@andorra-labs/code 0.0.0-stage → 0.1.5

package/docs/superpowers/specs/2026-11-01-jev-node-opt-in-design.md

@@ -0,0 +1,164 @@
+# Jev node opt-in, composer toggle, and account requirement
+
+Date: 2026-11-01
+Status: approved design, pending implementation plan
+
+## Problem
+
+Today the installation-wide Jev switch (`config.jevEnabled`, set by `/jev on|off` and by the desktop's
+"Configure decisions" dialog) is the main control, and a node's own `jevEnabled` setting can only opt
+*out*:
+
+- An Agent node with no `jevEnabled` setting uses Jev (`src/graph-runner.ts`, `node.jevEnabled === false`
+  is the only check).
+- A node's opt-out is honoured only for signed-in paid accounts (`decisionNodeOverrides` in
+  `src/decision/hostedPolicy.ts`); free accounts ignore node settings entirely.
+- A configured local decision service (Laya or Jev at a user endpoint) runs without any account.
+- The desktop has no per-run control: the bundled "Default" preset (the single-node Software Engineer
+  graph) cannot be saved, so its node setting cannot be changed, and the only alternative is the
+  installation-wide switch buried in Settings.
+- `/jev` is refused during a CLI run ("unavailable during a run").
+
+## Goals
+
+1. **Per-node opt-in.** A node uses Jev only when it explicitly enables it. With nodes A (Jev on),
+   B and C (no setting), turning Jev on lets only A use it; turning Jev off lets no node use it.
+2. **Composer toggle.** A boolean Jev switch in the desktop chat composer.
+3. **Mid-run notice.** Flipping the switch during a run saves it immediately and says it applies once
+   the current run ends or is interrupted.
+4. **Account required.** A user who is not signed in gets no Jev of any kind, hosted or local.
+
+## Non-goals
+
+- Changing the hosted quota, the decision engine, or decision routing modes.
+- Rewriting saved graph snapshots.
+- A per-session Jev setting distinct from the installation-wide switch.
+- Changing the telemetry `jevEnabled` field, which keeps reporting the switch.
+
+## Design
+
+### 1. Effective rule
+
+An Agent node runs with an active decision manager only when all of these hold:
+
+| Condition | Source |
+|---|---|
+| Signed in | `membership.subject` |
+| Switch on | `config.jevEnabled !== false` |
+| Node opted in | `node.jevEnabled === true` |
+| A decision service is configured or hosted access applies | existing `hostedDecisionPolicy` resolution |
+
+Everything else runs with `{ mode: 'off', provider: 'none' }`.
+
+Changes:
+
+- **`src/decision/hostedPolicy.ts`** — a new pure `resolveDecisionConfig` returns an off configuration
+  when `!enabled || !membership.subject`, before it considers a local `decisions` configuration. This
+  closes the account-less local path. `hostedDecisionPolicy` uses it and returns
+  `decisionNodeOptIn: true` in place of the paid-only `decisionNodeOverrides`.
+- **`src/graph-runner.ts`** — under `decisionNodeOptIn`, a node gets the run's manager only when
+  `node.jevEnabled === true`, with no plan condition. `GraphRunOptions.decisionNodeOverrides` is
+  renamed `decisionNodeOptIn` (`src/runtime.ts`). A direct `runGraph` caller that passes no flag keeps
+  giving every node the manager it supplied; every production run site goes through the policy, so the
+  flag is always set there. This keeps the ~40 decision tests that drive `runGraph` directly valid.
+- **`src/subagent-run.ts`** — the external subagent run builds its `DecisionManager` from
+  `config.decisions` directly, without a sign-in check. A new `subagentDecisionConfig` keeps its
+  existing service selection (it never defaulted to hosted Jev) and adds only the account requirement,
+  asking for membership only when decisions would otherwise be on.
+- Callers (`src/cli.ts`, `src/app-server.ts`, `src/browser-runner.ts`) keep spreading
+  `hostedDecisionPolicy(...)` and pick up `decisionNodeOptIn` with no edit.
