# Licensing

The project source is available under `MIT OR Apache-2.0`. This is an engineering inventory, not legal advice.

## Dependency admission

Before adopting a foundational emulator, decoder, ABI source, runtime, or toolchain component, record:

- exact version or Git revision;
- declared and detected licenses;
- required notices and source-offer obligations;
- whether code is linked, modified, copied, or used only as a behavioral reference;
- transitive dependencies and native-only assumptions;
- `wasm32-unknown-unknown` compatibility;
- maintenance ownership if a fork is required.

`cargo deny check` enforces the current Rust allowlist and rejects unknown registries and Git sources. The pinned Icicle repository is the sole explicit Git-source exception. Its selected leaf manifests omit the workspace license field, so `deny.toml` clarifies `MIT OR Apache-2.0` against checksums of the repository's two license files. CI also audits production web dependencies at high severity or above.

## Current third-party code

| Component | Purpose | License | Source form |
|---|---|---|---|
| `wasm-encoder` | Generate the browser Memory64 fixture | Apache-2.0 WITH LLVM-exception | Rust dependency |
| `wasmparser` | Validate generated WebAssembly in tests | Apache-2.0 WITH LLVM-exception | Rust dev dependency |
| `object` | Parse ELF format, architecture, and image-kind metadata | MIT OR Apache-2.0 | Rust dependency with only `elf`, `read_core`, and `std` features |
| `libfuzzer-sys` | Exercise the ELF byte parser with generated inputs | (MIT OR Apache-2.0) AND NCSA | Isolated fuzz-workspace dependency with its own policy file |
| `wasm-feature-detect` | Canonical browser feature probes | Apache-2.0 | JavaScript dependency |
| `wasm-bindgen` and `wasm-bindgen-cli-support` | Rust browser ABI and reproducible JavaScript/TypeScript glue generation | MIT OR Apache-2.0 | Rust runtime and repository-local build-tool dependencies |
| Vite, TypeScript, Playwright | Build, type-check, and test the probe | MIT / Apache-2.0 | Development dependencies |
| `unicode-ident` | Unicode identifier tables used by the wasm-bindgen macro toolchain | (MIT OR Apache-2.0) AND Unicode-3.0 | Transitive Rust dependency |
| `foldhash` | Hashing used transitively by wasmparser/walrus in the binding generator | Zlib | Transitive Rust build-tool dependency |
| Icicle `pcode`, `sleigh-runtime`, and `sleigh-compile` | Production AArch64 decode/lift input behind project-owned state and operations | MIT OR Apache-2.0 | Pinned Git dependencies; no copied Rust source |
| Other selected Icicle components | Native CPU/interpreter feasibility and future semantic reference | MIT OR Apache-2.0 | Pinned isolated experiment; not in the production graph |
| Ghidra AArch64 language data | Production AArch64 decode and semantics specification | Apache-2.0 | Pinned vendored source closure with retained `LICENSE`, `NOTICE`, certification manifest, and provenance README |

Refresh this table whenever production or foundational dependencies change. Toolchain and guest-runtime distribution manifests will be tracked separately once binary assets are introduced.

## Architecture references

Implementations may use public Arm and Linux specifications as behavioral sources. Do not copy specification prose, diagrams, pseudocode, or GPL implementation code into the permissive project core. ADR-0001 must include the full Icicle license and transitive-dependency review before any adoption decision.