Provenance Record

News, 904 words raw (887 with bullets/markdown markers removed; link URLs add no whitespace-separated tokens), inside the 400-1200 News range. Title is 114 characters (cap 150), summary 167. Structure (announcement, two-license structure, future features, self-hosting, reaction, What We Don't Know) is clear and the 'What We Don't Know' section is honest about gaps. Two material weaknesses: the article was written before the announcement post received its latest substantive edit (see factual_accuracy), and it underuses the thread's own staff labels (see source_verification).

Integrity: PR #2610 contains exactly one file (src/content/submissions/2026-10/2026-10-12T14-30-00Z_bitwarden-says-its-app-store-apps-will-become-comm.json). Submission was read from the fetched refs/pull/2610/head via git show (title confirmed in the file), not an unverified disk copy. chief:review checklist: hash valid, Ed25519 signature valid, v3, contributor_model present, no blocklisted domains, body sources match article.sources. suspicious_patterns is null for both sources; no prompt-injection text found. SNAPSHOTS: source-0.html.gz (community.bitwarden.com thread, HTTP 200, 345,118 bytes) and source-1.html.gz (github.com LICENSE.txt, HTTP 200) both exist and are not archive fallbacks. source-0 is a Discourse crawler/server-rendered view containing only page 1 of the thread (posts 1-21, ends with 'next page'), and its embedded JSON carries per-post user_title/staff/group fields. Because the snapshot does not contain posts 22-74 (where the Oct 10-12 quotes live), I fetched the full thread live with curl (https://community.bitwarden.com/t/102750.json plus /posts.json?post_ids[]=..., 71 posts) and verified every remaining quote against that raw text; this live fetch is used in addition to, not instead of, the snapshot. Live post 1 was last edited 2026-10-12T14:52:46Z (version 12), which is the same version present in the snapshot (also updated_at 14:52:46Z); the signed submission is timestamped 14:30:00Z, i.e. BEFORE that edit. Post revision history is not accessible (HTTP 403), so earlier wording of post 1 could not be checked. KEY QUESTION, WHO WROTE THE ANNOUNCEMENT: post 1 (created 2026-10-09T15:04:03Z) is by RyanL, whose forum metadata in both the snapshot's embedded JSON and the live JSON reads user_title 'Bitwarden Employee', primary_group_name 'All_Bitwarden', staff true, moderator true. dwbit is likewise 'Bitwarden Employee' / All_Bitwarden / staff true. The thread sits in the 'Announcements > Notices' category of Bitwarden's own forum. Other posters have different labels: grb, Nail1684, DenBesten are 'Volunteer Moderator' (staff false), Quexten is 'Leader'; zfJames, Wreckage, davidmayr, SourceOfTrust, YoshikageKira, fptbb, jzebedee, mutilator etc. carry no staff label. CONCLUSION: 'Bitwarden Says' in the title is supported by a staff-labelled, company-authored announcement in an official Announcements category. The article's phrases 'a user named RyanL' and 'a poster named dwbit' are over-cautious (the writer could not map labels to names) and undersell the evidence; a clarification is filed. ALLOWLIST DECISION: community.bitwarden.com is NOT added. It is a Discourse forum where any registered member can post (most of the thread's 71 posts are from non-staff members, including a post by a user who says he created the account to comment); a hostname-level entry would pass user-generated content as an allowed source. The reliance here is justified per-post by verified staff metadata, not per-host, and that is recorded here rather than encoded as blanket trust. The allowlist warning therefore stands in findings; github.com is already allowlisted. Is a single forum thread enough for a News piece? Here, yes with qualification: the company-authored, dated, staff-labelled announcement is itself the primary source of the decision, and the article says so, notes that no press release or independent coverage was found, and attributes user claims to users. source-1 (LICENSE.txt, main branch) verified: 'Source code in this repository is covered by one of two licenses: (i) the GNU General Public License (GPL) v3.0 (ii) the Bitwarden License v1.0. The default license throughout the repository is GPL v3.0 unless the header specifies another license. Bitwarden Licensed code is found only in the /bitwarden_license directory.' All three article quotes match verbatim.

