synaptane 1.0.0rc2__tar.gz

synaptane-1.0.0rc2/.gitignore

@@ -0,0 +1,37 @@
+# Python and tools
+__pycache__/
+*.py[cod]
+.venv/
+build/
+dist/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+.coverage.*
+coverage.xml
+htmlcov/
+
+# Local configuration, secrets and data
+.env*
+!.env.example
+synaptane.toml
+local/
+data/
+*.key
+*.pem
+*.log
+
+# OCR test corpus (large, kept out of Git)
+tests/fixtures/ocr/
+
+# AI agent tools (settings and local working copies)
+.claude/
+.g2-input/
+
+# Editors and systems
+.DS_Store
+.vscode/
+.idea/
+*.swp

synaptane-1.0.0rc2/CHANGELOG.md

@@ -0,0 +1,240 @@
+# Changelog
+
+All notable changes to Synaptane are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Before each upgrade, back up your instance (see `docs/admin/backup.md`) and read the section
+of the target version.
+
+## [Unreleased]
+
+## [1.0.0-rc.2] - 2026-10-25
+
+### Changed
+- Semantic search with Voyage AI: pages and queries are embedded with the prompts Voyage
+  prepends for its `input_type` ("document" and "query"), which its models are tuned for.
+  Vectors made without them stay compatible; `synaptane reindex` rebuilds an existing index
+  with them.
+- Agent CLIs of the image (subscription mode): Claude Code 2.1.303 and Codex 0.163.0. Codex's
+  new `browser_annotation_api` feature is turned off on each run; its other new features
+  (service tiers, access programs, interruptions, desktop voice) open nothing.
+- Anthropic provider: `anthropic` 2.0.0, which calls the Claude API with version 2026-10-21
+  and sends the API key in `Authorization: Bearer` instead of `X-Api-Key`. Requests to the
+  Claude API itself are unchanged. **If the organization's AI goes through a gateway or proxy
+  (an "API address" set for Anthropic), check that it accepts the key in `Authorization`**;
+  one that only reads `X-Api-Key` now refuses the requests ("key refused"). The `anthropic`
+  package is now under Apache-2.0 (MIT before; see `THIRD_PARTY_NOTICES.md`).
+
+### Security
+- Pillow 13.0.0: fixes in the image decoders (JPEG, TIFF, GIF, PDF, EPS), which open the
+  images uploaded for OCR.
+- opentelemetry-api 1.45.1 (pulled in by anthropic, fastapi and mcp): its `tracestate` parser
+  no longer takes quadratic time on a crafted header (CVE-2026-114603). Synaptane does not
+  extract trace headers itself.
+
+### Added
+- Prices of the Voyage 4 embedding models (`voyage-4-large`, `voyage-4`, `voyage-4-lite`), so
+  that their indexing is counted at its real cost instead of the table's highest price.
+- Semantic search: an optional **minimal similarity** per organization, next to its embedding
+  model (Semantic search page, REST `meaning_min_similarity`). Set, the best page found by
+  meaning must reach it instead of standing out from the median of its neighbours: in a space
+  of similar pages (call transcripts, tickets), relevant questions never stood out enough and
+  meaning added nothing. Empty by default: nothing changes. Cleared when the model changes,
+  since its scale is the model's.
+
+### Fixed
+- A space created after its tidy-up time (02:00 by default) no longer gets a scheduled run
+  right away, before its repository is even synchronized, which failed with "This space has
+  not been synchronized with its repository yet". Its first run is the next night, and no
+  scheduled run starts before the first synchronization.
+- The failed-run alert offers to test the AI connection only when the cause may lie with the
+  AI; a space not synchronized yet points to the repository status.
+- A UTF-8 text file whose 8 KiB detection window cut a multi-byte character (an accented
+  letter at byte 8192) was taken for a binary file: shown as a download, without its text for
+  search and AI assistants. It is text again; an invalid byte still makes a file binary.
+
+## [1.0.0-rc.1] - 2026-10-12
+
+First public release.
+
+### Added
+
+#### Wiki stored in Git
+- Organizations group spaces. Each space is a Git repository on any host (GitHub, GitLab,
+  Gitea…), over HTTPS with a token or over SSH. Its `content/` folder is the wiki, in plain
