{
  "schemaVersion": 1,
  "complianceStatus": "local-custody-and-private-package-verified; public-distribution-review-pending",
  "components": [
    {
      "name": "protobuf",
      "version": "21.12",
      "license": "BSD-3-Clause",
      "sourceUrl": "https://github.com/protocolbuffers/protobuf/tree/v21.12",
      "sourceLicenseFile": ".build/native/External/protobuf/src/LICENSE",
      "bundledLicenseFile": "legal/dependencies/protobuf-21.12/LICENSE",
      "sha256": "6e5e117324afd944dcf67f36cf329843bc1a92229a8cd9bb573d7a83130fea7d",
      "usage": "proof-runtime",
      "modified": false
    },
    {
      "name": "Eigen",
      "version": "5.0.1",
      "license": "MPL-2.0",
      "sourceUrl": "https://gitlab.com/libeigen/eigen/-/tree/5.0.1",
      "sourceLicenseFile": ".build/native/External/Eigen3/src/LICENSE",
      "bundledLicenseFile": "legal/dependencies/eigen-5.0.1/LICENSE",
      "sha256": "1f256ecad192880510e84ad60474eab7589218784b9a50bc7ceee34c2b91f1d5",
      "usage": "proof-runtime",
      "modified": false
    },
    {
      "name": "Eigen COPYING.README",
      "version": "5.0.1",
      "license": "license-index",
      "sourceUrl": "https://gitlab.com/libeigen/eigen/-/tree/5.0.1",
      "sourceLicenseFile": ".build/native/External/Eigen3/src/COPYING.README",
      "bundledLicenseFile": "legal/dependencies/eigen-5.0.1/COPYING.README",
      "sha256": "db640ff2bd90c6abd6a4d3fbb351e0ee4d555417cf840492054d1cbb2ea85644",
      "usage": "proof-runtime",
      "modified": false
    },
    {
      "name": "emsdk",
      "version": "fdcf56c75a1d27fdff6525a7e03423595485ca19",
      "license": "MIT",
      "sourceUrl": "https://github.com/emscripten-core/emsdk",
      "sourceLicenseFile": ".toolchains/emsdk/LICENSE",
      "bundledLicenseFile": "legal/dependencies/emsdk/LICENSE",
      "sha256": "99d9a9616fbde3f5ee22a71d8645799a8522d48526130c5ba6dc27ad15ce01f1",
      "usage": "build-tool-only",
      "modified": false
    },
    {
      "name": "Emscripten",
      "version": "3.1.65",
      "license": "MIT OR NCSA",
      "sourceUrl": "https://github.com/emscripten-core/emscripten/tree/3.1.65",
      "sourceLicenseFile": ".toolchains/emsdk/upstream/emscripten/LICENSE",
      "bundledLicenseFile": "legal/dependencies/emscripten-3.1.65/LICENSE",
      "sha256": "620a78084fc7ca97c0b5dea9abf891f3ffcadfdbf305276f099c9c4e12fc1d86",
      "usage": "generated-js-runtime-and-build-tool",
      "modified": false
    },
    {
      "name": "libc++",
      "version": "3.1.65 toolchain",
      "license": "Apache-2.0 WITH LLVM-exception and legacy notices",
      "sourceUrl": "https://github.com/emscripten-core/emscripten/tree/3.1.65/system/lib/libcxx",
      "sourceLicenseFile": ".toolchains/emsdk/upstream/emscripten/system/lib/libcxx/LICENSE.TXT",
      "bundledLicenseFile": "legal/dependencies/emscripten-3.1.65/libcxx-LICENSE.TXT",
      "sha256": "539dd7aed86e8a4f12cbdd0e6c50c189c7d74847e4fecc64ce2c6ee3a01da38b",
      "usage": "wasm-runtime; final link map confirms archive",
      "modified": false
    },
    {
      "name": "libc++abi",
      "version": "3.1.65 toolchain",
      "license": "Apache-2.0 WITH LLVM-exception and legacy notices",
      "sourceUrl": "https://github.com/emscripten-core/emscripten/tree/3.1.65/system/lib/libcxxabi",
      "sourceLicenseFile": ".toolchains/emsdk/upstream/emscripten/system/lib/libcxxabi/LICENSE.TXT",
      "bundledLicenseFile": "legal/dependencies/emscripten-3.1.65/libcxxabi-LICENSE.TXT",
      "sha256": "e2b35be49f7284a45b7baca8fc7b3ab7440e7902392b2528a457816b5bb2a15c",
