Licensing and third-party notices
Where each component’s license and provenance is recorded.
Synoec’s license is in LICENSE. Third-party components keep their own licenses and notices. This page maps those records; the license text shipped with each artifact is authoritative.
Application dependencies
Section titled “Application dependencies”The third-party notices catalog records direct JavaScript and native dependencies, desktop components, bundled data and licensed test fixtures, with exact versions and license expressions. The direct dependency inventory feeds release SPDX generation; bun.lock pins the JavaScript graph.
The release packager ships the Synoec license, third-party notices, an SPDX inventory and checksums. A source dependency list is not proof of what a particular binary contains — inspect the actual target-platform package.
Bundled desktop tools
Section titled “Bundled desktop tools”| Component | Version / source | License and retained information |
|---|---|---|
| Electron | 44.7.1, pinned in apps/desktop/package.json |
MIT; Electron and Chromium notices are retained in the assembled app; catalog entry |
ripgrep (rg for agent shells) |
15.2.0, archive SHA-256 pinned in scripts/runtime/ripgrep-assets.ts |
MIT or Unlicense; notice |
| NetBird client | 0.78.0, archive SHA-256 pinned in scripts/runtime/netbird-sidecar.mjs |
BSD-3-Clause; notice |
NSIS installer stubs (Windows .exe) |
NSIS 3.13, archive SHA-256 pinned | zlib/libpng; notice |
Bundled data
Section titled “Bundled data”| Component | Version / source | License and retained information |
|---|---|---|
| models.dev catalog projection | api.json snapshot, SHA-256 pinned in models-dev-openai-compatible.json |
MIT; notice. Public provider/model metadata for OpenAI-compatible setup only |
Generated notification sounds
Section titled “Generated notification sounds”apps/desktop/assets/notification-sounds/ holds Synoec’s own sounds, computed from
sine partials and pitch sweeps by generate-notification-sounds.mjs,
with no recorded, sampled or third-party audio. They are covered by Synoec’s license.
| File | SHA-256 |
|---|---|
bell.wav |
31d43dd250fb373024e3dfccaed5258ef4a8693e99bc49f6a4ad66fe5e661295 |
finish.wav |
b3454972ec49e1529bf84a2bde1e314c08211263138febb7c7912f115defa964 |
knock.wav |
f0d3f43f1208c1b35c741d2a37f028c50a65a0075ca756c74a6ae8b172427254 |
long-pop.wav |
bc5ec20f647cb84164bfefd1dcf1ddaa49413fc0bd0ba9b6953e1771a8039b8c |
note.wav |
d1057a682c72100d2c3f21ed701ad6ebb2b8a32ecfaafb6a84a133ce499a3d6e |
pop.wav |
2f930d64b1dd3ed0016b9dcd688cfbcd1d8d5c3b8bba1f76389dfb1b1464490b |
pulse.wav |
18855c908d5c551d019da850a25e4cf989a3d815283bb5e9111ac3c65fa72041 |
Persistent memory (optional)
Section titled “Persistent memory (optional)”| Component | Version / source | License and retained information |
|---|---|---|
| MemPalace | 3.9.0 | MIT; provenance |
| uv (managed installer) | 0.8.22 | MIT option in UV-LICENSE; platform downloads hash-pinned |
| Private Python | 3.12.11 | Python and bundled notices stay in its installed distribution |
| MiniLM model and tokenizer | all-MiniLM-L6-v2 | Apache-2.0; the Core AI archive carries source attribution and model notice |
| Python dependencies (Chroma, ONNX Runtime, tokenizers …) | Hash-locked in the requirements lock | Installed-wheel inventory; originals remain in wheel metadata |
| Core AI framework | macOS | Supplied by the OS under Apple’s terms; not redistributed |
Installed runtimes keep MEMPALACE-LICENSE, MINILM-LICENSE, UV-LICENSE,
THIRD-PARTY.json and upstream wheel notices under
$SYNOEC_HOME/runtimes/mempalace-3.9.0/. The wheel inventory was inspected on
darwin-arm64 only. Core AI and standard MiniLM are alternative representations
of the same model; its license applies to whichever you select or bundle.
Context extraction
Section titled “Context extraction”| Component | Version / source | License and retained information |
|---|---|---|
| unpdf | 1.3.2, bundling Mozilla pdf.js | MIT (unpdf) and Apache-2.0 (pdf.js); PDF text and page pictures for Read, AttachmentRead and WebFetch, in the engine with no Python runtime |
| pypdf | 6.21.1, wheel SHA-256 pinned | BSD-3-Clause; PYPDF-LICENSE installed with the memory runtime |
Office, OpenDocument, CSV and HTML extraction uses the Python standard library. See context extraction provenance.
