Abstract

Long-running agentic research and engineering systems often mix model reasoning with permissions, source selection, evidence interpretation, execution state, evaluation, and deployment decisions. This creates avoidable ambiguity: a model can appear successful while operating on the wrong source snapshot, missing telemetry can be mistaken for zero, execution success can be mistaken for evidence truth, and an accepted experiment can drift into implicit authority to modify or deploy the system itself.

This thesis evaluates an alternative architecture in which those responsibilities are externalized. Human authorization is prospectively bound to frozen contracts; source context is released by identity rather than inherited ambiently; evidence objects are retrieved through integrity checks; provider/runtime identity and unavailable telemetry remain explicit; independent review operates on frozen evidence when required; and successful experiments produce evidence for a later human decision rather than new authority.

The contribution is primarily an integrated operational discipline, not a claim that its primitives are individually new. Preregistration, least privilege, protected approvals, bounded delegation, content addressing, provenance, sandboxing, transparency logs, constrained generation, and human preference evaluation all have strong public precedents. The thesis packages several independently testable specifications and case studies showing how those established mechanisms can be composed into agentic-R&D contracts.

Evidence is deliberately mixed. The Authorized Research Envelope, Verifiable Agent Artifacts, Agent Worker Contracts, EFWH integration, and operational profiles reached reviewed release-candidate boundaries. The bounded semantic-search study was intentionally stopped after 9 of 80 planned human comparisons because the alternatives were often not meaningfully distinguishable; its confirmatory human-preference result therefore remains UNKNOWN. That early stop is retained as evidence about experimental design rather than converted into a positive or null result.

The resulting claim is modest: agentic R&D can be organized so that autonomy occurs inside externally verifiable boundaries while authority expansion, missing evidence, review contamination, and adoption remain explicit. Whether this architecture is better for other domains, organizations, models, or risk levels remains an open empirical question.

Canonical source: ABSTRACT.md

01 — Problem

The common shorthand model → tools → answer hides several different control problems. Who defines what sources count? Which exact bytes were released? What authority was granted? What happened when telemetry was unavailable? Does a successful provider call mean the evidence is valid? Who reviews the result? Who is allowed to adopt it?

When these questions are implicit, agent systems can fail without obvious tool errors. Ambient filesystem access can silently change source scope. Mutable context can make a later run non-comparable to an earlier one. A success status can obscure stale or invalid evidence. Missing measurements can collapse into zero. A model can effectively self-review by carrying persuasive execution context into evaluation. Most importantly, a successful experiment can become de facto permission for the next step even when no human authorized that expansion.

This thesis treats those as contract and provenance problems rather than problems that should be solved by asking the model to “be careful.”

Failure modes under test

• Ambient authority: the worker inherits more permissions or sources than the research question requires.
• Unbound context: results cannot be tied to the exact source/release actually evaluated.
• Evidence/status conflation: provider success is treated as evidence truth.
• Unknown erasure: unavailable telemetry becomes zero, false, or implicit success.
• Self-review contamination: evaluation depends on the executor’s persuasive narrative rather than a frozen evidence corpus.
• Authority creep: an accepted result silently authorizes publication, deployment, or permission expansion.
• Irreproducible claims: public conclusions depend on private infrastructure with no public substitute or visible limitation.

The project therefore asks a narrower engineering question: how much useful autonomy can remain inside the model while these control responsibilities are represented and checked outside it?

Claim binding: C-FROZEN-01.

Canonical source: 01_PROBLEM.md

02 — Design Principles

1. Authority is external. The worker may exercise delegated authority but cannot define or enlarge it. Non-delegable actions remain explicit human gates.
2. Context has identity. Important work binds to exact released inputs, hashes, revisions, or manifests rather than ambient source state.
3. Evidence validity is separate from execution success. A provider may complete while evidence is missing, stale, unverifiable, or out of scope.
4. UNKNOWN is first-class. Missing telemetry or unavailable observations remain UNKNOWN when the decision requires them; they are never fabricated as zero or success.
5. Integrity precedes disclosure where required. Known-object evidence retrieval verifies the complete object before returning content.
6. Resource bounds are prospective. Questions, source sets, operation ceilings, and stop conditions are frozen before outcome-driven pressure can expand them.
7. Review can be isolated. High-assurance decisions use frozen evidence and independent context rather than the executor’s conversation history.
8. Success is evidence, not authority. Passing an experiment or review may support a human adoption decision but never self-adopts, publishes, or expands permission.
9. Reproducibility outranks flattering narratives. Synthetic/open fixtures are preferred when private implementation details are unnecessary for the public claim.
10. Claims are narrower than enthusiasm. Established primitives are credited as prior art; differentiation is stated at the composition or contract level and dated when based on public search.

