# Algorave distribution record — 2026-09-15

## Current MVP package decision

Compiler bundling and rebuilding upstream toolchains are not release tasks.
Historical references below to “LLVM coverage” do not establish such a requirement
and are superseded by this decision. Preserve collected source files; do not
continue recursive toolchain acquisition.

The current archive passes source checksums, notices inventory and reproduction
of both browser bundles after a clean npm install. Generated Help links resolve
to nonempty source, license and notices artifacts. This was rechecked after the
MVP agent-guide changes, on runtime build `4e6260266268`.

The remaining narrow uncertainty is Csound's precompiled WASM provenance:
its upstream recipes select four codec sources from an unpinned package set.
The app archive includes the published WASM, pinned Csound source and build
recipes, but the browser-bundle rebuild reuses that WASM; it does not prove the
completeness of source for its embedded native dependencies. Do not present this
uncertainty as a compiler requirement or the passing verifier as a legal verdict.
The bounded MVP package check is closed on 2026-09-16: all 69 pinned package
files match their recorded hashes, and the source/notices and browser rebuild
checks pass. The native codec provenance limitation remains recorded as an
upstream uncertainty, not an established violation or an additional MVP gate.
This is an engineering release decision, not a claim of independent native
WASM reproduction or a legal assurance. No compiler acquisition is required.

Basis: the shipped Strudel AGPL section 1 distinguishes corresponding source
from unmodified general-purpose tools not part of the work; Csound's LGPL 2.1
sections 4/6 concern the library's corresponding source and relinking materials.
See the [official AGPL text](https://www.gnu.org/licenses/agpl-3.0.dbk) and
[official LGPL 2.1 text](https://www.gnu.org/licenses/old-licenses/lgpl-2.1.dbk).
This review distinguishes the artifacts; it does not infer that every linked
runtime component is exempt from its own source or notice terms.

The original `tetrisgm/chiptunes` repository is public. Development moved on
2026-09-15 to private `tetrisgm/Algorave`; no new public deployment has occurred. The existing root LICENSE is MIT and is unchanged. The new artifact embeds
Strudel and superdough, declared AGPL-3.0-or-later; it must not be represented as an
MIT-only browser bundle. Retain original notices and provide the integrated work's
source with distribution. The UI Help links to the exact source snapshot, AGPL
text, and collected package notices alongside the artifact. No private source
publication or replacement of the original MIT license is required for this
packaging. The license boundary is the integration, not its iframe sandbox.

References checked on this date:
- https://strudel.cc/technical-manual/project-start/ describes Strudel integration,
  compatible licensing, derivative work and source publication requirements.
- https://www.gnu.org/licenses/gpl-faq.en.html describes compatible combinations
  and inclusion of dependent libraries in corresponding source.
- https://www.gnu.org/licenses/license-compatibility.en.html describes combining
  permissively licensed code with copyleft code. Original permissions/notices are
  preserved; labeling the resulting combination does not erase them.

`build.js` builds the same workspace into `dist/algorave`; the existing local
preview command uses the same builder. `dependencies.json` inventories packages
actually included by esbuild's input graph. The full runtime bundles upstream
web.mjs source rather than its prebundled distribution, so transitive inputs and
their notices remain visible. The pattern worker is no longer embedded.
The current inventory has 87 package entries, declaring MIT, ISC, BSD-2-Clause,
BSD-3-Clause or AGPL-3.0-or-later. `THIRD_PARTY_NOTICES.txt` preserves distributed
license/notice files. This inventory is evidence about these installed packages,
not a blanket legal assurance about future dependencies.

The unpublished @strudel/edo 0.1.0 is copied unchanged from Strudel commit
`8f81463b9cb5ddd5f117ed7baef6a1fde9445dc2` into `src/algorave/vendor/edo`.
UPSTREAM.json records the original Git blob hashes for its source, tests,
metadata and repository license. The input graph includes it in the dependency
notices, and the source archive includes those exact files. Its original package
metadata retains workspace dependency declarations; the enclosing application's
lockfile supplies the actual bundled dependencies.