Local AI on Windows (optional)
Section titled “Local AI on Windows (optional)”| Component | Version / source | License and retained information |
|---|---|---|
| NInfer | iamwavecut/ninfer-all release 2026-11-03.1 (commit c37a053b…), Windows x64 CUDA 13.4 package, two volumes pinned by SHA-256 in ninfer.json and mirrored unchanged as the ninfer-2026-11-03.1 prerelease on the Synoec repository |
Apache-2.0; the release’s LICENSE, LICENSE-*.txt and SHA256SUMS.txt stay in the unpacked runtime, which setup verifies against that list |
| Bonsai 2 (27B) | WaveCut/Ternary-Bonsai-2-27B-NInfer-v3 revision 841f7812…, one .ninfer artifact pinned by SHA-256 in the same manifest |
Apache-2.0 (official weights with MTP, DFlash2 and vision) |
| Synoec Local AI service | apps/desktop/native/guardian/src/bin/synoec-local-ai.rs, built with the guardian crate |
Synoec’s own; windows-sys notices ship with the guardian’s |
| ComfyUI (image generation, optional) | Comfy-Org/ComfyUI release v0.43.0 (commit 426f5eea…), the ComfyUI_windows_portable_nvidia.7z package pinned by SHA-256 in image.json |
GPL-3.0; unpacked as published, with its embedded Python and that Python’s packages under their own licenses |
| Qwen Image 2.1 Turbo transformer and VAE | Comfy-Org/Qwen-Image-2.1 revision aacf31a6…, two files pinned by SHA-256 in the same manifest |
Qwen research license: non-commercial use only. The card names it before anything downloads |
| Qwen3-VL 8B text encoder, INT8 | pottokao/Qwen-Image-2.1-Text-Encoder-Heretic-int8-convrot revision 033b4bf2…, one file pinned by SHA-256 in the same manifest |
Apache-2.0 |
Both are downloaded on demand, never rebuilt by Synoec: the NInfer volumes from
Synoec’s own ninfer-2026-11-03.1 prerelease (upstream deletes its releases;
the bytes and upstream SHA256SUMS are unchanged) and Bonsai 2 from Hugging
Face. The Microsoft
Visual C++ 2022 runtime and the NVIDIA driver are the person’s own installs.
Image generation is optional and downloads the same way: the person
fetches ComfyUI from GitHub and the three model files from Hugging Face, and
Synoec redistributes none of them. Qwen Image 2.1’s license allows
non-commercial use only, which is the person’s to accept.
This table is the only license record for these components; the
third-party notices catalog has no entry for
them yet, and the Python packages inside the ComfyUI package are not
catalogued individually. The guardian’s own Rust dependencies, serde_json
among them, are staged from cargo metadata at build time, which fails if a
license or notice file is missing. The earlier Prism runtime is gone and ships
nothing.
Decision models and discovery (optional)
Section titled “Decision models and discovery (optional)”| Component | Version / source | License and retained information |
|---|---|---|
| Julia-1 | SupersonicLabs/Julia-1 revision a85b127321d5… |
Apache-2.0 |
| GLiNER2.5-Decide | fastino/GLiNER2.5-Decide revision 5a7adf72a23b… |
Apache-2.0 |
| gliner2 Python runtime | 2.0.0, hashed in gliner-requirements.lock | Apache-2.0 |
| PyTorch, Transformers, NumPy, Safetensors, PEFT | Pinned in the two requirements locks | BSD-3-Clause / Apache-2.0; notices in wheel metadata |
Model files are downloaded on demand, with sizes and SHA-256 hashes in
decision-models.json;
no payload is committed. See
discovery notices.
Web tools (optional)
Section titled “Web tools (optional)”| Component | Version / source | License and retained information |
|---|---|---|
| SearXNG | revision 2e624bed40eb97b46faa98094a0b74d3ececd93d |
AGPL-3.0-or-later; corresponding source and LICENSE retained in each installed search runtime |
| Scrapling | 0.4.15 | BSD-3-Clause |
| Patchright browser runtime | 1.63.0; Chromium 153.0.8010.12 (Patchright revision 1243) | Apache-2.0 driver and browser notices retained in the scrape runtime; archives pinned in scrapling-browser-artifacts.json |
| Python dependencies | Hash-locked requirements | Installed-wheel inventory |
SearXNG’s corresponding source must accompany any distributed search runtime or network-service deployment. See web-tool provenance.
Lysis REA toolkit (optional)
Section titled “Lysis REA toolkit (optional)”| Component | Version / source | License and retained information |
|---|---|---|
REA (rea-agents) |
6.3.0, locked by rea-package-lock.json | MIT; dependency licenses listed in REA runtime provenance |
| Node.js (REA runtime) | 24.21.0, per-platform SHA-256 in rea-node-release.json | MIT plus bundled notices; its LICENSE stays in the private runtime |
External analysis engines (Ghidra, Hopper, IDA, JADX) have their own licenses and are not installed by this step.
Release obligations
Section titled “Release obligations”- Preserve copyright, license and NOTICE text in redistributed artifacts.
- Review the exact target-platform package, including transitive and native components, and refresh its SBOM and notices.
- Keep each asset’s origin, version, hash and license together.
- Do not claim development-only dependencies are absent without inspecting the artifact.
Related
Section titled “Related”- Releases · Third-party notices
Decisions behind this page: 0244, 0286 — see the decisions index.