ithrl 0.1.0__tar.gz

ithrl-0.1.0/.gitignore

@@ -0,0 +1,30 @@
+# Python environments and caches
+.venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.hypothesis/
+.pyrefly/
+.coverage
+.coverage.*
+htmlcov/
+
+# Build artifacts
+build/
+dist/
+*.egg-info/
+
+# Local configuration and secrets
+/.local/
+.env
+.env.*
+!.env.example
+
+# Local ithrl evidence and runtime data
+.ithrl/
+*.ithrl
+*.sqlite
+*.sqlite-journal
+*.sqlite-shm
+*.sqlite-wal

ithrl-0.1.0/CHANGELOG.md

@@ -0,0 +1,80 @@
+# CHANGELOG
+
+<!-- version list -->
+
+## v0.1.0 (2026-10-17)
+
+### Bug Fixes
+
+- **adapters**: Detect saved session formats structurally
+  ([`c8256b9`](https://github.com/eberkut/ithrl/commit/c8256b93ce79fb9c3f025e2b92a970f336497218))
+
+- **reduce**: Validate native candidates before sampled dispatch
+  ([`90d4c0d`](https://github.com/eberkut/ithrl/commit/90d4c0d11a206389d44c6a59991df53c19802514))
+
+- **runner**: Clarify Codex isolation prerequisites
+  ([`4a409c1`](https://github.com/eberkut/ithrl/commit/4a409c1f37caf301a00cfbd20d3a95cf15844eb9))
+
+### Features
+
+- Establish credential-free context reduction core
+  ([`c517409`](https://github.com/eberkut/ithrl/commit/c517409c06e40c92b24a8b990685abd4acc9a9ba))
+
+- **adapters**: Parse Codex and Copilot session evidence
+  ([`3b81c26`](https://github.com/eberkut/ithrl/commit/3b81c2607397d884bcfb1b19dbf995f66ccb0107))
+
+- **calibration**: Add bounded sampled runner calibration
+  ([`f9db180`](https://github.com/eberkut/ithrl/commit/f9db18012565badc2cf2a3a4a6158487d4c5fb70))
+
+- **case**: Preserve immutable native source evidence
+  ([`d108b96`](https://github.com/eberkut/ithrl/commit/d108b96487ccb69f6b36642ae331d36272038722))
+
+- **cli**: Add an installed example and focused public guides
+  ([`1efc2ff`](https://github.com/eberkut/ithrl/commit/1efc2ffb03c734b666b1d1da9b5610ad62970267))
+
+- **cli**: Add guarded native calibration
+  ([`06d2bfb`](https://github.com/eberkut/ithrl/commit/06d2bfb3f4d34f4dc845d9d6877257e4e79f9120))
+
+- **cli**: Integrate sampled reduction and exact resume
+  ([`40be766`](https://github.com/eberkut/ithrl/commit/40be7664ba90ac5341d93fb5a725dbfa0efd48d3))
+
+- **extract**: Support ordinary Codex and Copilot sessions
+  ([`3cd0c10`](https://github.com/eberkut/ithrl/commit/3cd0c1092aeb3669b86fdae07e887d28ba9d685f))
+
+- **reduce**: Add sampled contracts and durable progress
+  ([`650252d`](https://github.com/eberkut/ithrl/commit/650252d76e8d7d72f3f5715ecaf488e752dc18b1))
+
+- **reduce**: Integrate sampled candidate search
+  ([`72958d8`](https://github.com/eberkut/ithrl/commit/72958d8d6ae0307ca2d090a2a10d02606bafdea6))
+
+- **runner**: Add Codex final-response execution
+  ([`ad30a9a`](https://github.com/eberkut/ithrl/commit/ad30a9a17b0e665056eca9b415cbf4e2770a7bf7))
+
+- **runner**: Add controlled Copilot execution
+  ([`c9d1bb2`](https://github.com/eberkut/ithrl/commit/c9d1bb23bfdd98bb022fd0b62ca9b8a81021fe4b))
+
+- **runner**: Add isolated execution runtime
+  ([`17d2224`](https://github.com/eberkut/ithrl/commit/17d22240414cdb32d4464f16e7b2621d99729ca0))
+
+- **runner**: Add shared execution foundation
+  ([`89536e9`](https://github.com/eberkut/ithrl/commit/89536e919730fc0abf680a2928a89761c78339f5))
+
+- **runner**: Validate isolated native calibration
+  ([`b0cd438`](https://github.com/eberkut/ithrl/commit/b0cd438d1fa280f0ddafa39d23653a7ac926da1b))
