@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/licensing/candidates/gitlab-sast-source-notice-bundle.json

@@ -0,0 +1,45 @@
+{
+  "schemaVersion": 1,
+  "status": "independently-byte-verified-conditional-source-notice-package-not-release-cleared",
+  "sourceCommit": "53bf5cf6df3c51b6c02110f5a638b5e6213666cd",
+  "sourceEvidence": {
+    "path": "licensing/candidates/gitlab-sast-source-evidence.json",
+    "sha256": "662c47108fe1acfd6ce3db5508fcfe81bb851f666bb5d4091e80d1f35ace0e91",
+    "files": 163,
+    "rules": 161,
+    "licenseCounts": {
+      "MIT": 79,
+      "LGPL-3.0": 82
+    }
+  },
+  "archive": {
+    "name": "conditional-sast-source-notices.zip",
+    "sha256": "aa6f5134dcf908f46992b7a00e7c42d5f7dcaeb45a0fad293132474159ecdd83",
+    "bytes": 673832,
+    "entries": 167,
+    "sourcePrefix": "source/",
+    "deterministic": true,
+    "compression": "stored",
+    "timestamp": "1980-01-01T00:00:00",
+    "entryMode": "0644",
+    "sourceBytesModified": false,
+    "readmeNoticeAndManifestIncluded": true,
+    "gpl3ReferenceSha256": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
+  },
+  "verification": {
+    "all163CanonicalSourcesAndLicensesMatched": true,
+    "all166ManifestPayloadsMatched": true,
+    "uniqueSafeRelativeRegularEntries": 167,
+    "independentRootVerification": true,
+    "separateBuilderProcessByteIdentical": true
+  },
+  "evidenceLocation": "2026/10/21/lattice-vsg-release-continuation/sast-source-notices (local Codex visualization evidence; archive not committed or published)",
+  "installed": false,
+  "pinsChanged": false,
+  "commerciallyApproved": false,
+  "limits": [
+    "The prior source archive already contained all 161 selected YAML files and two original licenses. This bundle adds README, NOTICE, manifest and the full GPLv3 reference.",
+    "Final runtime composition, source delivery, replaceability, attribution presentation and qualified obligations review remain open.",
+    "The bundle is engineering evidence, not an approved installable runtime, scanner-coverage verdict, rights clearance or release approval."
+  ]
+}

package/dist/security-runtime/licensing/candidates/malpedia-source-license-evidence.json

@@ -0,0 +1,41 @@
+{
+  "schemaVersion": 1,
+  "status": "source-license-declaration-evidence-not-rights-clearance",
+  "sourceRepository": "https://github.com/malpedia/signator-rules",
+  "sourceCommit": "c901f97b7df03e41917da74c2a84b04c227316c2",
+  "inventory": {
+    "path": "licensing/candidates/yara-forge-20260927.json",
+    "sha256": "4a1eb672e488b99d3381979a9eb1de4890edee79cfbcded9502683d48dbc7d54"
+  },
+  "declaration": {
+    "sourceUrl": "https://raw.githubusercontent.com/malpedia/signator-rules/c901f97b7df03e41917da74c2a84b04c227316c2/README.md",
+    "path": "licensing/notices/candidate-sources/sha256/e08c368ccd455f85c7fb9e04830e730f26e9dbb5c0f77bc88e09a5b0cb37df5b.txt",
+    "sha256": "e08c368ccd455f85c7fb9e04830e730f26e9dbb5c0f77bc88e09a5b0cb37df5b",
+    "bytes": 1938,
+    "scope": "rules/",
+    "license": "CC-BY-SA-4.0"
+  },
+  "legalcode": {
+    "sourceUrl": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt",
+    "path": "licensing/notices/candidate-sources/sha256/28a9529c7d0bb4dc51f4bf5c116a3d16ef247a052f7591466768ddf563fd1cf5.txt",
+    "sha256": "28a9529c7d0bb4dc51f4bf5c116a3d16ef247a052f7591466768ddf563fd1cf5",
+    "bytes": 20138
+  },
+  "selection": {
+    "decision": "candidate-attribution-sharealike",
+    "rules": 1582,
+    "uniqueSourceUrls": 1582,
+    "metadataAndAuthorPresent": true,
+    "digestAlgorithm": "SHA-256 of UTF-8 compact JSON tuples [rule,blockSha256,author,sourceUrl,candidateLicense,decision], sorted by rule code point order; no trailing newline",
+    "digest": "1abee35347277118e5a744e8837bb6ac88147196ef80bd527dc833f6b840b042"
+  },
+  "closed": "The missing source-license declaration reference for these 1582 records is bound to their immutable upstream rules-folder declaration and official legalcode.",
+  "notEstablished": [
+    "Original-source payload equality or YARA-Forge adaptation/modification status.",
+    "Completed attribution, change notices, adapted-source distribution or ShareAlike compliance.",
+    "Other rights, coverage equivalence, selected-pack pin, commercial clearance or release approval."
