Open-source credits and provenance

Koder contains third-party adaptations and resources. It must not be described as entirely written from scratch. This inventory identifies observed reuse; it does not certify that every file is original or that every licence obligation in the combined distribution is resolved.

Code and protocol adaptations

The original Lark, DingTalk and Nayuki adoption commits were not recorded. THIRD_PARTY_COMPONENTS.json records immutable upstream revisions checked for these notice copies on 2026-10-19; those verification snapshots are not invented original adoption commits. ISO/IEC 18004 standardizes the QR format; that is distinct from crediting an upstream implementation.

Bundled skill, rule and data resources

The inspected 0.3.0 package includes selected resources from these eight projects under kernel/fusion/ecosystem/resources/. These are skill instructions, prompts, rules or data; the table does not claim that each upstream execution engine is embedded.

Full notice copies are in licenses/, including the per-skill Anthropic licences and Caveman's NOTICE/MIT attribution. The component inventory records paths and SHA-256 values. Third-party resources retain their own terms; the kernel declaration does not replace them.

Runtime and optional external software

The applications/MCP candidate bundles the official @modelcontextprotocol/sdk 1.30.0 (MIT, source) and 100 transitive production/required peer dependencies. Their individual origins, versions and complete license hashes appear in the npmComponents section of THIRD_PARTY_COMPONENTS.json. Runtime files retain the original package layout and licenses under kernel/node_modules/; none is relicensed as KARMEN proprietary code. Gamma integration uses the provider's API/MCP contracts; it does not include Gamma's application source.

• Node.js is the runtime. If needed, the installer downloads an official Node distribution and checks its published SHA-256. Node's own licence and third-party notices remain with that distribution.
• The optional Hermes engine is installed separately and called as an ACP peer process. This is separate from the Hermes-derived JavaScript adaptations above.
• ACP and application API compatibility do not imply ownership of, endorsement by, or a licence to rebrand another vendor's product. The public CLI package declares no npm runtime dependencies; Node's built-in implementations belong to the Node distribution.

Scope and outstanding corrections

The CLI remains under GNU GPL version 3. On 2026-10-19 the granting copyright holders adopted the limited kernel linking permission for the CLI portions they have authority to license. The installed kernel is imported into the same Node.js process by src/agent.mjs and retains its separate proprietary terms. The additional permission does not change third-party licences, remove applicable source or notice obligations, or grant rights in the kernel. Package metadata points to the permission text instead of inventing an SPDX exception identifier. This adoption does not replace or validate the published 0.3.0 archive.

The verified 0.3.0 archive contains an incomplete open-code-review/LICENSE (6,895 bytes, ending mid-sentence). The complete file from the same pinned upstream revision, 11,356 bytes with SHA-256 1945665fdb6968a66ea29438ddee0aee23035365c862e5c4a75b62b303340acf, is supplied here. The next package must carry that file and its updated resource-manifest hash. This documentation commit does not alter the old archive.

Experimental user-supplied memory/personalization skills are outside the inspected 0.3.0 release. Their public redistribution terms are not established by an attachment or a user-provided label; their text is not published by this update. Listing a resource also does not mean its proposed runtime integration has passed acceptance.

Development workflow method references (preview.5)

The original Koder development-workflow instructions and GitHub research adapter were written for this release. Method references: GitHub Spec Kit and obra/superpowers, both reporting MIT licenses when inspected on 2026-10-20. No Spec Kit or newly retrieved Superpowers code/templates were copied into this change. Existing bundled Superpowers resources remain governed by their separately recorded license and pinned revision. This is method attribution, not a claim of upstream endorsement or complete license clearance for future projects.

KARMENLOOP personal-agent-growth 0.3.2

The eight unmodified files from personal-agent-growth v0.3.2 are bundled as a separately licensed method resource, not as a background service. Copyright (C) 2026 KARMENLOOP Official Team. They retain AGPL-3.0-only and their full license and notice. The resource manifest pins each file and the source revision. Koder's own license does not replace these terms.

REA 6.7.0 is bundled under its original MIT license. Its dependencies retain their own licenses and notices, including OpenPGP.js under LGPL-3.0+. See vendor/rea/README.md, vendor/rea/components.json, vendor/rea/node_modules/rea-agents/THIRD_PARTY_NOTICES.md and vendor/rea/sources/. External analysis engines are not included.

Browser automation workflow

The agent-browser core method, command references and three reference templates are bundled from vercel-labs/agent-browser at 468c0526c884722afd9c10bcc0d5b09ed4c0c5d1 under Apache-2.0. The original license and the kernel resource manifest retain provenance and SHA-256 values. These are on-demand method resources; the agent-browser executable and Chromium are not installed by this change. The Koder adapter maps the workflow to actually available computer tools and keeps tool, account and execution authorization separate. Templates are reference text and are never automatically executed.

The existing Anthropic frontend-design files were verified byte-for-byte against anthropics/skills at dbd4588f9e1033efb41dad4bef2f7947c8993d44. They were already current and retain their original Apache-2.0 license. Unrelated skill revisions were not repinned.