These principles recur across all packages, but each package is independently scoped. A reader need not accept one package’s results to evaluate the others.

Canonical source: 02_DESIGN_PRINCIPLES.md

03 — Authorized Research Envelope

The Authorized Research Envelope (ARE) is the thesis’s flagship specification: a prospective, hash-bound contract for giving an AI research process bounded autonomy without transferring ownership of authority to the model.

A run becomes active only when a human authorization record binds to the exact frozen envelope identity. Inside that envelope, the executor may research, run bounded experiments, preserve evidence, and adapt within the preregistered question. It may not reinterpret success, missing telemetry, review results, or an attractive next step as permission to enlarge scope.

Normative ideas

• exact envelope identity and human-bound activation;
• explicit non-delegable powers;
• branch-specific questions, released sources, and resource ceilings;
• protected boundaries and mandatory stops;
• raw operation/provenance accounting;
• required UNKNOWN semantics when evidence is unavailable;
• isolated independent review when required;
• conjunctive pass criteria;
• successful execution may support human adoption review but cannot self-adopt, publish, or expand authority.

The reference package is intentionally an advisory/read-only R&D profile, not a universal agent-governance system. Its schemas and invalid fixtures make authority ambiguity, scope expansion, self-adoption, protected-state crossing, missing telemetry, and reviewer contamination machine-checkable.

Public prior art already establishes preregistration, least privilege, approval gates, bounded delegation, guardrails, and tracing. The scoped distinction is the complete composition as one testable R&D authorization contract; the public search through 2026-09-19 did not find a close implementation exposing the whole combination. That is a dated search finding, not a first-invention claim.

Claim binding: C-FROZEN-02.

Canonical source: 03_AUTHORIZED_RESEARCH_ENVELOPE.md

04 — Verifiable Agent Artifacts

Verifiable Agent Artifacts (VAA) narrows evidence retrieval to verification of a known object, not browsing an ambient filesystem.

The caller supplies a known namespace/release identity, relative artifact path, and expected SHA-256. Trusted code resolves the object inside an allowlisted root, rejects path/link escape, verifies the complete object before disclosure, and only then returns deterministic bounded text slices with actual identity, size, offset, and continuation metadata. A digest mismatch or boundary violation returns no content.

The deliberate omissions are part of the protocol: no globbing, recursive listing, semantic search, arbitrary-path fallback, or “helpful” discovery belongs in the core. Discovery and verification are separate capabilities.

The release includes adversarial traversal, digest-mismatch, chunk-reconstruction, Unicode/transport, empty/large-file, and replacement/integrity cases. Historical platform-specific link behavior remains a documented limitation rather than an inferred pass.

Content addressing and provenance are established practice in Nix, SLSA, and related systems. Universal Research MCP provides a close public expected-SHA fail-closed evidence-read analogue. VAA is therefore positioned as a small reusable integrity profile/reference implementation, not as a uniqueness claim.

Claim binding: C-FROZEN-03.

Canonical source: 04_VERIFIABLE_AGENT_ARTIFACTS.md

05 — Bounded Semantic Search

This workstream tests whether a very small semantic proposer can add useful search bias over a strong deterministic heuristic when the model has zero tool authority and can only emit typed, reversible design choices that trusted code validates and renders.

The experiment froze tasks, design grammar, heuristics, model/runtime identities, prompts, arm mapping, candidate generation, trial order, and left/right assignment before the human review. All arms used the same functional task content and trusted rendering path. The frozen proposer was Qwen2.5-0.5B-Instruct Q4_K_M via a llama.cpp-compatible local endpoint with no silent model fallback.

What happened

Held-out generation completed for 24 tasks, producing 96 valid candidates and an 80-comparison blind schedule. Human review was then stopped after 9/80 comparisons because many alternatives were not meaningfully distinguishable and continuing risked turning fatigue into forced preference labels.