+  ],
+  "commerciallyCleared": false,
+  "pinsChanged": false,
+  "rawRulePayloadIncluded": false
+}

package/dist/security-runtime/licensing/candidates/rule-license-evidence.json

@@ -0,0 +1,376 @@
+{
+  "schemaVersion": 1,
+  "status": "preserved-original-text-evidence-not-commercial-clearance",
+  "collectedOn": "2026-10-20",
+  "inputs": [
+    {
+      "path": "licensing/candidates/yara-forge-20260927.json",
+      "sha256": "4a1eb672e488b99d3381979a9eb1de4890edee79cfbcded9502683d48dbc7d54"
+    },
+    {
+      "path": "licensing/candidates/gitlab-sast-source-evidence.json",
+      "sha256": "662c47108fe1acfd6ce3db5508fcfe81bb851f666bb5d4091e80d1f35ace0e91"
+    }
+  ],
+  "licenseReferences": [
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/Neo23x0/signature-base/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:01.338689+00:00",
+      "observedLicense": "LicenseRef-DRL-1.1",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 1068,
+        "review-conflicting-metadata": 10
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/8a959b2413d0c83ca1b3ce9153076c649abf2e4bbfebbb493fb24c2074a1eb8a.txt",
+        "sha256": "8a959b2413d0c83ca1b3ce9153076c649abf2e4bbfebbb493fb24c2074a1eb8a",
+        "bytes": 1939
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md",
+      "sourceUrl": "https://raw.githubusercontent.com/SEKOIA-IO/Community/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md",
+      "retrievedAt": "2026-10-21T02:33:01.679311+00:00",
+      "observedLicense": "LicenseRef-DRL-1.1",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 706
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/ce41c9a2c986277f7f9ab146a2195c1888a5d8da062e22d7c9c88666bb7c38cd.txt",
+        "sha256": "ce41c9a2c986277f7f9ab146a2195c1888a5d8da062e22d7c9c88666bb7c38cd",
+        "bytes": 1897
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/WithSecureLabs/iocs/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:01.962036+00:00",
+      "observedLicense": "BSD-2-Clause",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 24
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/811515f8723aa4007de2fbb75a364127fdec51cda534b87a7ea8f2fef2f96dd7.txt",
+        "sha256": "811515f8723aa4007de2fbb75a364127fdec51cda534b87a7ea8f2fef2f96dd7",
+        "bytes": 1306
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/advanced-threat-research/Yara-Rules/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:02.130149+00:00",
+      "observedLicense": "Apache-2.0",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 57,
+        "exclude-safety": 1
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4.txt",
+        "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+        "bytes": 11357
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/chronicle/GCTI/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:02.278342+00:00",
+      "observedLicense": "Apache-2.0",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 89
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/9b8e1305e46d1dd4011b6ed933c9f6223e08c9c4625001c5fd75a34fa930f616.txt",
+        "sha256": "9b8e1305e46d1dd4011b6ed933c9f6223e08c9c4625001c5fd75a34fa930f616",
+        "bytes": 11337
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md",
+      "sourceUrl": "https://raw.githubusercontent.com/cod3nym/detection-rules/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md",
+      "retrievedAt": "2026-10-21T02:33:02.451275+00:00",
+      "observedLicense": "LicenseRef-DRL-1.1",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 8
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/a01f1a28424bfe7f49a23d339a01847cfa9ace3864d5e7295051772a4bae2271.txt",
+        "sha256": "a01f1a28424bfe7f49a23d339a01847cfa9ace3864d5e7295051772a4bae2271",
+        "bytes": 1940