+  Markdown; PDF, Office documents and images are stored next to the pages.
+- Markdown first, and all your files: PDF (built-in viewer; text layer, or OCR for scanned
+  pages), Word, PowerPoint and Excel documents and their OpenDocument equivalents (`.docx`,
+  `.pptx`, `.xlsx`, `.odt`, `.odp`, `.ods`: download, with the extracted text), images
+  (displayed, text read by OCR), standalone HTML pages (rendered in an isolated frame, source
+  one click away) and any text file (syntax highlighting) are searchable and readable by AI
+  assistants. Other files are stored, versioned and downloadable.
+- The old binary Office formats `.doc`, `.xls` and `.ppt` are searchable too, their text read
+  in the same bounded process and shown under the download link. Word 6 to 2003 and Excel 5 to
+  2003 are read by catdoc (`catdoc`, `xls2csv`, included in the Docker image); without it,
+  these files are kept without text and `synaptane doctor` warns. PowerPoint 97 to 2003 is read
+  by Synaptane itself (with olefile), whether the file was saved by PowerPoint or LibreOffice:
+  titles, bodies, free text boxes, tables and speaker notes, slide after slide. A
+  password-protected file is kept without text, its failure recorded in the extraction
+  manifest.
+- Two-way sync, triggered by an incoming webhook or by polling, with conflict resolution in
+  the web UI. Nothing local is lost when the repository URL changes or after a force-push.
+- Reading and editing in the web UI: page tree, outline, backlinks, wiki links `[[name]]`,
+  history and diffs. Moving a page rewrites the links that point to it, in the same commit.
+- **Health** tab per space: broken links with suggestions, orphan, empty or untitled pages,
+  pages not changed for months.
+- **Page verification**: owner, verification date and review cycle in the front matter
+  (`owner`, `verified`, `review_every`). Badges, a list of pages due for review, and a weekly
+  email to owners.
+- **Related pages** under each page (by meaning, rare words in common, links, folder), with a
+  one-click proposal to link two pages.
+
+#### Inbox and AI tidy-up
+- Each space has an inbox. Notes, with attachments, come from AI assistants (MCP), the web UI
+  or the REST API. Pages changed directly are integrated as well.
+- Every night (or a few minutes after each drop, if enabled), an AI agent files the notes into
+  the wiki, updates existing pages, fixes links and commits. A run can be undone in one click.
+- **Space purpose** (`.synaptane/vocation.md`) and space-specific **tidy rules**
+  (`.synaptane/prompts/tidy.md`), edited in the web UI, with eight templates (infrastructure,
+  marketing, product, client project, personal, family, job search, blank).
+- Guardrails: at most 10 deletions per run; caps on tokens, model calls and tool calls per run
+  (2 million tokens, 120 model calls and 400 tool calls for the tidy-up; 1 million, 60 and 200
+  for a routine); an optional monthly budget per organization with alerts at 80 % and 100 %;
+  file-by-file merge when someone edits a page during a run.
+- The agent reads attachments (text, PDF, Office, OCR) and searches by words and meaning
+  before writing, to complete pages rather than duplicate them.
+- Run log with cost, tokens, quality metrics (broken links introduced, orphan pages created…)
+  and a link to the commit. People who dropped notes get an email saying where they were
+  filed.
+- Offline evaluation bench for the tidy-up and search (`tests/eval/`).
+
+#### Agent routines
+- Scheduled AI agents per space (daily, weekly or monthly) that read a part of the wiki and
+  write only to their outputs: a report page, inbox items, an email, the `routine.done`
+  webhook.
+- Two ready-made routines: **Consistency check** (contradictions, outdated information,
+  duplicates) and **Weekly digest**.
+
+#### Search
+- Full-text search with ripgrep: accent and ligature folding, light English and French
+  stemming, BM25-style ranking, one readable excerpt per result that links to its section.
