baketnk--frame-yap/docs/third-party.md

Dependency provenance and release boundary

FrameYap's original code is MIT licensed, as selected by the project owner. This does not relicense external models, fonts, protocols or runtimes. There is no dependency on another application's checkout, assets or environment.

Included source

protocol/gamescope-input-method.xml is the unmodified public Gamescope 3.16.28 protocol, downloaded from https://github.com/ValveSoftware/gamescope/blob/3.16.28/protocol/gamescope-input-method.xml. SHA-256: da35711f5d1d750bc47931132a89bf34e6b96a72bafc054d34092d3f42358ec4. Its embedded permissive copyright/license notice is preserved. Generated bindings are build outputs, not hand-written wire encoding. The private protocol may change with SteamOS; compatibility must be rechecked.

Frame controller bindings were authored here using the observed public input profile names (frame_controller, /input/grip, click); no SteamVR driver code, images, protected kernels or another application's assets were extracted for these bindings.

Bundled font and UI reference

assets/fonts/Inconsolata-Regular.ttf is an unmodified copy of the typeface used by kouseki's editor and VR canvas, extracted from its assets/fonts directory at checkout revision 738569f4c41ff4c8fc9edd5bfff9c861957ea39e. SHA-256: e0267abf9d734e2b9f766f8cb7a496b552c57cdfeacfa0efdc5bfd21940ae145. Copyright 2006 The Inconsolata Project Authors; SIL Open Font License 1.1, retained in assets/fonts/OFL-Inconsolata.txt (line endings and trailing whitespace normalized; license text unchanged). The reviewed OFL permits bundling and redistribution with its copyright/license notice; the font remains OFL, not MIT, and is not sold by itself. Upstream: https://github.com/googlefonts/Inconsolata. The TTF is unchanged. No MSDF atlas, icons, engine code or renderer dependencies were copied. Unicode coverage is finite; missing glyphs use the face's notdef glyph.

Visual references: kouseki's apps/vr_workspace/hud.cpp (rounded mint-to-blue perimeter and curved accent) and menu_tablet.hpp (dark cards, highlighted selection). FrameYap implements those design ideas independently on a single CPU RGBA surface. Building, installing and running require no kouseki checkout. CMake installs the font and OFL with assets; native staging defaults to that font, places the launcher copy at fonts/font.ttf, and includes its license in THIRD_PARTY_NOTICES.txt. Custom staging fonts still require an explicit license.

Explicit native build inputs (not vendored)

• Valve OpenVR SDK v2.15.6: BSD-3-Clause-style license, copyright Valve 2015; retain its LICENSE with redistributed loader binaries.
• SDL3: zlib license; device trial used SDL 3.2.16 built in a private user prefix.
• Wayland client and scanner: retain upstream MIT-style notices.
• libxcb (X11 protocol client): MIT-style license; used only by the opt-in Xwayland focus observer. Include it in native runtime dependency checks; no X server is started by normal operation.
• FreeType: choose and comply with its applicable FTL/GPL licensing option.
• Optional font override: the earlier device check used system Hack Regular. A custom release font must include its own license and assessed glyph coverage; new builds default to the bundled Inconsolata described above.
• Compiler runtime, libc minimum and transitive shared libraries require a release dependency audit. Passing a developer build is not a portable-runtime guarantee.

Redux weights and proprietary runtime are different

Public model: https://huggingface.co/moondream/parakeet-redux, exact revision fad622f25f303105c20d70e201bcc477c88b620c, model card CC-BY-4.0. Attribution: Moondream/M87 Labs, Parakeet Redux, derived from NVIDIA Parakeet TDT 0.6B v3. No modifications to the supplied weights are made. Exact model/config/tokenizer sizes and SHA-256 hashes are recorded in python/frameyap/model_files.py. fetch-model.py fetches and retains the original model card alongside the files. No weights are committed to this repository.

The inspected kestrel-kernels==0.7.0 wheel license identifies it as proprietary M87 Labs software and says use requires a separate written agreement. Copying and redistribution are restricted by that agreement. This includes its protected CPU payload, not just CUDA. The Python wrapper and model card do not override those terms. No attempt was made to unpack/decrypt/reverse-engineer protected kernels.

Release blocker: permission covering use and redistribution has not been established here. The initial on-device compatibility measurements preceded this license review; further inference/bundling was paused when the issue was found. The acquired packages remain isolated under the device's project-owned development directory, not in Git or a published artifact. Do not advertise the GitHub runtime bundle as available or automatically download/install those packages for end users. Resolve permission with the vendor, or separately scope an independently licensed runtime for the same weights. Do not silently substitute a dense/heavier model.

Other runtime packages (Torch CPU, numpy, tokenizer/native extensions, etc.) also need their own notice/license inventory before publication. The public model's small size is neither total runtime size nor redistribution permission.

CPU trial dependency choice

Trial interface pins: moondream 2.4.0, kestrel 0.8.0, kernels 0.7.0, native 0.1.8, Python 3.12.3, Torch 2.8.0+cpu on ARM64. An unqualified moondream install initially resolved a CUDA-enabled Torch and NVIDIA wheels; these were replaced/removed from the owned venv before measurement. The measured Torch reported torch.version.cuda is None. Do not repeat an unconstrained pip install moondream as a CPU setup recipe.

For eventual packaging research, a standalone CPython 3.12.14 ARM64 distribution was downloaded but not bundled with the proprietary runtime: https://github.com/astral-sh/python-build-standalone/releases/tag/20260901, cpython-3.12.14+20260901-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz, SHA-256 577b4bec0793ad1ff0cbff9adbd0df078eddde38a4c41bf5d83ad381a85ee39d. Its included licenses and compatible native dependencies still require review before any release. No public prebuilt FrameYap release has been published.