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/craiu/yararules/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:02.765740+00:00",
+      "observedLicense": "restricted-or-custom-review",
+      "dependentRuleDecisions": {
+        "exclude-unresolved-rights": 10
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986.txt",
+        "sha256": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986",
+        "bytes": 35149
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt",
+      "sourceUrl": "https://raw.githubusercontent.com/ditekshen/detection/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt",
+      "retrievedAt": "2026-10-21T02:33:02.991009+00:00",
+      "observedLicense": "BSD-2-Clause",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 609
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/e9efb2f7daf11bb6379c06c16b870dddcecc4a10f8704bb8aad807529c8b3c97.txt",
+        "sha256": "e9efb2f7daf11bb6379c06c16b870dddcecc4a10f8704bb8aad807529c8b3c97",
+        "bytes": 1330
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md",
+      "sourceUrl": "https://raw.githubusercontent.com/dr4k0nia/yara-rules/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md",
+      "retrievedAt": "2026-10-21T02:33:03.127159+00:00",
+      "observedLicense": "LicenseRef-DRL-1.1",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 4
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/ce41c9a2c986277f7f9ab146a2195c1888a5d8da062e22d7c9c88666bb7c38cd.txt",
+        "sha256": "ce41c9a2c986277f7f9ab146a2195c1888a5d8da062e22d7c9c88666bb7c38cd",
+        "bytes": 1897
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/elceef/yara-rulz/5683b294a12cf0c875b624933586029ae43a852f/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:03.289347+00:00",
+      "observedLicense": "MIT",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 16
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/4fecb8fcaf80fd9a6315bca5225ee43377015b46a0459c2925495be885cab19a.txt",
+        "sha256": "4fecb8fcaf80fd9a6315bca5225ee43377015b46a0459c2925495be885cab19a",
+        "bytes": 1073
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/eset/malware-ioc/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:03.474145+00:00",
+      "observedLicense": "BSD-2-Clause",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 57
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/995182e185856186fbbe49f150409ae026aa4cda7e94f83c6ed737cbb77fa9c7.txt",
+        "sha256": "995182e185856186fbbe49f150409ae026aa4cda7e94f83c6ed737cbb77fa9c7",
+        "bytes": 1300
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/kevoreilly/CAPEv2/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:03.636747+00:00",
+      "observedLicense": "GPL-3.0",
+      "dependentRuleDecisions": {
+        "review-copyleft": 121
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/814442c3987a2c0411171ad8ad43118e8c08f85c9c5d1dcdecc9787c7ca8689b.txt",
+        "sha256": "814442c3987a2c0411171ad8ad43118e8c08f85c9c5d1dcdecc9787c7ca8689b",
+        "bytes": 34748
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/LICENSE",
+      "sourceUrl": "https://raw.githubusercontent.com/magicsword-io/LOLDrivers/9fa32adeab865455de8b24cba0bbc0f3439d59f7/LICENSE",
+      "retrievedAt": "2026-10-21T02:33:03.804231+00:00",
+      "observedLicense": "Apache-2.0",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 48
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4.txt",
+        "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+        "bytes": 11357
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt",
+      "sourceUrl": "https://raw.githubusercontent.com/mandiant/red_team_tool_countermeasures/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt",
+      "retrievedAt": "2026-10-21T02:33:03.962557+00:00",