+- Text extracted from PDF, Office documents and images (Tesseract OCR) in a separate, bounded
+  process.
+- Optional hybrid semantic search with pgvector and reciprocal rank fusion. Embedding
+  providers: Ollama, OpenAI, Google Gemini, Mistral, Voyage AI, any OpenAI-compatible API.
+- Notes waiting in the inbox are shown above the results. Search palette on every page
+  (Ctrl/Cmd+K or `/`).
+
+#### MCP server for AI assistants
+- Streamable HTTP server at `/mcp` with OAuth 2.1 (PKCE, dynamic client registration, token
+  rotation) or personal tokens. A connection can be limited to read-only or to some spaces.
+- 20 tools to list spaces, search, read, browse, follow history, manage the inbox, write,
+  move, delete and verify pages. `search` and `fetch` follow the ChatGPT connector format.
+- 3 prompts: `save`, `answer_with_sources`, `briefing`.
+- Tested with Claude.ai, Claude Desktop, Claude Code and ChatGPT (developer mode). A
+  **Test the connection** page shows calls as they arrive.
+
+#### AI providers
+- Anthropic (default model `claude-sonnet-5-5`), OpenAI, Mistral, Ollama and any
+  OpenAI-compatible endpoint, configured per organization, with a per-space model override.
+- Claude and ChatGPT subscriptions through the official Claude Code and Codex CLIs (super
+  admin only, self-built image), with quota tracking for Claude.
+- Automatic cost estimates for Claude models; manual price per million tokens for the others.
+- The monthly budget covers tidy-up, routines and semantic indexing (embedding tokens priced
+  for OpenAI, Gemini, Mistral and Voyage AI). With a provider billed per use, the form
+  suggests a budget of 20 € a month and the AI page warns while none is set.
+
+#### Accounts and teams
+- Roles: super admin, organization admin, contributor, reader. Invitations by email or by
+  link, password reset, email verification.
+- Single sign-on: OIDC, GitHub, GitLab, Google, with optional allowed email domains per
+  provider.
+- Personal tokens and connected applications, managed in **My account**.
+- Alerts to organization admins: failing tidy-up, routine or sync, inbox not reviewed,
+  deletion cap reached, big changes, subscription quota above 90 %, budget.
+
+#### APIs
+- REST API covering the web features, with an optional OpenAPI schema and interactive docs
+  (`api_docs`).
+- Webhooks signed with HMAC-SHA256, with automatic disabling after repeated failures.
+
+#### Operations
+- Docker Compose deployment, behind the host's reverse proxy or all-in-one with nginx and
+  Let's Encrypt. Image published at `ghcr.io/synaptane/synaptane`, without the Claude Code and
+  Codex CLIs; the Dockerfile can build them in.
+- `SYNAPTANE_VERSION` selects the image tag; `SYNAPTANE_DEFAULT_LOCALE` sets the default
+  language of the UI (`en` or `fr`).
+- The Compose file pulls the published images at its own version by default
+  (`SYNAPTANE_VERSION`, `1.0.0-rc.1` for this release; there is no `latest` to follow) and
+  never builds. Building from the repository goes through `compose.build.yaml`, under the local
+  name `synaptane:local`. Both images carry `LICENSE`, `NOTICE` and the third-party notices in
+  `/usr/share/doc/synaptane/`.
+- Demo data set (`examples/acme-wiki/`, the wiki of a fictional IT team) and the
+  `synaptane demo` command, which loads it into a disposable instance.
+- Eight sample files in the demo data set, linked from its pages: a PDF contract, a scanned
+  delivery note (OCR), a Word checklist, a PowerPoint review, an Excel inventory, the 2019
+  inventory in the old Excel format (`.xls`), a rack diagram (PNG, OCR) and an HTML status
+  report, generated by `scripts/demo_files.py` (the `.xls` file by `scripts/legacy_files.py`).
+- `synaptane doctor` checks the installation; `synaptane check-clis` checks that the agent
+  CLIs only expose Synaptane's tools.
+- Verified backups and atomic restore. Off-site copies encrypted with age and sent with
+  rclone to one or more destinations (S3, B2, SFTP, WebDAV, SMB, Google Drive…), with