That stop invalidated the planned confirmatory analysis. The semantic-versus-heuristic human-preference result is therefore UNKNOWN. Partial ratings are diagnostic only. The original preregistration and pre-review manifest remain frozen; the publication layer carries a separately hashed early-stop addendum instead of rewriting them.

Why the result still matters

The experiment demonstrates a reproducible way to isolate a weak semantic proposer from authority and rendering validity. It also exposed a concrete experimental-design failure: a blind preference study should not begin until generated alternatives pass a perceptual/diversity gate proving that the comparison presents meaningfully different choices.

Schema/catalog-constrained UI generation, trusted renderers, pairwise human evaluation, and preference-guided generation have strong prior art. This release is a diagnostic protocol/case study, not evidence that tiny-model semantic search improves human preference.

Claim binding: C-FROZEN-04.

Canonical source: 05_BOUNDED_SEMANTIC_SEARCH.md

06 — Agent Worker Contracts

Agent Worker Contracts extracts a small interoperability surface from the broader worker-fabric research. It is intentionally not a universal multi-agent orchestrator.

The contract separates an untrusted work request from a broker-created effective JobSpec. The trusted layer binds an exact released context, effective authority, provider/runtime/profile identity, resource-accounting semantics, failure/termination behavior, evidence references, and a normalized ResultEnvelope. Result identity is immutable, and provider execution success remains separate from evidence validity.

Important semantics include:

• child/effective authority must never silently exceed parent or human authority;
• resource accounting distinguishes enforced, observed, unavailable/UNKNOWN, and not-applicable states;
• provider/runtime identity is provenance rather than an implementation detail;
• cross-provider fallback cannot happen silently;
• schema validity does not make a model claim true;
• the current v0.1 profile is single-tier and does not claim live recursive child dispatch.

Current live backend evidence is asymmetric: one remote provider path was observed end-to-end while the local adapter is disabled/incomplete; older two-backend evidence is configuration-specific. Public conformance therefore uses synthetic fixtures instead of claiming universal provider compatibility.

Recent bounded-delegation/policy-algebra work already covers monotone authority and budget restriction, while A2A and agent SDKs cover provider-neutral task/artifact exchange, handoffs, tracing, and execution frameworks. The scoped contribution is the exact released-context/evidence/UNKNOWN/provenance contract and its conformance fixtures.

Claim binding: C-FROZEN-05.

Canonical source: 06_AGENT_WORKER_CONTRACTS.md

07 — EFWH as a Distribution Layer

The Evidence-First Work Harness (EFWH) is the accessible consumer-facing workflow in this portfolio. It organizes long-running work around environment orientation, evidence classes, competing hypotheses, task contracts, bounded execution, evaluation, durable state, and handoff.

THESIS-05 tested whether selected thesis principles could be added without turning EFWH into another orchestrator. The 2.4.0-rc1 source candidate adds an optional assurance profile with authorized-experiment schema support, expected-hash evidence references, explicit UNKNOWN semantics, independent-review guidance, machine-checkable human-only adoption constraints, and exact handoff/release provenance.

The candidate passed repeated release hardening across four revisions. Failures in RC1–RC3 exposed POSIX ZIP path semantics, executable/line-ending portability, repository-layout assumptions, and a Windows short-path digest edge. RC4 added extracted-offline installer execution and installed-payload parity; an isolated Linux review verified 111/111 released files, exact offline ZIP reproducibility, idempotent installation, and npm/offline/canonical payload parity.

These results establish packaging and workflow behavior for the candidate; they do not make EFWH a new theory of long-running agents. Durable progress files, incremental handoffs, evaluation, guardrails, tracing, and context management all have public precedents.

Rights boundary

At the time of THESIS-05 independent review, the EFWH source candidate was UNLICENSED; that historical fact is preserved in source provenance. A later explicit human publication decision selected MIT-0 OR Apache-2.0 for project-owned material. The EFWH snapshot embedded in this publication tree carries that dual-license expression. Third-party material, if any, remains under its own terms.

Claim binding: C-FROZEN-06.

Canonical source: 07_EFWH_AS_DISTRIBUTION_LAYER.md

08 — Operational Profiles

THESIS-06 packages three lower-novelty engineering patterns as profiles/tutorials rather than inventions.

Restricted Snapshot Worker

The profile applies established isolation principles: a restricted worker receives an explicit immutable/hash-bound source release rather than ambient owner-path access; execution is disposable/bounded; output is advisory; and no reverse-apply path exists by default. Public tests validate the contract profile, not universal OS isolation or equivalence to a hardened VM.

