- provenance made precise: the crypto/wire-format core is clean-room; the
RAOP/AP2 transport in
raop_sender.cppis credited as a C++ port of pyatv (MIT). pyatv's MIT notice now ships inlicenses/THIRD-PARTY-NOTICES.txt. - added
## securityscope note (sender does not yet authenticate the receiver; trusted-LAN use), plusSECURITY.md,CONTRIBUTING.md(with the clean-room rule), an issue template, and a CI build of the crypto core. - hardening: bplist UTF-16 length DoS-bound; pair-verify empty-shared-secret
guard. ed25519 build now matches its SOURCE.md (drops seed.c /
ED25519_NO_SEED). - initial extraction from FXChainPlayer: the verified AirPlay 2 realtime sender
- the Qt-free crypto/wire-format core.
- README carries the complete seven-step AP2 realtime recipe + the pair-verify-vs-transient audio-key story (the macOS 32-byte clamp).
- Apache-2.0 (explicit patent grant for the reverse-engineered protocol); vendored ed25519 (zlib); Mbed TLS (Apache-2.0) at build time.
- trademark / non-affiliation disclaimer added to README + NOTICE (Apple Inc. marks used nominatively; clean-room interoperability client, ships no apple keys/certs/firmware).