# Third-party notices

Sonalon is released under the **GNU General Public License, version 3** (`LICENSE`). Copyright (C) 2026 John Benac for Sonalon's own code. This file follows the layout of the notices of Private Local Chat (`/srv/privatelocalchat-public`, commit `c52b645d5ce0f9fc43cf245b6ce3e5208bb045b7`), from which the licensing approach was taken. The machine-readable inventory behind it is `docs/evidence/licence/third-party.json`; `tests/license-notices.test.mjs` fails when the two or the shipped files disagree.

**Every new third-party component or model weight set needs an entry here and in `docs/evidence/licence/third-party.json` before it ships.** A licence that has not been confirmed from the component's own files is written as "licence to be confirmed", with the reason in the inventory, never guessed.

## Source for each build

The complete corresponding source of the build a visitor received is published as an archive named by the build id: `https://assets.sonalon.com/source/sonalon-<build id>.tar.gz`. The build id is shown in the app's Settings and is in `src/build-info.js`; the page "How it works" links the archive of the build being served. The archive is made by `tools/publish-source.mjs`; its `README` says what it contains and what it leaves out and why. Apache-2.0, MIT, ISC and Bitstream Vera components are combined with this program under the terms of GPL-3.0, which permits it.

## Software bundled with the app

| Component | Used for | Licence | Source |
|---|---|---|---|
| three.js 0.186.1 (`public/vendor/three-0.186.1/`, licence text beside it) | Drawing the 3D places and people | MIT | https://github.com/mrdoob/three.js |
| meshoptimizer decoder 1.3.0 (`public/vendor/meshopt-1.3.0/`, `SOURCE.txt` gives the sha256) | Decoding compressed 3D models | MIT | https://github.com/zeux/meshoptimizer |
| transformers.js (@huggingface/transformers) 4.2.0, bundled in `public/vendor/memory-embedding/worker.js` | Running the memory embedding model in the browser | Apache-2.0 | https://github.com/huggingface/transformers.js |
| @huggingface/jinja 0.5.9, bundled in the same worker | Chat-template support inside transformers.js | MIT | https://github.com/huggingface/huggingface.js |
| @huggingface/tokenizers 0.1.3, bundled in the same worker | Splitting text for the embedding model | Apache-2.0 | https://github.com/huggingface/tokenizers.js |
| ONNX Runtime Web 1.26.0-dev.20260416-b7804b056c, bundled in the same worker (banner in `worker.js.LEGAL.txt`); its WebAssembly runtime is served from the asset host with the model files | Running the model | MIT | https://github.com/Microsoft/onnxruntime |
| Moonshine speech runtime (Vitruvian low-memory build), `public/vendor/moonshine/` (a worker per model; `README.md` gives provenance and hashes) | On-device speech recognition and the Kokoro voice | MIT for Moonshine runtime code and the Vitruvian patch; bundled dependency terms below | https://github.com/moonshine-ai/moonshine/blob/06f74196a6212fe8642df143d87a243970f15114/LICENSE |
| Private Local Chat voice runtime (Kitten TTS engine, ONNX Runtime Web 1.31.1, eSpeak NG phonemizer), `public/vendor/plc-voice/` (a `.LEGAL.txt` beside each worker) | The lighter on-device voice, and its phonemes for lip sync | GPL-3.0 (eSpeak NG GPL-3.0-or-later; ONNX Runtime Web, fflate, noble-hashes MIT) | https://github.com/espeak-ng/espeak-ng |

The Moonshine runtime's pinned `LICENSE` Section 1 explicitly covers its code under MIT, excluding `core/third-party`; the other-language model terms in Section 2 do not describe this runtime. Its source graph includes ONNX Runtime 1.23.2, nlohmann, cpp-annote and utf8proc (MIT), utf8proc's Unicode data notice, utf-8 (BSL-1.0), kaldi-native-fbank (Apache-2.0), kissfft (BSD-3-Clause), and Eigen's MPL-2.0 subset (`EIGEN_MPL2_ONLY`). Their supplied licence texts, the upstream Moonshine licence and the Vitruvian patch licence are preserved in `public/vendor/moonshine/licenses/`, with source URLs and hashes in `docs/evidence/licence/technical-source-check-2026-11-04.json`. These are source-graph notices; this is not a claim that every object survives the WASM linker.