Research Journal

The journal uses a hash-linked event sequence for provenance continuity. Synthetic verifier tests cover normal verification, tampering, and reordering. A fresh retained private journal snapshot also verified with zero event-hash or predecessor-link mismatches. This establishes continuity under the implementation’s canonicalization rule; it does not establish the truth of claims inside events or independently attest external evidence.

One-Way Promotion

The profile describes reviewed lab state becoming an immutable consumer release while consumer state persists independently and no reverse synchronization into research source occurs by default. Current exact implementation/acceptance evidence was not recovered, so this remains DESIGN_PROFILE_ONLY / NOT_VALIDATED_PRODUCTION_PRACTICE.

Sandboxing, transparency logs, protected deployments, and artifact promotion all have strong public precedents. The thesis uses these profiles to show how established mechanisms can support the larger separation between research evidence and adoption authority.

Claim bindings: C-FROZEN-07, C-FROZEN-08, C-FROZEN-09.

Canonical source: 08_OPERATIONAL_PROFILES.md

09 — Evidence and Results

Cross-workstream observations

• Release identity and file hashes make later review refer to exact bytes instead of mutable project state.
• Independent review repeatedly found useful defects: cross-platform archive behavior, installer-layout assumptions, and audit-scope limitations were caught after author-side tests had passed.
• UNKNOWN semantics materially affected conclusions: THESIS-03 preference, THESIS-06 production promotion, missing telemetry cases, and legal/rights questions were not converted into success or failure.
• The early-stopped semantic-search experiment is evidence against forcing a preregistered procedure after its measurement instrument becomes uninformative; it is not evidence that semantic search is better or worse.
• Public reproducibility is strongest when private implementation evidence is replaced by synthetic/open fixtures that preserve the invariant being claimed.

Exact hashes, release identities, and review report identities are in RELEASE_INDEX.md.

Canonical source: 09_EVIDENCE_AND_RESULTS.md

10 — Prior Art and Claim Positioning

This is an engineering comparison frozen from a public search dated 2026-09-19. It is not a patent novelty or freedom-to-operate opinion. “No close implementation found” means only that the searched public sources did not reveal one as of that date.

Selected primary/public sources

• OSF Registrations: https://help.osf.io/article/330-welcome-to-registrations
• GitHub Deployments and Environments: https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments
• Bounded Agents, arXiv:2608.15888: https://arxiv.org/abs/2608.15888
• Policy Algebra, arXiv:2608.16402: https://arxiv.org/abs/2608.16402
• OpenAI Agents SDK: https://openai.github.io/openai-agents-python/
• Universal Research MCP: https://github.com/mp-juns/universal-research-mcp
• SLSA Provenance v1.2: https://slsa.dev/spec/v1.2/provenance
• Nix content addressing: https://releases.nixos.org/nix/nix-2.24.2/manual/store/store-object/content-address.html
• A2A specification: https://a2a-protocol.org/latest/specification/
• Docker Sandboxes security: https://docs.docker.com/ai/sandboxes/security/
• Sigstore/Rekor: https://docs.sigstore.dev/logging/overview/
• Vercel json-render: https://github.com/vercel-labs/json-render
• Generative UI/PAGEN: https://generativeui.github.io/
• AlignUI, arXiv:2601.17614: https://arxiv.org/abs/2601.17614

The complete frozen bibliography and search limitations live in the THESIS-07 release. Public wording must retain the dated, scoped nature of negative search findings.

Canonical source: 10_PRIOR_ART.md

11 — Limitations and Open Questions

Evidence limits

• The portfolio contains reviewed specifications and implementation profiles, but it does not establish that this architecture is universally safer, faster, cheaper, or more reliable than alternatives.
• Historical internal implementation evidence is provenance/case-study evidence where appropriate; public claims are scoped to public or synthetic artifacts.
• THESIS-03 stopped after 9/80 human ratings and has no confirmatory preference result.
• THESIS-06 one-way promotion remains a design profile because current production acceptance evidence was not recovered.
• THESIS-04 live backend evidence is asymmetric, and v0.1 excludes live recursive child delegation.
• Platform-specific containment/link behavior and provider interfaces can change and require revalidation.