      "usage": "wasm-runtime; final link map confirms archive",
      "modified": false
    },
    {
      "name": "compiler-rt",
      "version": "3.1.65 toolchain",
      "license": "Apache-2.0 WITH LLVM-exception and legacy notices",
      "sourceUrl": "https://github.com/emscripten-core/emscripten/tree/3.1.65/system/lib/compiler-rt",
      "sourceLicenseFile": ".toolchains/emsdk/upstream/emscripten/system/lib/compiler-rt/LICENSE.TXT",
      "bundledLicenseFile": "legal/dependencies/emscripten-3.1.65/compiler-rt-LICENSE.TXT",
      "sha256": "1a8f1058753f1ba890de984e48f0242a3a5c29a6a8f2ed9fd813f36985387e8d",
      "usage": "wasm-runtime; final link map confirms libcompiler_rt.a",
      "modified": false
    },
    {
      "name": "musl libc",
      "version": "3.1.65 toolchain",
      "license": "MIT and per-file exceptions in COPYRIGHT",
      "sourceUrl": "https://github.com/emscripten-core/emscripten/tree/3.1.65/system/lib/libc/musl",
      "sourceLicenseFile": ".toolchains/emsdk/upstream/emscripten/system/lib/libc/musl/COPYRIGHT",
      "bundledLicenseFile": "legal/dependencies/emscripten-3.1.65/musl-COPYRIGHT",
      "sha256": "f9bc4423732350eb0b3f7ed7e91d530298476f8fec0c6c427a1c04ade22655af",
      "usage": "wasm-runtime; final link map confirms archive; canonical native CLI arithmetic reference uses unchanged 38-source subset",
      "modified": false,
      "nativeReference": {
        "status": "canonical-cli-promoted-after-actual355-and48forward-gates; public-distribution-review-pending",
        "sourceManifest": "spike/native/math/source-manifest.json",
        "sourceArchive": "legal/dependencies/emscripten-3.1.65/musl-math-source.tar.gz",
        "sourceArchiveSha256": "36629c0e81313ef49542ada22742f05d808f64098ebd6c1d314ea3e1770acb95",
        "unchangedOriginalFiles": 52,
        "originalMathTranslationUnits": 38,
        "privateAdapter": "spike/native/math/darwin-exp10.c",
        "privateAdaptersSeparateFromOriginalSources": true,
        "qualification": "web/lab/evidence/engine-aligned-math-4b819fd9/qualification.json",
        "qualifiedNativeBinarySha256": "4b819fd94159600e92280cbdc3917cc96c9dc751597aa447361f66150cc69c73"
      }
    },
    {
      "name": "Public Sans",
      "version": "local Vitrum asset snapshot",
      "license": "OFL-1.1 + CC0-GSA-modifications",
      "sourceUrl": "https://github.com/uswds/public-sans",
      "sourceLicenseFile": "assets/fonts/OFL-public-sans.txt",
      "bundledLicenseFile": "legal/fonts/OFL-public-sans.txt",
      "sha256": "82f0d3cad45f264192db156360b4a710fe7060885f6aa261e6539f13cb9eb0d9",
      "usage": "gallery-runtime",
      "modified": false
    },
    {
      "name": "IBM Plex Mono",
      "version": "local Vitrum asset snapshot",
      "license": "OFL-1.1",
      "sourceUrl": "https://github.com/IBM/plex",
      "sourceLicenseFile": "assets/fonts/OFL-ibm-plex-mono.txt",
      "bundledLicenseFile": "legal/fonts/OFL-ibm-plex-mono.txt",
      "sha256": "7e6b2818edbd8f6a01ae80641cc8f16a51080d08fb4e532be3a0b6f74adb07da",
      "usage": "gallery-runtime",
      "modified": false
    },
    {
      "name": "Eigen COPYING.BSD",
      "version": "5.0.1",
      "license": "per-file license; retained conservatively",
      "sourceUrl": "https://gitlab.com/libeigen/eigen/-/tree/5.0.1",
      "sourceLicenseFile": ".build/native/External/Eigen3/src/COPYING.BSD",
      "bundledLicenseFile": "legal/dependencies/eigen-5.0.1/COPYING.BSD",
      "sha256": "51928dce36213c5333ba3172e847d735d4c6e9b7ff2722a326c49067155b82eb",