+
+Free and paid signed-in accounts are treated alike: node opt-in applies to both.
+
+### 2. Bundled presets opt in
+
+Presets cannot be edited, so they ship opted in, and the switch is their control:
+
+- `SOFTWARE_ENGINEER_HARNESS` (`src/membership.ts`, the desktop's single-node "Default") — set
+  `jevEnabled: true` on `engineer` in place. It has no frozen-revision convention: the app server
+  already serves its current definition for its one revision. Bumping it to revision 2 is avoided
+  because the `default` id's revision lookup is shared with `DEFAULT_HARNESS`'s frozen revisions
+  (`getGraph('default', 2)` would become ambiguous).
+- The Andorra preset — `getAndorraHarness()` sets `jevEnabled: true` on every Agent node of the copy it
+  builds from `DEFAULT_HARNESS`.
+- `DEFAULT_HARNESS` and its frozen revisions are not touched. They are the Graph Studio template and
+  resume snapshots; a duplicate of the template starts unticked like any new node.
+
+A resume pinned to a frozen `default` revision carries no node setting and so runs without Jev. That
+is accepted: the revision describes what it always described.
+
+### 3. Saved user graphs
+
+Nodes in graphs users already saved carry no setting and therefore stop using Jev. Snapshots are not
+rewritten. Graph Studio makes this visible:
+
+- **`src/graph-ui/app.js`** — the per-node "Jev decisions" checkbox reads `node.jevEnabled === true`
+  (unticked when unset). Ticking writes `true`; unticking deletes the key, so an unticked node and an
+  old node serialize identically. The help text becomes: "Off unless ticked. When Jev is on, it assists
+  this agent with routing decisions. Requires sign-in; quota and runtime permissions apply."
+- The client-side validation at `app.js:243` and server validation at `src/graphs.ts:476` are unchanged
+  (boolean on Agent nodes).
+
+### 4. CLI `/jev`
+
+- **`src/commands.ts`** — status and confirmation text describe the new rule:
+  `Jev: enabled (saved preference). Applies to nodes with Jev turned on. Requires sign-in and available
+  quota.` The free/paid wording about node settings is removed.
+- **`src/cli.ts`** — `/jev` joins the in-run command allowlist. During a run it saves the switch and
+  prints `Jev <on|off> saved. The current run keeps its setting; the change applies after it ends or
+  you interrupt it.` The status-bar `jevEnabled` updates immediately to the saved value.
+- **`src/account-presentation.ts`** — the signed-in notice ("Jev decisions default to enabled when
+  signed in; use /jev to toggle.") is reworded to "Jev runs on nodes that turn it on; use /jev to
+  toggle."
+
+### 5. Desktop composer toggle
+
+A `JevToggle` component (new file `desktop/src/components/JevToggle.tsx`) rendered in the composer
+controls of both `NewTaskView.tsx` and `SessionView.tsx`, beside the model picker.
+
+- **State:** reads `config.jevEnabled` from the data store (`!== false` means on) and the account's
+  `signedIn`. Writes with `saveConfig({ jevEnabled }, { jevEnabled: config.jevEnabled ?? null })`,
+  the same call `DecisionSettings` uses, so the CLI, Settings and the composer always agree.
+- **Gated:** hidden when the host lacks the `config.decisions` capability. Disabled when signed out,
+  with the tooltip "Sign in to use Jev."
+- **Mid-run:** when `running` (the existing `SessionView` selector) is true at the moment of a change,
+  the save proceeds and the app notifies
+  `Jev <on|off> saved. The current run keeps its setting; the change applies after it ends or you
+  interrupt it.` No notice when idle.
+- **Failure:** a rejected save reverts the switch and notifies the error via `describeError`.
+- **Settings consistency:** `DecisionSettings`' "Off" source and the composer switch are the same
+  setting; Settings' row note keeps describing the decision service.