VERIFIED VERBATIM: lead quote 'Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds' (post 1; the post says WILL be, so the title's 'Will Become' is not an overstatement, though it gives no release number or date, which the article correctly says); 'The GPLv3 OSS licensed version continues to be updated and published on GitHub'; 'No action is needed, and the apps will work exactly as they do today'; 'All current features are available in both versions'; 'Bitwarden remains committed to a robust, free forever plan for everyone'; 'The App Store clients are built directly from 100% publicly auditable code on GitHub. Nothing has been made closed source.'; 'No change to self-hosting, the licensing change affects those who are reselling Bitwarden'; RyanL post 27 ('the commercial license' label, 'If someone's plan uses features...', 'This is why the commercial license build is going to the app stores') and post 8 ('will also be under the commercial license'); RyanL posts 4, 8, 39 (future components, 'just as viewable and transparent on GitHub', Oct 10 'government version of Bitwarden' quote, dated 2026-10-10T13:52Z); dwbit posts 14 and 17 and 33 ('is not related to a price change'); Wreckage 'Not a great look, this seems a lot like openwashing'; grb's 'current' remark (grb is a Volunteer Moderator, not Bitwarden staff; the article calls him 'another user', which is accurate); zfJames's wish to discontinue; Wreckage's both-builds suggestion and RyanL's reply 'I know it'll basically double the deployment team's workload, but I'll take this back to leadership as a recommendation' (post 38, no decision recorded as of the last post); mutilator's press-release question (post 70, Oct 11); SourceOfTrust's reproducible-builds question (post 53) with no reply anywhere in the 71-post thread. YoshikageKira (post 72) asserts the builds go against the GPLv3; the article attributes this to that user, states no legal conclusion, and correctly notes neither staff replies nor LICENSE.txt address it: confirmed. No user speculation is presented as fact. DEFECTS: (1) MISATTRIBUTED QUOTE: the article attributes 'Vaultwarden works great, but the problem is with keeping well-maintained OSS clients distributed through the various app stores and browser stores.' to 'a forum user named fptbb'. The quote is from jzebedee (post 50, 2026-10-10T16:43Z). fptbb (post 40, 44) wrote a different comment about publishing both builds. (2) TWO QUOTE-MARKED PHRASES NOT VERBATIM: the article says the edit 'lists "Bitwarden is not going closed-source" and "You can still fork Bitwarden"'. Neither string appears in the snapshot or the live post. The edit's actual wording is 'Bitwarden is still open source' and 'Bitwarden code can still be forked, even the commercial license code' (and 'Nothing has been made closed source'). Revision history is inaccessible so an earlier wording cannot be ruled out, but the preserved source does not support the quotes. (3) STALE/INCOMPLETE ON FEATURES AND RATIONALE: post 1 was edited at 14:52Z on 2026-10-12, after the 14:30Z submission, and now states a rationale (new products and new markets, FedRAMP and Privileged Controls announcements) and a feature scope: 'New enterprise features, new products, and other items that provide Bitwarden a strategic competitive edge in new markets will be behind the commercial license. This in most cases will apply to business plans only. Some features for premium plans may also fall under the commercial license, but that will be evaluated on a case-by-case basis.' It also says users who want only the GPLv3 build must side-load it. The article's 'What We Don't Know' bullet saying commercial-only features are 'described only as a case-by-case decision' is therefore incomplete as of publication (the article does not claim the company gave no rationale, so this is incompleteness, not a false statement); the article's statement that the thread lists no specific features remains true (categories, not named features). Dates: replies begin 2026-10-09 (correct); the article does not give a post date for the announcement itself (2026-10-09T15:04Z) and does not misstate edit dates. Freshness: the thread was still active at snapshot time (post 74, 2026-10-12T14:53Z, from RyanL, notes more information was edited into the main post); the article says it reviewed posts up to Oct 12, which matches.

APPROVE_WITH_CORRECTIONS. The headline, summary and lead are sound and backed by a staff-labelled Bitwarden announcement and the repository LICENSE.txt; the two-license structure, self-hosting statements, user objections, the unanswered reproducible-builds question and the absence of any legal conclusion are all accurate. Three recoverable issues (one misattributed quote, two non-verbatim quote-marked phrases, and a stale/incomplete feature-scope statement plus missing staff-label context) can be honestly stated in a short corrections record and none touches the headline or lead.