prototype/THIRD_PARTY_NOTICES.md

# Third-party notices

This private prototype uses the following components. No public distribution or contest entry has occurred.

- Mastra core 1.78.0, Apache-2.0 for the workflow components used here. No `ee` components are imported. Its third-party components retain their own licenses. Source: https://github.com/mastra-ai/mastra/blob/main/LICENSE.md
- Hugging Face Transformers.js 3.8.1, Apache-2.0. Source: https://github.com/huggingface/transformers.js
- Zod 4.6.7, MIT. Source: https://github.com/colinhacks/zod
- Model: Xenova/all-MiniLM-L6-v2, revision `751bff37182d3f1213fa05d7196b954e230abad9`, Apache-2.0 as declared in the pinned model card. These are ONNX weights derived from sentence-transformers/all-MiniLM-L6-v2, whose official card also declares Apache-2.0. Source: https://huggingface.co/Xenova/all-MiniLM-L6-v2/tree/751bff37182d3f1213fa05d7196b954e230abad9 ; upstream https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2
- The model is a sentence/short-paragraph embedding model, not a text generator. Input is truncated to 256 wordpieces. No remote custom code is loaded.

Exact npm dependency versions, source archive URLs, integrity hashes, and declared licenses are in `package-lock.json` and `evidence/dependency-licenses.json`. Installed packages contain their original license files. The model's per-file source URLs, sizes, and SHA-256 hashes are in `models/manifest.json`; the pinned model card is saved under `models/Xenova/all-MiniLM-L6-v2/README.md`.

Original code and original synthetic fixtures are prepared for a proposed Apache-2.0 release. The included LICENSE is the standard Apache-2.0 text. Publication and any final release attribution remain subject to the project owner's approval. This notice does not claim ownership of model or dependency code.