+
+### 6. Error handling
+
+- Membership lookup failure: `getMembership` already yields no `subject` on failure, so Jev is off for
+  that run; existing account notices explain why.
+- Signed out with a local decision service configured: the configuration is kept but inert; the
+  Settings row note adds "Requires sign-in." so the user is not left guessing.
+
+## Testing
+
+Automated:
+
+- `test/hosted-decision-policy.test.ts` — the rule table: signed out (with and without a local
+  service) → off; signed in + switch off → off; signed in + switch on → resolved service.
+- `test/hosted-decision-policy.test.ts` (also) — a three-node graph with A `true`, B unset, C `false`:
+  under opt-in only A uses the manager (one third of the calls a flagless run makes); free and paid
+  behave the same; the presets' Agent nodes are opted in and `DEFAULT_HARNESS` is not.
+- `test/subagent-run-decisions.test.ts` — signed out → off; decisions off → no account request.
+- `test/cli-live-control.test.ts` — `/jev` accepted mid-run with the notice and the status bar
+  updated.
+- Desktop vitest — `JevToggle`: reflects config, disabled when signed out, notice only while running,
+  revert on save failure.
+- `test/graph-ui-client-validation.test.ts` — checkbox serialization (tick writes `true`, untick
+  removes the key).
+
+QA plan: `tests/jev-node-opt-in-test-plan.md`, covering the CLI and desktop flows, signed-out,
+free, and paid accounts, mid-run toggling, presets, and saved graphs losing Jev until ticked.
+`tests/default-active-jev-test-plan.md` is updated where it asserts the old default-on behavior.
+
+## Rollout notes
+
+- Behavior change for existing users: saved custom graphs lose Jev until nodes are ticked; signed-out
+  users with a local decision service lose it until they sign in. The PR description says so.
+- `docs/reference/config.md` and `docs/getting-started/accounts.md` are updated to the new rule.

package/docs/superpowers/specs/2026-11-01-pr-section-design.md

@@ -0,0 +1,104 @@
+# Pull request section in the Plan card
+
+Status: approved 2026-11-01.
+
+## Goal
+
+After the agent opens a pull request, the session's Plan card shows a **Pull request** section with the PR's link
+(opened in the system browser) and a ⋯ menu:
+
+- Open on GitHub · Copy link
+- View changes (the PR's `/files` page)
+- ☐ Auto-fix · ☐ Merge when ready · ☐ Auto-archive on merge or close
+- Convert to draft (Mark ready when the PR is a draft)
+- Dismiss
+
+The agent can change the same settings from a prompt ("turn on auto-merge for this PR") through a `pull_request` tool.
+
+## Where the state lives
+
+One JSON file per session: `<home>/pull-requests/<sessionId>.json`.
+
+```ts
+interface SessionPullRequest {
+  url: string;              // https://github.com/<owner>/<repo>/pull/<n>
+  owner: string; repo: string; number: number;
+  title?: string;
+  state: 'open' | 'draft' | 'merged' | 'closed';
+  autoFix: boolean; mergeWhenReady: boolean; autoArchive: boolean;
+  /** Newest review-comment time Auto-fix has already handed to the agent. */
+  handledThrough?: string;
+  updatedAt: string;
+}
+```
+
+It isn't stored on `SavedSession` because a run saves the record it captured at startup when it finishes. A setting
+the agent changed mid-run would then be silently reverted, which is the reason `sessions.setArchived` is refused
+during a run. A separate file also lets the watcher engine and the session's own engine share one source of truth.
+Deleting a session deletes its file.
+
+## Engine (`src/pull-requests.ts`)
+
+- **Store:** `readPullRequest`, `writePullRequest` (atomic), `removePullRequest`, `listPullRequests`.
+- **URL parsing:** `parsePullRequestUrl(text)` returns the first `github.com/<owner>/<repo>/pull/<n>` URL.
+- **Detection:** the run's event hook remembers each `node.tool.started` whose arguments contain `gh pr create`.