@strudel/draw 1.2.6 is now bundled from `src/algorave/vendor/draw`, copied from
the pinned npm package. Its drawing algorithms remain upstream; draw.mjs and
animate.mjs add lifecycle checkpoint hooks, canvas resize-listener disposal and
current-size animation rendering. Their original files are preserved in upstream/,
with all original package-file SHA-256 hashes in UPSTREAM.json. The modified
source, originals, metadata and AGPL license are included in the source archive.

@strudel/gamepad 1.2.6 is copied unchanged from the same pinned Strudel commit
into `src/algorave/vendor/gamepad`. Its source, package metadata, README and
repository license are preserved with Git blob hashes in UPSTREAM.json. The
application bundles this source against its locked @strudel/core dependency;
its exports retain upstream pattern behavior and module-level toggle state.

Three npm packages omit a standalone license file:
- @tonaljs/progression 4.9.2 declares MIT. Supplement its notices with Tonal's
  umbrella MIT notice, verified at https://github.com/tonaljs/tonal/blob/main/docs/LICENSE
  (Git blob 77ac35ab560a93e9c939409f86f9704f49daf66e).
- chord-voicings 0.0.1 declares ISC and names Felix Roos as author. Its published
  gitHead is 447ee7932851562dcfc480f54f5011430174a30d; that upstream repository also
  has no standalone license. Preserve this exact metadata and the package source;
  do not invent an upstream copyright statement. This omission remains visible
  in the dependency report for release review.

- sfumato 0.1.2 declares ISC and names Felix Roos as author. Its published
  gitHead is b5100e4b39345dbee1ed8c2ac13200ff73604585; both npm and that repository
  revision omit a standalone license. Preserve the metadata supplement and exact
  package. The seven preferred TypeScript/build files are additionally supplied
  in src/algorave/vendor/sfumato, checked against their upstream Git blob hashes.
  Its nested soundfont2 0.4.0 dependency includes its MIT license and source.

The standard sound setup loads Strudel's public bank catalogs and sample audio on
request; remote audio bytes are not embedded in the distribution. Its catalog
selection and piano helper follow Strudel's AGPL REPL prebake.mjs, attributed in
src/algorave/strudel-prebake.mjs. Piano recordings are Alexander Holm's Salamander
Grand Piano (CC BY 3.0); VCSL is CC0. Preserve the source/credit links below rather
than making a blanket license claim for every sample in an upstream collection:
- https://codeberg.org/uzu/strudel/src/branch/main/website/src/repl/prebake.mjs
- https://archive.org/details/SalamanderGrandPianoV3
- https://github.com/sgossner/VCSL
- https://github.com/ritchse/tidal-drum-machines
- https://github.com/tidalcycles/uzu-drumkit
- https://github.com/tidalcycles/uzu-wavetables
- https://github.com/yaxu/mrid
- https://github.com/tidalcycles/Dirt-Samples
- https://github.com/felixroos/webaudiofontdata

`source.tar.gz` contains a source allowlist from the Git working tree and the exact
npm package directories present in the algorave input graph. It includes their
original sources/source maps, package metadata and notices. It excludes dist,
local project data, environment files and repository credentials. SOURCE.json
records each file's SHA-256 and the visible algorave build ID; BUILD.txt describes
rebuilding with the pinned npm dependency lock. The archive is generated from the
same working files as the browser bundle, rather than a potentially older HEAD.
The source snapshot is available beside the bundle even when GitHub is unavailable.

The updated owner goal explicitly requests public web deployment. That request
does not authorize desktop reinstallation, broadcast changes or a license change
to existing source files. The earlier six provider calls were separately authorized.
Native Safari, sustained performance, asset handling and live-provider acceptance
remain separate goal requirements. Preserve this record in the release review.

The motion input module uses @strudel/motion 1.2.6 preferred source under
AGPL-3.0-or-later. Its original checksums and import/lifecycle adaptations are
recorded in src/algorave/vendor/motion/UPSTREAM.json.

The optional experimental Tidal helper includes preferred @strudel/tidal 0.1.0
and hs2js 0.1.0 source (AGPL-3.0-or-later), with pinned web-tree-sitter 0.20.8
and bundled WASM assets. Their provenance is in src/algorave/vendor.