Open research questions

• What measurable reliability improvement comes from external authority/evidence contracts compared with strong prompt-only or framework-native controls?
• What operational overhead do exact releases, preregistration, and independent review add, and at what risk level is that overhead justified?
• Can authority/resource constraints be verified across recursive multi-agent graphs without losing usability?
• Which UNKNOWN states should block a pass versus merely lower confidence?
• How should release identity compose across distributed services, caches, and nondeterministic tools?
• Can clean independent review remain efficient at scale without becoming a bottleneck?
• Can a redesigned semantic-search study add a preregistered perceptual/diversity gate while retaining a strong heuristic baseline?

Release limits

Final licensing, ownership/employer-policy clearance, attribution identity, repository-history audit, and public release remain human decisions. A negative public-search result never proves global uniqueness.

Canonical source: 11_LIMITATIONS_AND_OPEN_QUESTIONS.md

Reproducibility

The umbrella repository does not require private project infrastructure to evaluate its central claims. Each standalone package exposes a public/synthetic reproduction surface; historical internal evidence is provenance unless explicitly marked otherwise.

THESIS-03 external model/runtime

Exact external model: Qwen/Qwen2.5-0.5B-Instruct-GGUF/qwen2.5-0.5b-instruct-q4_k_m.gguf; size 491400032 bytes; SHA-256 74a4da8c9fdbcd15bd1f6d01d621410d31c6fc00986f5eb687824e7b93d7a9db. It is not bundled. The frozen runtime identity is llama.cpp commit 5d806aa25; runtime binaries/source are not bundled.

Reproduction rule

If a public fixture replaces private evidence, reproduce the stated invariant, not the private environment. For example, the public restricted-worker suite validates the profile contract; it does not prove arbitrary-host OS isolation. The public journal validates hash-chain behavior; it does not reproduce private journal contents or prove event truth.

Exact source candidate and review identities are in RELEASE_INDEX.md.

Canonical source: REPRODUCIBILITY.md

Frozen Public Claims — THESIS-09

These claims inherit the THESIS-07 frozen wording and THESIS-08 audit constraints. Stronger novelty or outcome language is not authorized by this release candidate.

• C-FROZEN-01 — Umbrella: Long-running agentic R&D can be organized so that the model does not own authority, evidence validity, released source scope, resource-accounting semantics, independent review, or adoption; those responsibilities are represented as external contracts and verifiable artifacts.
• C-FROZEN-02 — ARE: The Authorized Research Envelope is an integrated prospective authorization protocol combining exact envelope identity, human activation, non-delegable authority, bounded questions/sources/resources, stop conditions, provenance accounting, UNKNOWN semantics, isolated review where required, conjunctive pass, and a separate human-only adoption/publication gate. No close complete public implementation was found in the sources searched through 2026-09-19; this is a scoped search finding, not proof of first invention.
• C-FROZEN-03 — VAA: Verifiable Agent Artifacts is a known-object evidence-retrieval integrity profile with expected digest, allowlisted namespace, complete-object verification before disclosure, fail-closed mismatch/path escape, deterministic bounded slices, and no ambient discovery. It is not claimed as unique.
• C-FROZEN-04 — Semantic Search: The bounded semantic-search release is a reproducible diagnostic experiment using a tiny zero-authority typed proposer and trusted renderer/validator. The human review stopped early; semantic-versus-heuristic human preference remains UNKNOWN.
• C-FROZEN-05 — Worker Contracts: Agent Worker Contracts is a compact provider-neutral contract surface for exact released context, effective authority, resource-accounting state, provider/runtime provenance, evidence validity, failure/fallback semantics, and immutable result identity. It does not claim a new theory of delegation or established recursive dispatch.
• C-FROZEN-06 — EFWH: EFWH is an operational evidence-first workflow/distribution surface. The thesis candidate adds optional high-assurance contract/evidence/review semantics; it is not a claim of new agent theory. Licensing and ownership/employer clearance remain unresolved human decisions.
• C-FROZEN-07 — Restricted Worker: A concrete hardening/reference profile applying established isolation principles; not a new sandbox model or proof of hardened-VM equivalence.
• C-FROZEN-08 — Research Journal: A tamper-evident hash-linked R&D provenance profile. Chain verification establishes continuity/tamper evidence under its canonicalization rule, not truth of claims.
• C-FROZEN-09 — One-Way Promotion: A design profile illustrating separation of reviewed research evidence from adoption authority, immutable release boundaries, persistent consumer state, and no reverse synchronization by default. It is not validated production practice.