+  When the matching `node.tool.completed` arrives, its output is parsed and the PR is attached to the session.
+  Attaching a URL that is already attached keeps its settings.
+- **gh actions** (`execFile('gh', …)`, nothing interpolated into a shell):
+  - Merge when ready on: `gh pr merge <url> --auto --merge`. Off: `gh pr merge <url> --disable-auto`.
+  - Convert to draft: `gh pr ready <url> --undo`. Mark ready: `gh pr ready <url>`.
+  - Refresh: `gh pr view <url> --json number,title,state,isDraft,url,autoMergeRequest`.
+  - A failed `gh` call raises an error naming the command and its stderr. The stored setting is left unchanged, so
+    the menu never shows a checkmark the PR doesn't have.
+- **Protocol** (capability `sessions.pullRequest`):
+  - `sessions.pullRequest.get {id}` returns `{ pullRequest | null }`.
+  - `sessions.pullRequest.update {id, autoFix?, mergeWhenReady?, autoArchive?, draft?}` returns `{ pullRequest }`.
+  - `sessions.pullRequest.dismiss {id}`.
+  - Event `session.pullRequest.updated {sessionId, pullRequest | null}`.
+- **Agent tool** `pull_request` (family `git`, capability `github.pull-request`, sequential), with
+  `action: 'status' | 'attach' | 'update' | 'dismiss'`, `url?`, `autoFix?`, `mergeWhenReady?`, `autoArchive?` and
+  `draft?`. It reaches the engine through `ToolContext.pullRequests`, which is bound to the run's session. Where no
+  session exists, the tool reports itself unavailable, the way `set_timer` does.
+
+## Watcher
+
+- Exactly one engine per home polls. It holds an exclusive lease (the store lock at `<home>/pull-requests/.watcher`),
+  and another engine takes the lease over only when the previous holder's pid is dead.
+- It polls every 60s, and only while some PR has `autoFix` or `autoArchive` on and is still open or draft. It
+  refreshes state with `gh pr view` and emits the update event whenever state or title changed.
+- **Auto-archive:** a PR that is now merged or closed archives its session with `sessions.setArchived` semantics.
+  A `busy` refusal means a run is active, and the archive is retried on the next poll.
+- **Auto-fix:** it reads unresolved review threads plus top-level PR comments through `gh api graphql`, and drops
+  comments written by the `gh` viewer (the agent's own replies). If any is newer than `handledThrough`, it arms a
+  1-second self-wake for the session with a fixed prompt naming the PR and how many threads are new. Comment text
+  is never put in the prompt, because it is untrusted third-party content; the agent reads it with `gh` as tool
+  output. Once the wake is armed, `handledThrough` is set to the newest comment time.
+- Auto-fix reacts to review comments only. It ignores CI failures and merge conflicts, as the user decided.
+- The watcher stops polling a PR once it's merged, closed or dismissed.
+
+## Desktop
+
+- The store keeps `pullRequests[sessionId]`, filled from `sessions.pullRequest.get` when a session opens and kept
+  current by the update event from any engine.
+- `PlanWidget` takes a `pullRequest` prop and renders a section under the subagents:
+  - a state chip;
+  - an `owner/repo#n` link with the title, which calls `openExternalUrl`;
+  - a ⋯ button that opens the menu. It closes on Escape or an outside click, and focus goes back to the button.
+- `planHasContent` counts a PR, so the card stays up after a plan is cleared.
+- Each checkbox calls `sessions.pullRequest.update` and shows a pending state while the call runs. An error goes
+  to `notify('error', …)`.
+
+## Limits
+
+- Polling happens only while some engine with this home is running; with the app closed, nothing polls.
+- Providers that run an external agent CLI (Claude, Codex) don't see the `pull_request` tool. Detection from shell
+  output still covers PRs created through the built-in shell tools.
+- Merge when ready uses a merge commit (`--merge`).