+  retention. Monthly restore drill script.
+- Server scripts in `deploy/host/`: `deploy.sh` (backup, build, checks, automatic rollback),
+  `backup.sh`, `install-nginx.sh`.
+- The running version and commit are shown by `synaptane --version`, `doctor`, the
+  administration page and backup manifests.
+
+#### Interface
+- Web UI in English and French, light and dark themes, usable on mobile and with the
+  keyboard.
+
+### Changed
+- Agent instructions in English; the agent writes in the language of the space.
+- Interface strings now have English source keys; French is a translation (fr.json); REST
+  errors follow Accept-Language.
+
+### Security
+- No default account. A random master key (mode 0600) encrypts secrets stored in the
+  database; changing an API or repository URL requires entering its secret again.
+- Passwords hashed with Argon2, tokens stored hashed, CSRF protection on every form, login
+  throttling per account and per address.
+- One authorization check shared by the web UI, the REST API and MCP. Through an assistant,
+  even a super admin reaches only the spaces they are a member of.
+- Email addresses are verified by a link that must be confirmed from the signed-in account
+  that asked for it.
+- OAuth consent screen warns when an application name does not match its redirect address.
+  For an account in several organizations, the consent screen and the personal token form
+  select only the spaces of one organization by default.
+- Single sign-on never creates accounts unless enabled per provider (off by default), and
+  can be limited to allowed email domains. A GitHub, Google or gitlab.com provider that would
+  let anyone sign up is flagged as "Open to everyone".
+- Rate limits, answered with HTTP 429: 3 email verification links per account per hour, 30
+  invitations per organization per hour, 120 inbox drops per account per hour, 5 manual
+  tidy-up runs per person and space per day (20 for an organization admin).
+- Sign-in logs never contain an unknown login as typed, only a short fingerprint.
+- A monthly budget requires a known price for every model in use; a model that loses its
+  price is counted at the highest known price, never zero.
+- Probable secrets are refused before any commit (pages, notes, attachments, agent output).
+- Content read by AI agents is framed as untrusted data, including everything the MCP tools
+  return to assistants. Every MCP write tool is declared destructive, so that clients ask
+  for confirmation. The tidy-up agent and routines have no shell, file or network access;
+  subscription CLIs are restricted to Synaptane's tools, checked in CI.
+- Hardened Git use: Git hooks disabled, no symbolic links, literal paths.
+- Markdown rendered through an HTML sanitizer, with a strict Content Security Policy.
+- Document extraction isolated in a process limited in memory and time.
+- Webhooks protected against requests to private networks.
+- Hardened containers: read-only file system, all capabilities dropped, no privilege
+  escalation, PostgreSQL not exposed, app bound to `127.0.0.1`, forwarded headers trusted
+  only from configured proxies.
+
+### Notes
+- Synaptane is **alpha software (preview)**, provided as is and maintained on a best-effort
+  basis by one person. The REST API, MCP tools and configuration may still change.
+- See [Known limitations](README.md#known-limitations) in the README.
+
+[Unreleased]: https://github.com/synaptane/synaptane/compare/v1.0.0-rc.2...HEAD
+[1.0.0-rc.2]: https://github.com/synaptane/synaptane/compare/v1.0.0-rc.1...v1.0.0-rc.2
+[1.0.0-rc.1]: https://github.com/synaptane/synaptane/releases/tag/v1.0.0-rc.1

synaptane-1.0.0rc2/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

synaptane-1.0.0rc2/NOTICE

@@ -0,0 +1,8 @@
+Synaptane
+Copyright 2026 René Cotton and the Synaptane contributors
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+It includes third-party components (fonts, icons, and the libraries and tools
+bundled in the Docker images) distributed under their own licenses: see
+THIRD_PARTY_NOTICES.md.