Csound checkpoint: vendor/csound contains the Strudel wrapper and orchestra source;
vendor/csound-browser contains the pinned published browser artifact, source map,
JavaScript source, COPYING/NOTICE, and upstream-source.tar.gz with the engine C and
wasm/browser build sources at the recorded commit. The supplied app build reuses
that unchanged compiled engine. The embedded WASM dependency/source inventory must be resolved before public
release. Independent engine compilation remains a diagnostic option, not an
additional product deliverable.


The Dough integration vendors @strudel/dough 1.3.2 from reference commit
`8f81463b9cb5ddd5f117ed7baef6a1fde9445dc2` and the complete published dough-synth
0.2.4 package. Each has a SHA-256 provenance manifest, original modified files
under upstream/, package metadata and AGPL notice. The synth package includes
its C source, WASM and build script. Independent engine rebuilding now passes
with installed Clang 22.1.0 and Rust LLD 22.1.2; three rendered comparison
programs match the bundled engine sample-for-sample. See the
[rebuild receipt](algorave-runtime-decisions.md#dough-independent-engine-rebuild--2026-09-15). Adaptations embed local assets, use data
worklet modules in the opaque frame, select the existing dominant-trigger API,
and prevent late prepared events from restarting stopped audio. Both packages
appear in the generated dependency/notices report and source archive.

The source-driven editor theme catalog includes 43 original files from the pinned
Strudel commit above, with Git blob and SHA-256 provenance in
`src/algorave/vendor/codemirror/UPSTREAM.json`. The original theme index is retained
in `upstream/`; the adapted index exports the 39 reference themes without upstream
document-wide activation. A derived color-only catalog supplies drawing colors
inside the opaque music frame without importing CodeMirror there. All originals
and adaptations are included in the verified corresponding-source archive.

The pinned core REPL adds evaluator checkpoint/restore methods for transaction
rollback. Its original `repl.mjs` is retained under `vendor/core/upstream/`; the
manifest identifies the adaptation and preserves original blob/checksum values.
Both versions are included in the verified corresponding-source archive.


## Csound embedded dependency inventory — 2026-09-15

Run `node scripts/inspect-algorave-csound-source.cjs` to read the published
bundle and archived recipes without executing downloaded code or installing
tools. It extracts one embedded WASM with SHA-256
`67311f471b48a96173b498a29d6b125cffe1c005410a49bcbd9b9987d27b7707`.
This is an inventory, not completed release-source acceptance.

| Linked dependency | Evidence | Remaining source identification |
| --- | --- | --- |
| libsndfile | Binary string 1.1.0; recipe pins `3bd5048f8c2f7285743e9922c195c7a08f3f5551` | **Source acquired and verified.** The bundled archive reproduces the exact recipe NAR hash. Original COPYING, AUTHORS, ALAC/GSM notices and G72x README are included. |
| mpg123 | Recipe pins 1.29.3 and a fetch hash; binary contains decoder strings | **Source acquired and verified.** `native-sources/mpg123-1.29.3.tar.bz2` matches the recipe SHA-256; original COPYING/AUTHORS are included in generated notices. |
| FLAC | Binary string `reference libFLAC 1.3.3 20221022`; recipe hard-codes `PACKAGE_VERSION=1.3.3` while using `pkgs.flac.src` | Resolve the exact source/patch set; do not equate the string with a verified commit. |
| Vorbis | Binary string 1.3.7; recipe uses `pkgs.libvorbis.src` | Resolve and verify source/patch set. |
| LAME | Binary string 3.100; recipe uses `pkgs.lame.src` | Resolve and verify source/patch set. |
| Ogg | Link recipe includes it and uses `pkgs.libogg.src` | Exact version is not established from the inspected strings or recipe. |

The archived Dockerfile follows `nixpkgs-unstable` and updates that channel;
it does not pin the package-set revision. The SDK recipes separately pin
wasi-libc, LLVM, wasi-sdk, GNU config and Emscripten source patches. These
inputs and the WASI/C++ runtime must be included in the remaining audit.
The package NOTICE lists JavaScript dependencies; it does not establish
coverage of the linked native codecs.

`nix-build` is not installed on this Mac. Do not treat installing Nix as the
solution to the missing source identities: first establish the actual inputs
and notices, then reproduce with an explicit toolchain/package set. No Nix
installation, engine replacement, external publication or license-compliance
claim was made by this audit.