+      "observedLicense": "BSD-2-Clause",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 147
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/a5b8bd9ae96c630bbf229d61c5c5def20274e00be39abfd2fab4d7879ceab462.txt",
+        "sha256": "a5b8bd9ae96c630bbf229d61c5c5def20274e00be39abfd2fab4d7879ceab462",
+        "bytes": 1297
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/synacktiv/synacktiv-rules/blob/d234cc4da0783db7dca56ae8dd5252afdc248df8/LICENSE.md",
+      "sourceUrl": "https://raw.githubusercontent.com/synacktiv/synacktiv-rules/d234cc4da0783db7dca56ae8dd5252afdc248df8/LICENSE.md",
+      "retrievedAt": "2026-10-21T02:33:04.103712+00:00",
+      "observedLicense": "LicenseRef-DRL-1.1",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 3
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/d5f4c36a0528e01cfdd9e4fc60879201d3af49b41c520200643d321fe53da5f9.txt",
+        "sha256": "d5f4c36a0528e01cfdd9e4fc60879201d3af49b41c520200643d321fe53da5f9",
+        "bytes": 1896
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-yara-license-evidence",
+      "metadataUrl": "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt",
+      "sourceUrl": "https://raw.githubusercontent.com/volexity/threat-intel/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt",
+      "retrievedAt": "2026-10-21T02:33:04.265866+00:00",
+      "observedLicense": "BSD-2-Clause",
+      "dependentRuleDecisions": {
+        "candidate-attribution": 91
+      },
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/ada32b3747ce108d5e8bab7918af94abbd03f2fe2a46304f74c6333bbfd914ed.txt",
+        "sha256": "ada32b3747ce108d5e8bab7918af94abbd03f2fe2a46304f74c6333bbfd914ed",
+        "bytes": 1293
+      },
+      "scope": "Reference evidence only; dependent rules include both conditional candidates and held rules. This does not include their rule source or clear their rights."
+    },
+    {
+      "kind": "upstream-sast-license-evidence",
+      "sourcePath": "LICENSE",
+      "sourceUrl": "https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/53bf5cf6df3c51b6c02110f5a638b5e6213666cd/LICENSE",
+      "observedLicense": "MIT",
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/33acf42afdd03163d75fe856cb431e70710e0b5deede3362e6d1c4697cfe1c6a.txt",
+        "sha256": "33acf42afdd03163d75fe856cb431e70710e0b5deede3362e6d1c4697cfe1c6a",
+        "bytes": 2000
+      },
+      "scope": "Original source license bytes retained; source delivery, modification and combined-work obligations remain unresolved."
+    },
+    {
+      "kind": "upstream-sast-license-evidence",
+      "sourcePath": "rules/lgpl/LICENSE",
+      "sourceUrl": "https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/53bf5cf6df3c51b6c02110f5a638b5e6213666cd/rules/lgpl/LICENSE",
+      "observedLicense": "LGPL-3.0",
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/a5681bf9b05db14d86776930017c647ad9e6e56ff6bbcfdf21e5848288dfaf1b.txt",
+        "sha256": "a5681bf9b05db14d86776930017c647ad9e6e56ff6bbcfdf21e5848288dfaf1b",
+        "bytes": 7651
+      },
+      "scope": "Original source license bytes retained; source delivery, modification and combined-work obligations remain unresolved."
+    },
+    {
+      "kind": "general-license-reference",
+      "sourceUrl": "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt",
+      "retrievedAt": "2026-10-21T02:33:04.415306+00:00",
+      "observedLicense": "CC-BY-SA-4.0",
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/28a9529c7d0bb4dc51f4bf5c116a3d16ef247a052f7591466768ddf563fd1cf5.txt",
+        "sha256": "28a9529c7d0bb4dc51f4bf5c116a3d16ef247a052f7591466768ddf563fd1cf5",
+        "bytes": 20138
+      },
+      "scope": "General legalcode only; does not establish source-specific rights or attribution for any of the 1582 metadata-tagged rules."