+
+- **sampling**: Collect bounded fresh-baseline blocks
+  ([`16abf30`](https://github.com/eberkut/ithrl/commit/16abf30b964eae299177d1e1dade6f545ffbda31))
+
+- **sampling**: Support paced execution and safe overload replacement
+  ([`5d70fbd`](https://github.com/eberkut/ithrl/commit/5d70fbd26901a0574883e07fd4055644c8515e80))
+
+- **statistics**: Add fixed-sample candidate classification
+  ([`fb26fca`](https://github.com/eberkut/ithrl/commit/fb26fcaf7c064f49ac7d63b4e2ceb1ab3d6dcdb5))
+
+- **workflow**: Confirm sampled reductions with fresh evidence
+  ([`ee291e4`](https://github.com/eberkut/ithrl/commit/ee291e4d906394452da61640989cef594f62caf7))
+
+### Refactoring
+
+- Simplify execution paths and avoid redundant context copies
+  ([`34ab361`](https://github.com/eberkut/ithrl/commit/34ab36165fed08678a80679b3f1753e6f26f63f8))

ithrl-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,305 @@
+# Contributing
+
+Start with an [issue](https://github.com/eberkut/ithrl/issues) describing the problem or proposed
+change. Pull requests are limited to collaborators; discuss the work before preparing one.
+
+For bug reports, include the ithrl version, platform, sanitized error code and steps to reproduce.
+Keep full sessions, cases, proprietary source and credentials out of public reports. Report
+suspected vulnerabilities through [private vulnerability reporting](https://github.com/eberkut/ithrl/security/advisories/new).
+
+## Development setup
+
+Use [uv](https://docs.astral.sh/uv/) and Python 3.12, 3.13 or 3.14. Python 3.14 is the primary
+development version. From the repository root:
+
+```bash
+uv sync --locked --all-groups
+uv run ithrl --help
+```
+
+The [bundled example](README.md#try-it) also works from a checkout; prefix `ithrl` commands with
+`uv run`. It does not depend on test fixtures.
+
+## Checks
+
+Run the same entry points used by CI:
+
+```bash
+uv lock --check
+uv run ruff check .
+uv run ruff format --check .
+uv run pyrefly check
+uv run pytest --ignore=tests/packaging
+uv run radon cc src/ithrl --min B --show-complexity --total-average
+uv run radon mi src/ithrl --min B --show
+uv build --sdist --wheel --no-sources
+ITHRL_DIST_DIR=dist uv run pytest -o addopts= tests/packaging
+```
+
+Non-packaging tests and the synthetic example need no provider credentials or network requests.
+Packaging checks may download build and runtime dependencies. Radon reports are review signals.
+
+CI runs tests, dependency audits and installed-package checks on Python 3.12–3.14. It builds one
+wheel/sdist pair; every Python version tests that wheel and rebuilds and installs a wheel from the
+sdist outside the checkout. Version output must match artifact metadata. To test a local wheel as
+an isolated tool, pass its path to `uv tool install` or `pipx install`.
+
+For local matrix runs, set `UV_PYTHON` on every command. Use separate environments, test caches and
+coverage files for parallel runs; otherwise run versions sequentially.
+
+## Workflow and dependency checks
+
+For GitHub Actions or Dependabot changes, use the jactionlint release pinned in
+[CI](.github/workflows/ci.yml):
+
+```bash
+jactionlint --no-online --strict-exit
+```
+
+CI uses its default correctness/security profile, with online lookups and automatic fixes disabled.
