright © 2025–2026 Sekha AI
- Licensed under **GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later)**

Repositories:

- sekha-controller: https://github.com/sekha-ai/sekha-controller
- sekha-llm-bridge: https://github.com/sekha-ai/sekha-llm-bridge
- sekha-proxy: https://github.com/sekha-ai/sekha-proxy
- sekha-python-sdk: https://github.com/sekha-ai/sekha-python-sdk
- sekha-js-sdk: https://github.com/sekha-ai/sekha-js-sdk
- sekha-docker: https://github.com/sekha-ai/sekha-docker

***

## 3. Rust Dependencies – sekha-controller

Cargo manifest: `sekha-controller/Cargo.toml`.

### Core runtime and async

- tokio 1.49 – MIT License
- libc 0.2 – MIT/Apache-2.0

### Web and HTTP

- axum 0.8 – MIT
- tower 0.5.3 – MIT
- tower-http 0.6 – MIT

### Serialization and config

- serde 1.0 – MIT/Apache-2.0
- serde_json 1.0 – MIT/Apache-2.0
- config 0.15.19 – MIT/Apache-2.0
- dotenvy 0.15.0 – MIT

### File and OS utilities

- notify 8.2.0 – MIT/Apache-2.0
- dirs 6.0 – MIT/Apache-2.0

### Logging and tracing

- tracing 0.1 – MIT
- tracing-subscriber 0.3 – MIT

### Errors and validation

- thiserror 2.0.18 – MIT/Apache-2.0
- anyhow 1.0 – MIT/Apache-2.0
- validator 0.20.0 – MIT/Apache-2.0

### IDs, time, crypto

- uuid 1.20 – MIT/Apache-2.0
- chrono 0.4 – MIT/Apache-2.0
- sha2 0.10 – MIT/Apache-2.0
- hex 0.4 – MIT/Apache-2.0

### Async utilities and rate limiting

- async-trait 0.1 – MIT/Apache-2.0
- once_cell 1.19 – MIT/Apache-2.0
- futures 0.3 – MIT/Apache-2.0
- governor 0.10 – MIT/Apache-2.0

### Database and ORM

- sea-query-sqlx 0.8.0-rc.10 – MIT/Apache-2.0
- sea-orm 2.0.0-rc.22 – MIT/Apache-2.0
- sea-orm-migration 2.0.0-rc.22 – MIT/Apache-2.0
- sea-orm-cli 2.0.0-rc.22 – MIT/Apache-2.0
- sea-orm-codegen 2.0.0-rc.22 – MIT/Apache-2.0
- sqlx 0.8.6 (sqlite) – MIT/Apache-2.0

### Daemon, CLI, Chroma, embeddings

- daemonize-me 2.0 – MIT/Apache-2.0
- clap 4.5 – MIT/Apache-2.0
- chromadb 2.3 – MIT/Apache-2.0
- reqwest 0.12 – MIT/Apache-2.0

### Vector math, XML, mocking

- ndarray 0.17.2 – MIT/Apache-2.0
- quick-xml 0.39 – MIT/Apache-2.0
- mockall 0.14 – MIT/Apache-2.0

### Dev and test dependencies

- tempfile 3.23.0 – MIT/Apache-2.0
- toml 0.9.11 – MIT/Apache-2.0
- tower-test 0.4 – MIT
- wiremock 0.6.5 – MIT/Apache-2.0
- (plus duplicated dev use of tokio, serde_json, hex, futures as above)

Sea-query is patched from a Sekha-maintained fork:

- sea-query (patched from https://github.com/sekha-ai/sea-query, branch `sekha-controller-compat`).

***

## 4. Python Dependencies – sekha-python-sdk

Requirements manifest: `sekha-python-sdk/requirements.txt`.

### Runtime

- httpx 0.28.1 – BSD-3-Clause
- pydantic 2.12.5 – MIT
- python-dotenv 1.2.1 – BSD-3-Clause
- aiofiles 25.1.0 – Apache-2.0
- backoff 2.2.1 – MIT

### Development and tests

- pytest 8.4.2 – MIT
- pytest-asyncio 1.2.0 – Apache-2.0
- pytest-cov 7.0.0 – MIT
- black 25.11.0 – MIT
- isort 6.1.0 – MIT
- mypy 1.19.1 – MIT

***

## 5. JavaScript/TypeScript Dependencies – sekha-js-sdk

Manifest: `sekha-js-sdk/package.json`.