      "usage": "retained-dependency-notices",
      "modified": false
    },
    {
      "name": "Eigen COPYING.APACHE",
      "version": "5.0.1",
      "license": "per-file license; retained conservatively",
      "sourceUrl": "https://gitlab.com/libeigen/eigen/-/tree/5.0.1",
      "sourceLicenseFile": ".build/native/External/Eigen3/src/COPYING.APACHE",
      "bundledLicenseFile": "legal/dependencies/eigen-5.0.1/COPYING.APACHE",
      "sha256": "03379001a7b12a2ec997a25554247d985270b353c10d5bafee9ac8d6519820b7",
      "usage": "retained-dependency-notices",
      "modified": false
    },
    {
      "name": "Eigen COPYING.MPL2",
      "version": "5.0.1",
      "license": "per-file license; retained conservatively",
      "sourceUrl": "https://gitlab.com/libeigen/eigen/-/tree/5.0.1",
      "sourceLicenseFile": ".build/native/External/Eigen3/src/COPYING.MPL2",
      "bundledLicenseFile": "legal/dependencies/eigen-5.0.1/COPYING.MPL2",
      "sha256": "66a3107d5ad6a058aab753eaac2047ccb2ed0e39465dd0fe5844da3e300d5172",
      "usage": "retained-dependency-notices",
      "modified": false
    },
    {
      "name": "Eigen COPYING.MINPACK",
      "version": "5.0.1",
      "license": "per-file license; retained conservatively",
      "sourceUrl": "https://gitlab.com/libeigen/eigen/-/tree/5.0.1",
      "sourceLicenseFile": ".build/native/External/Eigen3/src/COPYING.MINPACK",
      "bundledLicenseFile": "legal/dependencies/eigen-5.0.1/COPYING.MINPACK",
      "sha256": "c87b7f8ee88f6195e91743820c00354833583aef091b72e2d4a49c8e28e798a0",
      "usage": "retained-dependency-notices",
      "modified": false
    },
    {
      "name": "Pulse Explorer",
      "version": "3.2.0",
      "commit": "a12bbccc80e4fb183a8f45280e875946359e4411",
      "license": "Apache-2.0",
      "sourceUrl": "https://gitlab.kitware.com/physiology/explorer/-/tree/a12bbccc80e4fb183a8f45280e875946359e4411",
      "bundledLicenseFile": "legal/explorer/LICENSE",
      "bundledNoticeFile": "legal/explorer/NOTICE",
      "sha256": "43070e2d4e532684de521b885f385d0841030efa2b1a20bafb76133a5e1379c1",
      "usage": "source-reference-only; Qt UI not ported or shipped",
      "modified": false
    },
    {
      "name": "Pulse Engine",
      "version": "4.4.0",
      "commit": "5e29e5b13710a08cec90874be7d36ecb192ebcda",
      "license": "Apache-2.0",
      "sourceUrl": "https://gitlab.kitware.com/physiology/engine/-/tree/5e29e5b13710a08cec90874be7d36ecb192ebcda",
      "bundledLicenseFile": "legal/engine/LICENSE",
      "bundledNoticeFile": "legal/engine/NOTICE",
      "sha256": "43070e2d4e532684de521b885f385d0841030efa2b1a20bafb76133a5e1379c1",
      "usage": "proof-runtime; compiled natively and for WASM",
      "modified": false
    },
    {
      "name": "dlmalloc",
      "version": "2.8.6 in Emscripten3.1.65",
      "license": "Public domain Doug Lea origin; Emscripten changes under Emscripten LICENSE",
      "sourceUrl": "https://github.com/emscripten-core/emscripten/blob/3.1.65/system/lib/dlmalloc.c",
      "sourceNoticeFile": ".toolchains/emsdk/upstream/emscripten/system/lib/dlmalloc.c",
      "bundledLicenseFile": "legal/dependencies/emscripten-3.1.65/dlmalloc-NOTICE",
      "sha256": "e3325f87977501d63ad447abf7fa9d581d115781e60058946b418074b075148e",
      "usage": "wasm-runtime; final link map confirms libdlmalloc.a",
      "modified": false,
      "copyStatus": "verbatim upstream public-domain notice excerpt; Emscripten licence retained separately"
    },
    {