+
+Audit the resolved runtime dependencies and every dependency group, including development, docs
+and audit tooling, from `uv.lock`. Run this in Bash with the locked environment synchronized:
+
+```bash
+set -o pipefail
+uv export --locked --all-groups --no-emit-project --format requirements.txt |
+  uv run --locked --group audit pip-audit --strict --disable-pip --require-hashes -r /dev/stdin
+```
+
+The hashed export is temporary pipeline input. The audit queries PyPI's vulnerability service for
+package names and versions without installing those packages, resolving alternatives or applying
+fixes. CI evaluates markers on each supported Python version. This covers locked versions rather
+than every version permitted by package dependency ranges.
+
+GitHub's dependency graph and Dependency Review use the inventory GitHub has for each commit.
+Before relying on them for `uv.lock` coverage, compare the hosted package/version inventory with
+the locked export on each supported Python version. The PR dependency-review job rejects newly
+introduced known vulnerabilities at any severity across runtime, development and unknown scopes.
+It uses a read-only token and does not check out or execute PR code. If it reports incomplete
+dependency snapshots, wait for GitHub's graph update and rerun the job. No license allowlist is
+enforced by this check. Keep the lockfile audit above as the full-inventory CI gate; Dependabot
+version updates alone do not establish dependency-graph coverage.
+
+CI runs weekly on Monday at 06:17 UTC to detect new advisories. Dependabot checks Python, Actions
+and pre-commit dependencies weekly, groups minor/patch updates and leaves majors individually
+reviewable. Ordinary updates have a seven-day cooldown; security updates have none. Updates are
+never automatically merged. Hosted dependency-graph coverage is a separate verification gate.
+
+## Documentation
+
+README owns the quick start; `docs/` owns user guides and reference. Support, security and conduct
+policies live at the repository root. Keep private sessions, cases and credentials out of
+documentation and generated output.
+
+The optional `docs` dependency group pins MkDocs and the shadcn theme. Search runs in the browser;
+fonts and scripts are served with the site. GitHub star-count requests and raw Markdown copying
+are disabled. A local hook admits only the packaged theme assets used by this configuration.
+When changing the theme or enabled extensions, check that asset list and the
+[third-party notices](docs/third-party-notices.txt) alongside the rendered site.
+To preview the site locally:
+
+```bash
+uv sync --locked --all-groups
+uv run --group docs mkdocs serve
+```
+
+`mkdocs.yml` admits only the named public files under `docs/`. When adding a page, update its
+navigation and file allowlist, the sdist include list in `pyproject.toml`, and the documentation
+manifests in the documentation and packaging tests. Never set `docs_dir` to the repository root.
+
+After changing CLI options or help, regenerate the committed reference with Typer:
+
+```bash
+uv run typer ithrl.cli utils docs --name ithrl --title 'CLI reference' --output docs/cli.md
+```
+
+Generation reads command metadata without invoking the commands. Verify reference drift,
+publication boundaries, issue forms, page links and anchors with:
+
+```bash
+uv run pytest -o addopts= tests/unit/test_documentation.py -q
+uv run --group docs mkdocs build --strict
+```
+
+Build output stays in ignored `.local/site/`. Strict builds validate local documentation links;
+they do not verify remote URL availability.
+
+The [documentation workflow](.github/workflows/pages.yml) builds and deploys
+`https://eberkut.github.io/ithrl/` on pushes to `main`, or when a maintainer runs it manually
+from `main`. It checks the documentation before uploading only the generated site. Deployment
+runs in a separate `github-pages` environment job without checking out or executing project code.
+Pull requests receive read-only documentation checks through CI and cannot deploy.
+
+Repository administrators must select **Settings → Pages → Source: GitHub Actions** and restrict
+the `github-pages` environment to `main` before the first deployment. No custom domain, separate
+site repository, `gh-pages` branch or personal access token is needed. After a successful
+deployment, check the published pages, navigation and static assets at the URL above.