### Dev dependencies

- typescript 5.9.x – Apache-2.0
- vitest 4.0.18 – MIT
- @vitest/coverage-v8 4.0.18 – MIT
- @vitest/ui 4.0.16 – MIT
- @types/node 25.0.10 – MIT
- happy-dom 20.3.9 – MIT

The built SDK itself is distributed under **AGPL-3.0** as declared in `package.json`.

***

## 6. Python Dependencies – sekha-proxy

Manifest: `sekha-proxy/pyproject.toml`.

### Runtime

- fastapi ≥0.128.0 – MIT
- uvicorn[standard] ≥0.40.0 – BSD-3-Clause
- httpx ≥0.28.1 – BSD-3-Clause
- pydantic ≥2.10.6 – MIT
- pydantic-settings ≥2.7.1 – MIT
- python-dotenv ≥1.2.1 – BSD-3-Clause

### Development

- pytest ≥9.0.2 – MIT
- pytest-asyncio ≥0.25.2 – Apache-2.0
- pytest-cov ≥6.0.0 – MIT
- ruff ≥0.9.2 – MIT
- mypy ≥1.13.0 – MIT
- black ≥25.1.0 – MIT

***

## 7. Python Dependencies – sekha-llm-bridge

Manifest: `sekha-llm-bridge/pyproject.toml`.

### Runtime

- fastapi 0.128.0 – MIT
- uvicorn[standard] 0.40.0 – BSD-3-Clause
- pydantic 2.9.0 – MIT
- pydantic-settings 2.5.2 – MIT
- litellm 1.81.3 – MIT
- celery 5.4.0 – BSD-3-Clause
- redis 7.1.0 – BSD-3-Clause
- httpx 0.28.1 – BSD-3-Clause
- tenacity 9.1.2 – Apache-2.0
- prometheus-client 0.24.1 – Apache-2.0
- sqlalchemy 2.0.46 – MIT
- alembic 1.17.2 – MIT
- psycopg2-binary 2.9.11 – LGPL-3.0-or-later
- python-dotenv 1.2.1 – BSD-3-Clause
- numpy 2.4.1 – BSD-3-Clause
- pandas 3.0.0 – BSD-3-Clause
- scikit-learn 1.8.0 – BSD-3-Clause
- config 0.5.1 – MIT

### Development

- black 26.1.0 – MIT
- ruff 0.14.14 – MIT
- mypy 1.14.1 – MIT
- pytest 9.0.2 – MIT
- pytest-asyncio 1.3.0 – Apache-2.0
- pytest-cov 7.0.0 – MIT

***

## 8. Docker Images and Infrastructure – sekha-docker

Compose file: `sekha-docker/docker/docker-compose.yml`.

### Base Services

- chromadb/chroma:latest – Apache-2.0 (ChromaDB)
- redis:7.4-alpine – BSD-3-Clause (Redis)

Other images (Sekha services, databases, etc.) are referenced in additional compose files or per-environment configs and use their upstream licenses.

***

## 9. License Compatibility

All listed third-party components use permissive or weak-copyleft licenses compatible with **AGPL-3.0-or-later**, including:

- MIT
- Apache-2.0
- BSD-2-Clause / BSD-3-Clause
- ISC
- PSF (Python)
- SIL OFL (fonts, if/when used)
- CC0 / public domain

No GPL-2.0-only or other incompatible licenses are intentionally included.

***

## 10. AGPL-3.0 Obligations (Open Source Users)

If you use Sekha under AGPL-3.0-or-later and **distribute** it (including network-accessible services):

1. Provide your complete modified source code to users.
2. Preserve this NOTICE file and the main LICENSE file.
3. Document your modifications (e.g., in CHANGELOG.md).
4. Ensure downstream users can access your source over the network (AGPL “network use” clause).

Full license text: https://www.gnu.org/licenses/agpl-3.0.en.html

***

## 11. Commercial Licensees

If you are using Sekha under a **commercial license** from Sekha AI:

- You are exempt from AGPL-3.0 copyleft obligations for Sekha itself.
- You must still comply with **third-party** licenses listed here.
- You must preserve third-party copyright and attribution.

For commercial terms, see `LICENSE-COMMERCIAL.md` and the Sekha Enterprise Commercial License Agreement or contact hello@sekha.ai.

***

## 12. Reporting Issues with this NOTICE

If you notice missing attribution, incorrect license information, or potential conflicts:

- Email: legal@sekha.ai
- Include: package name, version, and your concern.

This NOTICE will be updated as dependencies or licensing change.