      "name": "Pulse StandardMale runtime patient dataset",
      "version": "4.4.0",
      "commit": "5e29e5b13710a08cec90874be7d36ecb192ebcda",
      "license": "Apache-2.0",
      "sourceUrl": "https://gitlab.kitware.com/physiology/engine/-/tree/5e29e5b13710a08cec90874be7d36ecb192ebcda",
      "sourceLicenseFile": ".upstream/engine/LICENSE",
      "bundledLicenseFile": "legal/engine/LICENSE",
      "bundledNoticeFile": "legal/engine/NOTICE",
      "sha256": "43070e2d4e532684de521b885f385d0841030efa2b1a20bafb76133a5e1379c1",
      "noticeSha256": "99a17dceaadffd6687113bddd8fbda9051dd8b74fac0b88548edbc3a09665de6",
      "usage": "application-runtime; official reference patient embedded for synthetic educational investigation",
      "modified": false,
      "datasetOrigin": {
        "sourceFile": ".build/native/install/bin/patients/StandardMale.json",
        "runtimePath": "patients/StandardMale.json",
        "sha256": "df99d070d06ae3b7f81e863e991499eabbe092f7c72c884146f293bf4c87eaa2",
        "producer": "Official Pulse 4.4.0 DataSetReader/runtime dataset; pinned engine build"
      },
      "generatedArtifact": {
        "file": "web/lab/modules/investigation-patient.js",
        "sha256": "244917260cd559f7ebe3f295ddca2ddc42911917e485bf7823d2f829a1942a6f",
        "generator": "scripts/generate-investigation-patient.py",
        "transformation": "JSON to JavaScript module; original patient values unchanged",
        "patientValuesChanged": false,
        "headerIdentifiesOriginAndLicense": true
      }
    }
  ],
  "assets": [
    {
      "file": "assets/fonts/public-sans-normal-400-latin.woff2",
      "sha256": "5ed4d31c988e73b258894244f209069ebe77dc7e564861954b21198b6de90d68",
      "usage": "gallery-runtime",
      "licenseEvidence": "legal/fonts/",
      "modified": false
    },
    {
      "file": "assets/fonts/public-sans-normal-600-latin.woff2",
      "sha256": "5ed4d31c988e73b258894244f209069ebe77dc7e564861954b21198b6de90d68",
      "usage": "gallery-runtime",
      "licenseEvidence": "legal/fonts/",
      "modified": false
    },
    {
      "file": "assets/fonts/ibm-plex-mono-normal-400-latin.woff2",
      "sha256": "08949f728dc52d528e69b1667d15c89a5686a4ee9a296ff90983985f99c380f7",
      "usage": "gallery-runtime",
      "licenseEvidence": "legal/fonts/",
      "modified": false
    },
    {
      "file": "assets/references/vitrum-logo-light.svg",
      "sha256": "72f97684164e8a0b4ebbd8b9fcd0808288d1557a994ca2370a13cfd5a40476d1",
      "usage": "gallery-runtime",
      "licenseEvidence": "user-supplied/user-owned asset; notApache",
      "modified": false
    },
    {
      "file": "assets/references/explorer-monitor.png",
      "sha256": "27593f1d2b60c9da3b08988a0189594cc722f03c1779ae2102bbb2eb69314560",
      "usage": "visual-reference-only",
      "licenseEvidence": "user-supplied/user-owned asset; notApache",
      "modified": false
    },
    {
      "file": "assets/references/explorer-ventilator.png",
      "sha256": "2bf72168406ae8c0c415829887dcd972ec2dadc8477354091b2d87737fc4026b",
      "usage": "visual-reference-only",
      "licenseEvidence": "user-supplied/user-owned asset; notApache",
      "modified": false
    },
    {
      "file": "assets/references/vitrum-logo-dark.svg",
      "sha256": "852d4756812c3e904ceb7b2120e589d3af95e0525120c33b8d7460ace4e3664f",
      "usage": "gallery-and-prototype-runtime",
      "licenseEvidence": "user-owned official Vitrum brand asset; not Apache",
      "modified": false
    },
    {
      "file": "assets/brand/vitrum-explorer-light.svg",