### Pinned mpg123 source receipt — 2026-09-15

The official mpg123 1.29.3 archive has SHA-256
`963885d8cc77262f28b77187c7d189e32195e64244de2530b798ddf32183e847`,
matching Csound's archived `libmpg123.nix` fetch hash exactly.
`native-sources/mpg123.json` records provenance. The inventory script checks
the archive hash against that recipe and the copied license against original
COPYING. The normal source collector includes the archive; the normal notice
collector includes COPYING.mpg123 and NOTICE.mpg123 (original AUTHORS).
Other native dependencies remain open; this is not full packaging acceptance.

### Pinned libsndfile source receipt — 2026-09-15

`python3 scripts/verify-algorave-libsndfile-source.py` verifies the bundled
archive SHA-256, serializes the source tree using the documented NAR format,
and matches `sha256-0yijstgNYlXHhGQwKknp19TqLuat41PPkAg3/ofDs5Q=`
from the archived Csound recipe. This includes file content, names, executable
bits and symlink targets. It also verifies the copied original license.
No Nix installation or downloaded code execution is involved.

Provenance is in `native-sources/libsndfile.json`; the complete source and
per-file headers remain in its archive. COPYING.libsndfile and NOTICE.libsndfile
are collected by the normal notice generator. The Csound source archive retains
its local patch and postPatch/build instructions. The other codec identities
and WASI/SDK source coverage remain unresolved; this is not full acceptance.

### Pinned WASI source receipts — 2026-09-15

The `native-sources/wasi-libc.json` and `wasi-sdk.json` records identify the
bundled original archives. Both match the exact NAR tree hashes in Csound's
archived `wasm/src/wasi-sdk.nix` (also pinned by its static SDK recipe).
Verify with `python3 scripts/verify-algorave-libsndfile-source.py wasi-libc`
and the same command with `wasi-sdk`. The default libsndfile check still passes.
These checks read source bytes, executable bits and symlink targets without
extracting or executing downloaded code.

All top-level LICENSE files are copied unchanged to `COPYING.wasi-*` for the
normal notice collector; per-file notices remain in the complete archives.
The normal source collector includes both archives. LLVM, GNU config and the four unpinned codec identities remain unresolved.
The Emscripten replacements are now covered by the receipt below.
This closes these two source inputs, not the complete release package.

### Pinned Emscripten replacements — 2026-09-15

The two complete replacement files used by the archived SDK recipe are now in
`native-sources/emscripten-new.cpp` and `emscripten-stdlib_new_delete.cpp`.
`emscripten-patches.json` records their immutable upstream URLs and hashes.
`python3 scripts/verify-algorave-csound-patches.py` verifies both byte hashes
against the original Nix recipe, including its Nix base32 representation.
Original file headers and the corresponding libcxx/libcxxabi LICENSE.TXT files
are preserved; `COPYING.emscripten-*` enters the existing notice collector.
The files are source inputs, not replacements for the running browser engine.

The preview build and source-archive verifier pass, including exact browser
bundle reproduction. LLVM and GNU config source coverage and the four unpinned
codec identities remain open; this is not complete source-package acceptance.

### Pinned GNU config source — 2026-09-15

The official Git repository supplies revision
`2593751ef276497e312d7c4ce7fd049614c7bf80`. Its archived tree matches the exact
NAR hash pinned by Csound's SDK recipe. The attempted HTTP snapshot returned
400; the official Git checkout succeeded. No scripts from it were executed.
`native-sources/gnu-config.json` records the archive, source and hashes.
Verify with `python3 scripts/verify-algorave-libsndfile-source.py gnu-config`.
The verifier checks both NAR encodings, the recipe revision/hash, original
config.guess/config.sub notices and the supplied GPLv3 text. The complete
original scripts are retained in the notice files to preserve their exceptions.
Source-archive checks and browser-bundle reproduction pass.

Remaining source identification: LLVM coverage and four ambient codec sources.
The FLAC binary's 1.3.3 field is hard-coded by `libflac.nix`, so it cannot identify
the source release. Do not use it to claim corresponding-source completion.