## Fonts, icons and artwork

| Component | Used for | Licence | Source |
|---|---|---|---|
| DejaVu fonts (`public/brand/fonts/`, Debian `fonts-dejavu-core`; full text in `public/brand/fonts/LICENSE.txt`) | The site and app typefaces | Bitstream Vera licence (DejaVu changes are public domain) | https://dejavu-fonts.github.io/ |
| Lucide icon geometry 1.62.0, pinned commit `03f11e2d6adc319ea21e9a1d5820a99cd3767257` (`public/brand/glyphs/`) | Interface icons | ISC, Copyright (c) 2026 Lucide Icons and Contributors | https://github.com/lucide-icons/lucide |
| **Cast character and mannequin models** (`public/avatars/`) | The people in the places | GPL-3.0-only, Sonalon's own generated work; the Vitruvian base is CC0-1.0 (CharMorph is GPL as a tool and its output is not a derivative; `assets/avatars/README.md`) | `assets/avatars/README.md` |
| **Scene models, textures and sidecars** (`public/scenes/`) | The places | licence to be confirmed: generated by Sonalon's own authoring chain with procedural textures (`docs/SCENE-SOURCES.md`); the owner has not yet stated the outward licence of this content separately from the code | `docs/SCENE-SOURCES.md` |
| **Persona illustrations and brand media** (`public/brand/portraits/`, the media on the asset host) | Portraits and share images | licence to be confirmed: AI-generated fictional persona illustrations; `docs/brand/media-registry.json` states no outward licence | `docs/brand/media-registry.json` |

## Models (downloaded files, not part of the program)

| Model | Used for | Licence | Hosted at |
|---|---|---|---|
| MongoDB/mdbr-leaf-ir (int8 ONNX), revision `4262131b32c3182bd06e67e92ae69d7bd66e0c5c` | Memory embeddings, 23 MB | Apache-2.0 (checked 2026-10-24, `docs/MEMORY-DESIGN.md` section 8; the model card's training-data statement has not been read) | `https://assets.sonalon.com/models/memory/` on the project asset host. Source: https://huggingface.co/MongoDB/mdbr-leaf-ir |
| Xenova/ms-marco-MiniLM-L-6-v2 (int8 ONNX, optional reranker) | Re-ranking recalled memories | licence to be confirmed: pinned export card `a09144355adeed5f58c8ed011d209bf8ee5a1fec` has no licence declaration or LICENSE file; its linked base declares Apache-2.0. Publication verified by matching CDN manifest and upstream LFS SHA-256 (23,143,499 bytes) | `https://assets.sonalon.com/models/memory/`. Source: https://huggingface.co/Xenova/ms-marco-MiniLM-L-6-v2 |
| UsefulSensors/moonshine-tiny (speech recognition, .ort) | Understanding what the visitor says, 44 MB | MIT (model card, checked 2026-11-04) | `https://assets.sonalon.com/models/speech/v1/moonshine-native/` |
| hexgrad/Kokoro-82M (ONNX .ort, voice af_heart) | Her voice, 118 MB with its phonemizer files | Apache-2.0 (model card, checked 2026-11-04; the card's training-data statements have not been read) | `https://assets.sonalon.com/models/speech/v1/moonshine-kokoro/` |
| KittenML/kitten-tts-nano-0.8-int8, revision `84781d74e29ee25217551556398b42f80593a813` | A lighter voice, 27 MB | Apache-2.0 (model card, checked 2026-11-04; the card's training-data statements have not been read) | `https://assets.sonalon.com/models/speech/v1/kitten-tts-nano-0.8-int8/` |

Model files are separate works. Their licences, not the GPL, apply to them. Weights for speech and language models are added here with their own licence and, where the model card states it, the training-data licence, when they first ship.

## Licences still to be confirmed

Three entries above say "licence to be confirmed": the scene models, textures and sidecars; the persona illustrations and brand media; and the optional reranker. The reranker is published, but its pinned export publisher has not supplied an explicit licence declaration; the linked base model's Apache-2.0 declaration is recorded separately. The reasons are in `docs/evidence/licence/third-party.json`. Nothing in this file states a licence for them that the project's own records do not.