      "sha256": "dcb7195f7bd72377db55b4420bd86c4ba05ca7f32919ceef878022555dd9d25e",
      "usage": "application-runtime",
      "licenseEvidence": "Vitrum-owned original paths plus Public Sans 600 outlined under its preserved font license",
      "modified": true,
      "provenance": "assets/brand/provenance.json",
      "generator": "scripts/build-explorer-brand.py"
    },
    {
      "file": "assets/brand/vitrum-explorer-dark.svg",
      "sha256": "1b5cff457b0ca5c5672be35ae38b6f510d20d168cc0a884b78b8c4ea5d239758",
      "usage": "application-runtime",
      "licenseEvidence": "Vitrum-owned original paths plus Public Sans 600 outlined under its preserved font license",
      "modified": true,
      "provenance": "assets/brand/provenance.json",
      "generator": "scripts/build-explorer-brand.py"
    },
    {
      "file": "web/lab/modules/investigation-patient.js",
      "sha256": "244917260cd559f7ebe3f295ddca2ddc42911917e485bf7823d2f829a1942a6f",
      "usage": "application-runtime; synthetic investigation reference patient",
      "licenseEvidence": "Apache-2.0; legal/engine/LICENSE and legal/engine/NOTICE retained; source dataset recorded in components",
      "modified": true,
      "modificationScope": "Generated JavaScript wrapper; original runtime patient values unchanged",
      "generator": "scripts/generate-investigation-patient.py",
      "sourceFile": ".build/native/install/bin/patients/StandardMale.json",
      "sourceSha256": "df99d070d06ae3b7f81e863e991499eabbe092f7c72c884146f293bf4c87eaa2",
      "engineSha": "5e29e5b13710a08cec90874be7d36ecb192ebcda"
    },
    {
      "file": "legal/dependencies/emscripten-3.1.65/musl-math-source.tar.gz",
      "sha256": "36629c0e81313ef49542ada22742f05d808f64098ebd6c1d314ea3e1770acb95",
      "usage": "corresponding unchanged math source subset for isolated native reference; notices retained in each file",
      "licenseEvidence": "legal/dependencies/emscripten-3.1.65/musl-COPYRIGHT plus original per-file permissive notices",
      "modified": false,
      "sourceManifest": "spike/native/math/source-manifest.json"
    }
  ],
  "excludedFromRuntime": [
    "Qt5.15.2",
    "Qwt6.1.5",
    "Explorer Anatomography data/*.vtp CC-BY-SA-2.1-JP",
    "Abseil",
    "pybind11"
  ],
  "buildToolsOnly": [
    "emsdk",
    "CMake",
    "Ninja",
    "Clang",
    "Temurin JDK21.0.12.1+1",
    "Emscripten compiler",
    "Python",
    "Node"
  ],
  "remainingReview": [
    "Audit future dependencies and imported runtime/clinical example datasets",
    "Human assessment of ownership/trademark terms before public release"
  ],
  "wasmLinkEvidence": {
    "file": "spike/wasm/evidence/build.json",
    "archives": [
      "libPulse.a",
      "libprotobuf.a",
      "libc++.a",
      "libc++abi.a",
      "libc.a",
      "libcompiler_rt.a",
      "libdlmalloc.a",
      "libnoexit.a",
      "libstubs.a"
    ],
    "additionalLicenceCoverage": "libnoexit.a and libstubs.a are Emscripten runtime covered by retained Emscripten LICENSE"
  },
  "packagingEvidence": {
    "builder": "scripts/build-release.mjs",
    "verification": "web/lab/evidence/distribution-qa.json",
    "manifestPointer": ".release/latest.json",
    "licenses": "Each private candidate contains original licenses and notices, fonts, SDK runtime licenses, and an About/licenses page.",
    "correspondingEigenSource": "Every candidate contains legal/dependencies/eigen-5.0.1/eigen-5.0.1-source.tar.gz built from the exact unmodified local build dependency.",
    "published": false
  }
}