# Third-party notices and provenance

The source archive includes the official Gradle wrapper JAR and licence/NOTICE text. Engine source, Maven packages, SDK/NDK tools and model/OCR data are acquired separately from the pinned upstreams. The debug APK includes the compiled llama.cpp/ggml and OCR/AndroidX native libraries, their notices, licence text found in runtime JARs, and the exact standalone dependency inventory at `assets/third-party/dependencies.lock.json`. The standalone build verifies every locked artifact's byte size and SHA-256. This inventory does not claim a completed legal audit of all upstream source contributions.

| Component | Pin | Upstream / licence |
| --- | --- | --- |
| llama.cpp and bundled ggml | `74d4f5b041ad837153b0e90fc864b8290e01d8d5` | [llama.cpp MIT licence](https://github.com/ggml-org/llama.cpp/blob/74d4f5b041ad837153b0e90fc864b8290e01d8d5/LICENSE); retain all additional licences under the source tree |
| Gradle wrapper/tool | 8.11.1 | [Gradle Apache-2.0](https://github.com/gradle/gradle/blob/v8.11.1/LICENSE); [NOTICE](https://github.com/gradle/gradle-distributions/releases/tag/v8.11.1) |
| Android Gradle Plugin | 8.10.1; standalone D8 8.10.21 / merger 31.9.2 | [Android tools source](https://android.googlesource.com/platform/tools/base/); Apache-2.0, applicable distribution notices |
| Kotlin and Compose compiler plugin | 2.2.20 | [JetBrains Kotlin Apache-2.0](https://github.com/JetBrains/kotlin/blob/v2.2.20/license/LICENSE.txt) |
| AndroidX Compose BOM/UI/Material 3, Activity, Lifecycle, Room, DataStore, WorkManager, Biometric, Fragment/test tooling | Pins in `app/build.gradle.kts` | [AndroidX licence](https://android.googlesource.com/platform/frameworks/support/+/androidx-main/LICENSE.txt), Apache-2.0; BOM manages exact Compose component versions |
| Kotlin coroutines | 1.10.2 | [kotlinx.coroutines Apache-2.0](https://github.com/Kotlin/kotlinx.coroutines/blob/1.10.2/LICENSE.txt) |
| Kotlin serialization JSON | 1.8.1 | [kotlinx.serialization Apache-2.0](https://github.com/Kotlin/kotlinx.serialization/blob/v1.8.1/LICENSE.txt) |
| OkHttp (and its resolved Okio dependency) | 4.12.0 | [Square OkHttp Apache-2.0](https://github.com/square/okhttp/blob/parent-4.12.0/LICENSE.txt); preserve Okio's actual resolved licence |
| PdfBox-Android | 2.0.27.0 | [Tom Roush PDFBox-Android](https://github.com/TomRoush/PdfBox-Android), Apache-2.0; preserve Apache PDFBox/fontbox and associated NOTICE files from resolved artifacts |
| Markwon core and tables | 4.6.2 | [Markwon Apache-2.0](https://github.com/noties/Markwon/blob/v4.6.2/LICENSE) |
| Tesseract4Android standard variant | 4.9.0 | [Adaptech Apache-2.0](https://github.com/adaptech-cz/Tesseract4Android/blob/4.9.0/LICENSE) |
| Native OCR transitives | Tesseract 5.5.1, Leptonica 1.85.0, libjpeg v9f, libpng 1.6.48, per the pinned wrapper README | [Tesseract](https://github.com/tesseract-ocr/tesseract/blob/5.5.1/LICENSE), [Leptonica](https://github.com/DanBloomberg/leptonica/blob/1.85.0/leptonica-license.txt), [IJG libjpeg](http://www.ijg.org/), [libpng](https://www.libpng.org/pub/png/src/libpng-LICENSE.txt); carry all respective notices in a distributed native APK |
| Tesseract English data (optional, user imported) | Chosen revision recorded by acquirer; local SHA-256 saved | [tessdata_fast Apache-2.0](https://github.com/tesseract-ocr/tessdata_fast/blob/main/LICENSE) |
| SmolLM2 135M instruction GGUF (downloaded separately) | `c6f2d396a5faa22c9722908d47e8da81a5d8cebc`, digests in catalogue | [Original model card/licence](https://huggingface.co/HuggingFaceTB/SmolLM2-135M-Instruct); [GGUF publisher](https://huggingface.co/bartowski/SmolLM2-135M-Instruct-GGUF), declared Apache-2.0 |
| OptimumCode JSON Schema validator | 0.4.0 JVM | [Upstream](https://github.com/OptimumCode/json-schema-validator/tree/0.4.0), MIT; Draft 7, 2019-09 and 2020-12, no remote schema loader |
| URI KMP | 0.0.19 JVM | [Upstream](https://github.com/eygraber/uri-kmp), Apache-2.0 |
| Kotlin codepoints | 0.9.0 JVM | [Upstream](https://github.com/cketti/kotlin-codepoints), MIT |
| Karacteristics | 0.0.3 JVM | [Upstream](https://github.com/OptimumCode/karacteristics), MIT |
| Doist normalize | 1.1.1 JVM | [Upstream](https://github.com/Doist/doistx-normalize), MIT |
| MobileVLM V2 1.7B and matching projector (acquired separately) | GGUF revision `bb2cbd1cdcc2dd4878ca5ce542716c4a95cbf5d7` | [Original model card](https://huggingface.co/mtgv/MobileVLM_V2-1.7B), [GGUF publisher](https://huggingface.co/cyzero-kim/MobileVLM_V2-1.7B-GGUF), Apache-2.0 |
| stb_image (through pinned llama.cpp CLIP) | b5046 source | [Pinned source](https://github.com/ggml-org/llama.cpp/blob/74d4f5b041ad837153b0e90fc864b8290e01d8d5/common/stb_image.h); dual MIT/public-domain terms retained |
| Android lint / Robolectric (verification tools only) | 31.10.1 / 4.14.1 | Official Google Maven / [Robolectric](https://github.com/robolectric/robolectric); exact verification graph in `scripts/verification-dependencies.lock.json`; not APK runtime dependencies |
| JUnit (tests only) | 4.13.2 | [JUnit EPL-1.0](https://github.com/junit-team/junit4/blob/r4.13.2/LICENSE-junit.txt) |
| org.json JVM test dependency | 20240303 | [JSON-java licence](https://github.com/stleary/JSON-java/blob/20240303/LICENSE); production uses the Android platform's org.json |