+
+## Testing
+
+- **Unit tests:** URL parsing, detection from a tool start/complete pair, the store, the tool with a fake
+  controller, the watcher with an injected `gh` runner (archive on merge, a wake on a new foreign comment, no wake
+  for the viewer's own comment) and the `PlanWidget` markup.
+- **QA plan:** `tests/pr-section-test-plan.md`.
+- **Run verification:** drive the built desktop dev app over CDP against a throwaway PR.

package/docs/superpowers/specs/2026-11-02-workflow-pane-design.md

@@ -0,0 +1,130 @@
+# Workflow visualizer and pane
+
+Status: approved 2026-11-02.
+
+## Goal
+
+The session's plan card becomes a live workflow visualizer that a person can follow while a run works: the graph
+node visits in order, each with the subagents it started nested under it, and the plan checklist below them. The
+card can be expanded into a right-side pane, the same slot the browser uses, with an animation that grows the card
+into the pane. Only one of the two panes is open at a time.
+
+Agents are drawn without avatars or per-agent colours: a monochrome status glyph, a name, a duration and a status
+word.
+
+## What the visualizer shows
+
+One component, `WorkflowView`, renders in two sizes: `card` (the docked card) and `pane` (the expanded pane).
+
+- **Phases are node visits, in start order.** Each is a row on a vertical timeline: a status dot (pulsing while
+  the visit works, filled once it completes, hollow when the run ended without it completing), the node's display
+  name, the count of its subagents that finished out of all it started (`3/51`), its duration, and a chevron that
+  folds its agents away. A visit with no subagents has no count and no chevron.
+- **Subagents nest under the visit that started them.** Each row: a glyph (spinner while running, ✓ succeeded,
+  ✕ failed, ■ stopped), the readable name (`File analyzer 3`, from `subagentLabels`), the duration, and the
+  status word (`subagentStatusLabel`). Activating a row opens that subagent's transcript view, as the card does
+  today.
+- **Long lists fold.** A visit with more than six subagents shows the first five and folds the rest into an
+  `N more` row that also says how many of them are running. Opening it lists the rest: one column in the card, a
+  two-column grid in the pane.
+- **Subagents with no visit** (a start event without a node, or a node the run never reported starting) are
+  listed in a final `Other agents` group, so none is ever dropped.
+- **The plan checklist is a separate list below the phases**, followed by the graph's widgets and the pull
+  request section, as the card has them today.
+- A run with no visits and no subagents (an engine that reports neither) shows the checklist alone, as today.
+- The card docks when the run has a checklist, widgets, subagents or a pull request, as today, and also once the
+  run has visited more than one node. A single-node run with nothing else to show keeps the whole column.
+
+Running durations tick once a second while the run is live; a stopped subagent or visit with no end time shows
+no duration.
+
+## Card to pane
+
+- The card's header gains an **Expand** button (`PanelRightOpen`). It is offered only when the session has a
+  pane scope (`browserKey`), the same condition the Browser button has.
+- Expanding records the card's on-screen rectangle, opens the workflow pane, and hides the card. When the pane
+  mounts it draws a *morph box*: a fixed-position element with the card's surface, border and radius that animates
+  from the card's rectangle to the pane's (about 220 ms, standard easing). The pane's content fades in as the box
+  finishes, and the box is removed.
+- The pane's header has the title **Workflow**, the overall progress, and a **Collapse** button
+  (`PanelRightClose`). Collapsing records the pane's rectangle, closes the pane, and the card, when it mounts again,
+  runs the same morph in reverse into its own rectangle.
+- A morph whose target never mounts (the card is too small for the conversation, or the session changed) is
+  dropped on the next frame rather than waiting.
+- `prefers-reduced-motion: reduce` switches instantly with no morph.
+- The pane uses the browser's divider: drag and arrow keys resize it, within the same limits
+  (`browserWidthLimits`). It remembers its width per session, starting at 420 px.