Prohibited wording

Absent a later explicit review with materially stronger evidence, do not use: first-ever, globally unique, invented here, unprecedented, no one else does this, new theory of delegation, novel sandbox, or proven universally safer.

Where a public-search negative finding matters, retain the date and scope: “I did not find a close public implementation combining X, Y, and Z in the sources searched through 2026-09-19.”

Canonical source: CLAIMS.md

Packages

The thesis is publishable as one clean repository while each reusable package remains independently understandable.

• packages/authorized-research-envelope
• packages/verifiable-agent-artifacts
• packages/bounded-semantic-search-lab
• packages/agent-worker-contracts
• packages/evidence-first-work-harness
• packages/operational-profiles

Original independently reviewed source-candidate identities remain documented in RELEASE_INDEX.md and package provenance. The exact combined public tree receives its own manifest and clean-room review.

Canonical source: PACKAGES.md

Release Index

These are the frozen source/review identities from the internal THESIS-00…10 program. They establish provenance for the material assembled into this public tree; they are not public-release authority.

Current publication state

The public tree in this repository is a new post-review assembly incorporating the human-approved public name and dual-license policy plus the THESIS-03 early-stop wrapper. Its exact identity is regenerated in RELEASE_MANIFEST.json and receives a fresh clean-room review before publication. THESIS-06 one-way promotion remains design-profile-only / not validated production practice.

Canonical source: RELEASE_INDEX.md

Security and Trust Boundaries

This repository documents research contracts and reference profiles. It does not itself grant tool permissions, credentials, filesystem access, publication authority, or deployment rights.

Trust model

• Human authorization is authoritative over worker intent.
• Trusted controllers/releases define effective source and authority boundaries.
• Worker/model output is untrusted until evidence and invariants are checked.
• Provider execution success is not evidence validity.
• Missing telemetry remains UNKNOWN where required.
• Independent review may validate evidence for a decision; it cannot authorize adoption or publication.

Publication safety

The THESIS-08 audit scanned 328 manifest-listed candidate files with zero missing/hash/size mismatches and no confirmed credential/private-path/company-secret matches under its configured patterns. That is bounded evidence, not proof that no undiscovered sensitive material exists.

Before public release, scan the exact repository and Git history that will be published, including deleted objects/history if history is retained. Prefer clean repositories created from reviewed candidate trees rather than importing unrelated private history.

Do not add model weights, private journals, raw private ratings/arm maps, credentials, employer data, or host-specific configuration merely because they were available during research.

Security-sensitive claims are scoped to tested contracts and fixtures. The restricted-worker profile is not a formal sandbox proof, and the VAA reference implementation is not a universal filesystem-security guarantee.

Canonical source: SECURITY.md

Third-Party Notices

This file records external components referenced by the public thesis. Project-owned material is dual-licensed under MIT-0 OR Apache-2.0; that choice does not relicense third-party material.

External THESIS-03 model

Qwen/Qwen2.5-0.5B-Instruct-GGUF/qwen2.5-0.5b-instruct-q4_k_m.gguf

• SHA-256: 74a4da8c9fdbcd15bd1f6d01d621410d31c6fc00986f5eb687824e7b93d7a9db
• size: 491400032 bytes
• upstream repository identified the model as Apache-2.0 at the frozen experiment point
• source: https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF
• not bundled in this repository.

External THESIS-03 runtime

llama.cpp, frozen experiment commit 5d806aa25

• official repository: https://github.com/ggml-org/llama.cpp
• project license: MIT
• runtime source/binaries are not bundled in this repository.

Optional THESIS-04 dependency

The portable semantic conformance suite uses the Python standard library. The optional Draft 2020-12 schema validation path requires the external jsonschema Python package; it is not vendored here.

EFWH

The audited EFWH 2.4.0-rc1 source candidate declared no runtime, development, or optional npm dependencies and bundled no model weights. It was UNLICENSED at source-review time; the project-owned publication snapshot embedded here is subsequently dual-licensed under MIT-0 OR Apache-2.0 by explicit human decision.

External papers, standards, repositories, and vendor documentation linked in 10_PRIOR_ART.md are references, not redistributed source.

Canonical source: THIRD_PARTY_NOTICES.md