No proprietary model licence is bypassed. The curated text entries are unrestricted according to their model cards; the app does not supply credentials or work around restricted access. Importing another model remains subject to that publisher's licence. Android SDK/NDK tools have their own Google terms; review them when provisioning a build environment. They are not redistributed in the source archive or APK.

The supplied Fieldwork design/reference and master prompt remain the user's project inputs; they are not presented as third-party downloadable dependencies. All sample conversation text used for testing is confined to tests.


Native licence texts are retained in `app/src/main/assets/third-party/native/`: Tesseract, Tesseract4Android, Leptonica, libpng and the IJG libjpeg README containing its permission terms. Gradle's licence/NOTICE accompany the wrapper. llama.cpp's MIT licence is added from the verified checkout during packaging. Runtime JAR licences/NOTICE files are retained under `assets/third-party/` rather than discarded with signature metadata. The original APK remains unsigned by any production publisher key; this is an Android debug-key build.

This software is based in part on the work of the Independent JPEG Group. The libjpeg 9f README was retained from Artifex's upstream-source import commit [`1b7cb64a230d079843223cb0ec1dcdb44d7b1492`](https://github.com/artifexsoftware/thirdparty-libjpeg/blob/1b7cb64a230d079843223cb0ec1dcdb44d7b1492/README).

The JSON validator and its URI/Unicode dependencies have their full licence texts under `app/src/main/assets/third-party/native/`. The same directory carries stb_image's licence alternatives. MobileVLM's projector and model are never bundled in the APK.