Add NOTICE and record the embedded specification bundle

.github/workflows/release.yml

@@ -72,7 +72,7 @@ jobs:
         shell: bash
         run: |
           source_date_epoch="$(git show -s --format=%ct "${RELEASE_TAG}^{commit}")"
-          touch --date="@${source_date_epoch}" LICENSE README.md THIRD_PARTY_NOTICES
+          touch --date="@${source_date_epoch}" LICENSE NOTICE README.md THIRD_PARTY_NOTICES
 
       - name: Package without publishing
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3

.goreleaser.yml

@@ -67,6 +67,7 @@ archives:
           - zip
     files:
       - LICENSE
+      - NOTICE
       - README.md
       - THIRD_PARTY_NOTICES
 

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to tagged releases are documented here.
 
 ## Unreleased
 
+- Add a `NOTICE` file identifying Brian Jin as the copyright holder and carrying
+  the attribution required for the embedded Judgment Pack Specification artifacts, and ship it in
+  the release archives.
+- Record the embedded specification bundle in `THIRD_PARTY_NOTICES`. The bundle is Apache-2.0
+  material from a separate project and appears in neither `go.mod` nor `go.sum`, so the previous
+  Go-modules-only framing omitted it.
+
 ## 0.0.1 - 2026-07-23
 
 - Establish `judgment-pack-runtime` as the vendor-neutral reference runtime for the Judgment Pack
@@ -26,5 +33,7 @@ All notable changes to tagged releases are documented here.
 - The embedded specification bundle is still pinned to the pre-neutralization upstream tag
   (`protossai/judgment-pack-spec@v0.1.0-draft`). Re-vendoring to a neutral, digest-locked spec tag
   is pending the specification project publishing one.
-- The Apache-2.0 `LICENSE` copyright-owner line and a `NOTICE` file are not yet filled in, and no
-  `GOVERNANCE`/`MAINTAINERS`/`CODEOWNERS` files exist yet.
+- No `GOVERNANCE`/`MAINTAINERS`/`CODEOWNERS` files exist yet. (The `NOTICE` file is added in
+  Unreleased. `LICENSE` is deliberately left byte-identical to the canonical Apache-2.0 text: its
+  appendix is a template for marking your own files, not a field to fill, and editing it costs a
+  clean Apache-2.0 match on automated license scanners. The copyright holder is named in `NOTICE`.)

NOTICE

@@ -0,0 +1,14 @@
+judgment-pack (Judgment Pack reference runtime)
+Copyright 2026 Brian Jin
+
+This product embeds unmodified specification artifacts from the Judgment Pack
+Specification: the JSON Schema, the conformance manifest and its schema, and the
+conformance case corpus.
+
+  Judgment Pack Specification
+  Copyright 2026 Brian Jin
+  https://github.com/Judgment-Pack/judgment-pack-spec
+  Licensed under the Apache License, Version 2.0.
+
+The exact embedded revision and per-file SHA-256 digests are recorded in
+internal/artifacts/jps/<version>/lock.json.

README.md

@@ -36,8 +36,8 @@ specification and the prefix of its provisional diagnostic codes.
 
 Download the archive for your operating system and architecture from
 [GitHub Releases](https://github.com/Judgment-Pack/judgment-pack-runtime/releases). Each archive
-includes the `judgment-pack` and `jpack` binaries, README, Apache-2.0 license, and third-party
-notices.
+includes the `judgment-pack` and `jpack` binaries, README, Apache-2.0 license, attribution notice,
+and third-party notices.
 
 Asset names follow this pattern:
 

THIRD_PARTY_NOTICES

@@ -1,11 +1,26 @@
 judgment-pack third-party notices
 ================================
 
-This distribution contains the following Go modules. Versions are recorded in
-go.mod and go.sum.
-
-Apache License 2.0 components
------------------------------
+This distribution contains third-party material of two kinds: specification
+artifacts embedded into the binary at build time, and Go modules. The embedded
+artifacts appear in neither go.mod nor go.sum and are listed first below. Go
+module versions are recorded in go.mod and go.sum.
+
+Judgment Pack Specification — Apache License 2.0
+-------------------------------------------------
+
+Copyright 2026 Brian Jin
+https://github.com/Judgment-Pack/judgment-pack-spec
+
+This distribution embeds unmodified specification artifacts compiled into the
+binary from internal/artifacts/jps/ — schema.json, manifest.json,
+manifest.schema.json, and the conformance case corpus. They are licensed under
+the Apache License, Version 2.0; a copy is in the accompanying LICENSE file, and
+the required attribution is in NOTICE. The exact upstream revision and per-file
+SHA-256 digests are recorded in the bundled lock.json.
+
+Apache License 2.0 components (Go modules)
+------------------------------------------
 
 - github.com/santhosh-tekuri/jsonschema/v6
 - github.com/spf13/cobra