+
+## Credential-free integration tests
+
+The sampled CLI tests exercise calibration, search, fresh confirmation, observations, result
+publication and exact resume with a mock runner:
+
+```bash
+uv run pytest -o addopts= tests/integration/test_sampled_cli.py -q
+```
+
+Mock-native tests exercise the three current native target profiles through isolated mock harness
+processes. They cover context-sensitive reduction, immutable inputs, action denial, cleanup,
+accounting and budget refusal:
+
+```bash
+uv run pytest -o addopts= tests/integration/test_native_calibration.py -q
+```
+
+These tests establish local contracts. Native qualification is recorded in the
+[measurement notes](docs/native-runs.md#compatibility-and-measurements).
+
+## Opt-in native smoke tests
+
+Profiles are `codex-final`, `copilot-final` and `copilot-shell`. They are skipped by default and
+refuse opt-in when `CI` or `GITHUB_ACTIONS` is set. Live mode makes real model requests.
+
+Use a private evidence parent outside the checkout and existing harness authentication. The
+installed harness and Bubblewrap must pass isolation/capability checks. Never put credentials in
+arguments or case content. Inspect the exact profile, model, provider and limits before execution.
+
+Start with structural preflight, which runs bounded local probes with network denied and no model
+turn. The host filesystem and harness executable are read-only; only private disposable state is
+writable:
+
+```bash
+uv run pytest -o addopts= tests/live -m native_smoke -s \
+  --native-smoke preflight --native-profile PROFILE \
+  --native-model MODEL --native-provider PROVIDER \
+  --native-smoke-root /absolute/private/evidence-parent
+```
+
+Inspect the printed plan and private `preflight.json`. To authorize provider execution, use its
+exact capability digest. For Copilot, `PROVIDER` must be `github-copilot`:
+
+```bash
+uv run pytest -o addopts= tests/live -m native_smoke -s \
+  --native-smoke run --native-profile PROFILE \
+  --native-model MODEL --native-provider PROVIDER \
+  --native-smoke-root /absolute/private/evidence-parent \
+  --native-capability-digest APPROVED_DIGEST
+```
+
+Every invocation creates fresh private state, harmless session content and an empty original
+workspace. Calibration requires two matching attempts and permits at most two, each bounded at
+120 seconds plus cancellation grace. Final-response profiles allow up to two provider calls;
+Copilot shell allows up to four, with `pwd` visible but denied.
+
+Returned actions never execute. Hosted tools, MCP and tool-side network effects remain forbidden.
+An input-token cap cannot be enforced. Private evidence records known counts and unknown
+acceptance explicitly. Unsupported or unsuccessful profiles fail the test without skipping or retrying.
+
+## Preparing a change
+
+Keep changes focused and add tests for changed behavior and failure paths. Update the relevant
+user guide when commands or results change. Use Conventional Commit subjects, such as
+`fix(extract): reject conflicting selectors`.
+
+Changes to native protocols, reconstruction, permissions or provider accounting need review of
+the affected safety boundary. Mock tests establish local contracts; claims of native support also
+need capability, isolation, calibration and live-use evidence for the target profile.
+
+## Preparing a release
+
+Python Semantic Release, pinned in the `release` dependency group, calculates versions from
+Conventional Commits. `pyproject.toml` is the version source; installed CLI and Codex client
+metadata read that distribution version. The tool generates `CHANGELOG.md` from the full release
+history, omitting routine build, CI, documentation, style and test commits. Do not edit the
+generated changelog by hand; review its contents before approving a release.
+
+Use `main` with complete history and all existing release tags available. Preview the next version
+without changing files, the index, commits, tags or remote state:
+
+```bash
+uv run --locked --group release semantic-release --noop version --print
+```
+
+The preparation command below writes **and stages** the version and changelog, even with
+`--no-commit`. Obtain approval for those local staging changes before running it. For worktree-only
+review, run it in a disposable checkout and transfer the reviewed file changes. To prepare:
+
+```bash
+uv run --locked --group release semantic-release version \
+  --no-commit --no-tag --no-push --no-vcs-release --skip-build
+uv lock --upgrade-package ithrl
+```
+
+The lock update remains unstaged. Review all generated changes, confirm version consistency and
+public-safe release notes, then run the affected checks before proposing the signed commit.