+
+## One pane at a time
+
+The browser and the workflow pane share the right-hand slot. The pane state per session scope gains
+`workflow: boolean` and `workflowWidth: number` beside `expanded`, in the same persisted store, so every action
+keeps the invariant in one update:
+
+| Action | Browser (`expanded`) | Workflow |
+|---|---|---|
+| `openWorkflow(scope)` | false | true |
+| `closeWorkflow(scope)` | unchanged | false |
+| `toggle(scope)` opening the browser, `expand(scope)`, `reportHeadlessOpen` | true | false |
+| `collapse(scope)`, `toggle(scope)` closing the browser | false | unchanged |
+
+So the agent opening a browser by itself takes the slot from the workflow pane, which returns to the card (no
+morph: the user did not ask for it). Older persisted entries with no `workflow` field read as closed.
+
+While the workflow pane is open the card renders nothing and reports itself hidden, so the conversation column
+keeps the whole width beside the pane.
+
+## Data (desktop fold only)
+
+No engine change. The fold already receives the events this needs:
+
+- `graph.node.started` carries `nodeId`, `nodeName`, `runId` and the node's `visit` number.
+- `graph.node.completed` carries `nodeId` and the node's `completion` (with `outcome` when it has one).
+- `graph.finalization.resumed` wakes a completed node again.
+- `subagent.started` and `subagent.completed` carry `subagentId` and the parent's `nodeId`.
+
+New fold state, with the same lifetime as `subagents` (reset at `graph.started`, replaced rather than mutated):
+
+```ts
+export interface NodeVisit {
+  /** `${nodeId}#${visit}`: unique within the run, stable when a journal replays the start. */
+  key: string;
+  nodeId: string;
+  name: string;
+  status: 'running' | 'completed';
+  time: string;
+  endTime?: string;
+}
+FoldState.visits: NodeVisit[];
+SubagentItem.visit?: string;   // the key of the visit that started it
+SubagentItem.endTime?: string; // when it settled
+```
+
+- A start whose key is already listed updates that entry rather than adding one. A start with no `visit` number
+  counts that node's earlier visits in this run.
+- A completion settles the newest running visit of that node. A resume sets that node's newest visit running again
+  and clears its end time.
+- A subagent start is stamped with the newest running visit of its `nodeId`. When no visit of that node is
+  running, it takes the newest running visit of any node. When nothing is running, it gets no visit.
+- When the run is not live, a visit or subagent still marked running is drawn as stopped (the rule
+  `PlanWidget` already applies to subagents).
+
+Grouping is a pure function, `workflowPhases(visits, subagents)`, so it can be tested without rendering.
+
+## Where the pane is rendered
+
+`SessionBrowserLayout` owns the slot and its divider. The workflow content needs `SessionView`'s state (the fold,
+the pull request and the open subagent), so the layout provides its pane element through a React context and
+`SessionView` portals `WorkflowView` into it. The browser branch is unchanged.
+
+## Testing
+
+- Fold: visits are recorded, settled and resumed; a replayed start does not duplicate a visit; subagents are
+  stamped with the right visit, the fallback visit, or none; `graph.started` resets visits.
+- `workflowPhases`: nesting, the `Other agents` group, the overflow split and its running count.
+- Store: every row of the exclusion table, plus the parsing of old entries.
+- Static renders: the card shows phases, nested agents, `N more` and the expand button; the pane shows the grid;
+  no agent avatars or colour classes are rendered.
+- QA plan: `tests/desktop-workflow-pane-test-plan.md`.
+- Run verification: the built dev desktop app driven over CDP through a real run that spawns subagents. Check the
+  morph both ways, the exclusion with the Browser button, the overflow, and that the column keeps its width.

package/licenses/GEIST-OFL-1.1.txt

@@ -0,0 +1,92 @@
+Geist Sans and Geist Mono Font
+(C) 2023 Vercel, made in collaboration with basement.studio
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is available with a FAQ at: http://scripts.sil.org/OFL and copied below
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION AND CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.