# Third-party notices

Provenance and redistribution status for everything in this repository that is not original project work. Policy lives in [Docs/licensing.md](Docs/licensing.md).

Status values: **verified** (licence confirmed and permits our use), **pending** (not yet checked), **unresolved** (checked and not cleared — must not be committed or shipped).

## Tools (not distributed)

| Component | Version | Licence | Status |
| --- | --- | --- | --- |
| Unreal Engine | 5.8.x (pin) | Epic Games EULA, proprietary | verified — not redistributable; distribution per Epic terms |
| Blender | 5.2 LTS | GPL-2.0-or-later | verified — tool only, no GPL code linked into a shipped build |
| MPFB | 2.0.18 | CC0 (base mesh and add-on assets) | verified — confirm per-asset at character production |
| Blosm | pin at install | check at install | **pending** |
| QGIS | 3.44.15 LTR | GPL-2.0-or-later | **pending** — tool only |
| Git LFS | 3.x | MIT | **pending** |

## Geographic data

| Component | Source | Licence | Status |
| --- | --- | --- | --- |
| OSM extract — Hollywood block, 2026-11-06 | OpenStreetMap API v0.6, `Geo/raw/osm-api-map-2026-11-06.osm` | ODbL 1.0 | verified — manifest and SHA-256 in `Geo/manifests/` |
| OSM building ways 424024147, 424024148 | OpenStreetMap API v0.6, `Geo/raw/*.json` | ODbL 1.0 | verified |
| Elevation data | not yet decided | per provider | **pending** — decide after the DEM variation check in `ROADMAP.md` |

Attribution string for any OSM-derived output: "© OpenStreetMap contributors", <https://www.openstreetmap.org/copyright>.

## Reference photography (local only, not committed, not shipped)

Reference photographs are **not** part of this repository. They live in the gitignored `Art/reference/` tree on the development machine, are used only for internal, private development, and are never built into a build or shipped. `.gitignore` enforces this; nothing under `Art/reference/` may be added, staged, or committed.

| Local folder | Source | Provenance |
| --- | --- | --- |
| `Art/reference/hollywood/` | Copied 2026-11-06 from `…/06-games/security-game/docs/screens/refs/hollywood/` | That folder's `SIDECAR.md` (author, licence, URL, crop notes) |
| `Art/reference/north-chinese/` | Fetched 2026-11-06 with `Tools/commons_fetch.py` from the Wikimedia Commons API | `sidecar.json` in the folder |
| `Art/reference/north-tussauds/` | Same | `sidecar.json` in the folder |

What the images are used for, what they are evidence for, and the block's recorded measurements live in [Docs/reference-notes-hollywood.md](Docs/reference-notes-hollywood.md). That document is committed; the images are not.

Rules that still apply, because they are about shipped output rather than local working material:

- No reference photograph may be shipped, baked into a texture, or distributed. If a shipped asset would otherwise derive from one, that is a licensing decision to be made before the release, recorded here.
- Venue lettering, signage artwork, and trademarks are separate rights from the photograph. Copying a façade's proportions is not the same as reproducing its signage.
- A reference image whose provenance cannot be found locally must not be used at all.

## Assets

No shipped 3D, texture, or audio assets exist yet. Add a row per asset category with author, source, licence, and redistribution status before the first content commit.