+Preparation creates no commit, tag or hosted release and uploads no package. Publication requires
+separate approval of the source commit, version, artifacts and destinations.
+
+### Publishing a prepared release
+
+The manually dispatched [release workflow](.github/workflows/release.yml) uses the existing CI
+workflow to check the exact source commit, build one release wheel/sdist pair and test installation
+on Python 3.12–3.14. It uploads to TestPyPI, waits for production approval, then promotes those
+same distribution bytes to PyPI and GitHub Releases. Ordinary pushes and pull requests do not
+publish packages. No native harness or model request is part of release automation.
+
+Before dispatch, the source must be reviewed and committed on `main`, with successful CI and
+the applicable hosted security checks for that commit. Verify account recovery readiness, package
+ownership and the following repository/index settings:
+
+- PyPI and TestPyPI Trusted Publishers bind `eberkut/ithrl`, `release.yml` and their respective
+  `pypi` / `testpypi` environments. Publishing uses OIDC, without a stored PyPI API token.
+- Both environments admit only `main`. `pypi` requires the maintainer's approval, permits
+  self-review and disallows administrative approval bypass. Environment declarations in YAML
+  do not configure these protections; verify the actual settings before dispatch.
+- Release-tag rules permit the maintainer's signed-tag creation and prevent unapproved tag
+  replacement or deletion. The workflow never creates a tag.
+
+The dispatch gate admits the repository's current maintainer identity and requires the full source
+SHA and exact final `X.Y.Z` version. Replace the placeholders with the reviewed values:
+
+```bash
+gh workflow run release.yml --repo eberkut/ithrl --ref main \
+  -f version=X.Y.Z -f source-sha=FULL_APPROVED_COMMIT_SHA
+```
+
+1. Inspect that run's checks and successful **Publish TestPyPI rehearsal** job. Its summary records
+   the source, version, immutable artifact ID and checksum-manifest digest. The production job
+   waits at the `pypi` environment. TestPyPI files, logs and artifacts are public.
+2. Download that run's `release-distributions` artifact into a new review directory. For example:
+
+   ```bash
+   gh run download RUN_ID --repo eberkut/ithrl \
+     --name release-distributions --dir /absolute/new/release-review
+   ```
+
+   Match `SHA256SUMS` to the digest in the run summary, then run `sha256sum --check SHA256SUMS`
+   from the review directory. Inspect the release notes and confirm TestPyPI serves the same
+   distribution hashes. Complete a clean TestPyPI installation/example rehearsal before approval;
+   resolve dependencies only from the normal PyPI index, without mixing indexes.
+3. After the rehearsal passes and tag creation is approved, create and verify the signed tag at
+   the frozen source commit, then push only that tag through the permitted tag-rules path:
+
+   ```bash
+   git tag -s vX.Y.Z FULL_APPROVED_COMMIT_SHA -m 'Release vX.Y.Z'
+   git verify-tag vX.Y.Z
+   git push origin refs/tags/vX.Y.Z
+   ```
+
+4. Review and approve the `pypi` deployment on the run's GitHub page. The job verifies the existing
+   annotated tag targets the frozen source, rechecks the files, and uploads to PyPI. The final job
+   rechecks the tag/files and creates the GitHub Release with those distributions, notes and
+   checksums. Signature verification belongs to the preceding maintainer tag check; the workflow
+   checks the tag object and target commit.
+5. Verify the published versions, hashes, attestations and installed example. A successful upload
+   alone does not complete release acceptance.
+
+Complete review within 30 days: release artifacts are retained for 30 days, and GitHub limits the
+total workflow lifetime, including approval waits. Start only one release at a time; concurrency
+preserves the active run but GitHub may replace an older pending run when another is queued.
+Do not rerun the whole workflow to promote a completed rehearsal or cancel a run during upload.
+For failure or partial publication, inspect the index and existing release first; preserve the
+original files and hashes. Any recovery upload needs explicit approval and must use identical
+missing files. Never rebuild and overwrite a published version or suppress conflicts with
+`skip-existing`.

ithrl-0.1.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.