+    },
+    {
+      "kind": "general-license-reference",
+      "label": "GPL-3.0",
+      "sourceUrl": "https://www.gnu.org/licenses/gpl-3.0.txt",
+      "retrievedAt": "2026-10-21T02:36:06.145148+00:00",
+      "status": 200,
+      "finalUrl": "https://www.gnu.org/licenses/gpl-3.0.txt",
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986.txt",
+        "sha256": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986",
+        "bytes": 35149
+      },
+      "scope": "General GPL text supplements LGPL reference; no combined-work approval."
+    },
+    {
+      "kind": "node-upstream-tag-license",
+      "label": "Node-22.23.3-third-party-notices",
+      "sourceUrl": "https://raw.githubusercontent.com/nodejs/node/v22.23.3/LICENSE",
+      "retrievedAt": "2026-10-21T02:36:06.452073+00:00",
+      "status": 200,
+      "finalUrl": "https://raw.githubusercontent.com/nodejs/node/v22.23.3/LICENSE",
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/c738ae413cf561f174e34f6961f8ca458aae2369a73640dda6234c629b98bcc4.txt",
+        "sha256": "c738ae413cf561f174e34f6961f8ca458aae2369a73640dda6234c629b98bcc4",
+        "bytes": 145485
+      },
+      "scope": "License/third-party notice text from the matching upstream version tag; not a complete binary SBOM or independently proven source/build equivalence."
+    }
+  ],
+  "additionalRequests": [
+    {
+      "kind": "general-license-reference",
+      "label": "GPL-3.0",
+      "sourceUrl": "https://www.gnu.org/licenses/gpl-3.0.txt",
+      "retrievedAt": "2026-10-21T02:36:06.145148+00:00",
+      "status": 200,
+      "finalUrl": "https://www.gnu.org/licenses/gpl-3.0.txt",
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986.txt",
+        "sha256": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986",
+        "bytes": 35149
+      },
+      "scope": "General GPL text supplements LGPL reference; no combined-work approval."
+    },
+    {
+      "kind": "node-upstream-tag-license",
+      "label": "Node-22.23.3-third-party-notices",
+      "sourceUrl": "https://raw.githubusercontent.com/nodejs/node/v22.23.3/LICENSE",
+      "retrievedAt": "2026-10-21T02:36:06.452073+00:00",
+      "status": 200,
+      "finalUrl": "https://raw.githubusercontent.com/nodejs/node/v22.23.3/LICENSE",
+      "file": {
+        "path": "licensing/notices/candidate-sources/sha256/c738ae413cf561f174e34f6961f8ca458aae2369a73640dda6234c629b98bcc4.txt",
+        "sha256": "c738ae413cf561f174e34f6961f8ca458aae2369a73640dda6234c629b98bcc4",
+        "bytes": 145485
+      },
+      "scope": "License/third-party notice text from the matching upstream version tag; not a complete binary SBOM or independently proven source/build equivalence."
+    }
+  ],
+  "noticeProbeLimit": "Nine common NOTICE filename probes on three exact Apache-source commits returned 404; this does not prove no notices exist elsewhere in the original distributions.",
+  "releaseRequirements": [
+    "Resolve source-specific rights, attribution, modification and notices for all selected rules, including 1582 CC-BY-SA and 27 explicit-Apache metadata candidates.",
+    "Assemble Linux-only source payloads only under their approved pin/selection and delivery obligations; no raw rules are included here.",
+    "Include the required notices and credits in the final runtime/local/cloud/download distribution. These evidence-only text files are outside the current artifact allowlist.",
+    "Preserve source availability and replaceability; legal interpretation and release approval remain separate."
+  ]
+}