Licensing and Acknowledgements¶

Pulp License¶

Pulp is released under the MIT License. You can use it for any purpose — commercial, personal, educational — with no royalties, revenue thresholds, or copyleft obligations. See LICENSE.md for the full text.

Third-Party Dependencies¶

Pulp builds on excellent open-source software. Every dependency that Pulp bundles, fetches automatically, or redistributes is compatible with MIT licensing — there is no copyleft in the shipped dependency chain.

Tables are sorted alphabetically (case-insensitive) by name. Entries here must stay in sync with DEPENDENCIES.md, NOTICE.md, and tools/deps/manifest.json (the machine-readable source of truth).

Core Dependencies (Always Used)¶

Name	License	Purpose	Link
Brotli	MIT	Decompression backend for native WOFF2 font registration used by Chromium-materialized imports	github.com/google/brotli
Catch2	BSL-1.0	Unit testing framework	github.com/catchorg/Catch2
CHOC	ISC	JS engine, MIDI utilities, audio file I/O, WebView, networking	github.com/Tracktion/choc
command-group	Apache-2.0	Cross-platform process-tree containment for bounded Rust CLI trace analysis	github.com/watchexec/command-group
cpp-httplib	MIT	HTTP client (GET/POST/download) used by `pulp-runtime`	github.com/yhirose/cpp-httplib
dr_libs	Public domain (Unlicense) / MIT-0	FLAC, MP3, WAV decode (`dr_flac`, `dr_mp3`, `dr_wav`)	github.com/mackron/dr_libs
Highway	Apache-2.0	Portable SIMD abstraction (SSE/NEON/AVX)	github.com/google/highway
Mbed TLS	Apache-2.0 (dual-licensed; Pulp uses the Apache-2.0 option)	Cryptographic primitives (SHA-256, RSA, AES)	github.com/Mbed-TLS/mbedtls
miniz	MIT	ZIP/GZIP compression	github.com/richgel999/miniz
msdfgen	MIT	Reserved for multi-channel SDF glyph generation	github.com/Chlumsky/msdfgen
muFFT	MIT	Float FFT backend for `FftT` on non-Apple targets (Apple uses vDSP)	github.com/Themaister/muFFT
nanosvg	zlib	SVG parsing and rasterization	github.com/memononen/nanosvg
pugixml	MIT	XML parsing and generation	github.com/zeux/pugixml
QuickJS	MIT	Default JavaScript engine, embedded in CHOC's `choc_javascript_QuickJS.h` (`CONFIG_VERSION` 2021-03-27)	bellard.org/quickjs
SheenBidi	Apache-2.0	Unicode Bidirectional Algorithm engine for Arabic / Hebrew / mixed-direction text in `core/canvas::BidiAnalyzer` (independent of system ICU)	github.com/Tehreer/SheenBidi
TweetNaCl	Public domain	Ed25519 sign/verify per RFC 8032 — Sparkle appcast signatures and signed node/package metadata	tweetnacl.cr.yp.to
WOFF2	MIT	WOFF2-to-sfnt decoder used to register the exact packaged web fonts captured by Chromium	github.com/google/woff2
yaml-cpp	MIT	YAML frontmatter parser for the DESIGN.md import pipeline (gated to `--from designmd`)	github.com/jbeder/yaml-cpp
Yoga	MIT	Layout engine for Flexbox/Grid-style native UI	github.com/facebook/yoga

Import Tooling Dependencies¶

These packages are npm-installed for design-import tooling and validation. They are not bundled into Pulp's C++ runtime.

Faithful runnable-HTML import can also invoke a user-installed Google Chrome or Chromium browser and Node.js 22. Pulp does not bundle, link, or redistribute either program with Pulp or generated plugins. The importer launches Chromium with a temporary isolated profile, serves only the authorized input folder over tokenized loopback HTTP, denies external requests by default, captures the evaluated design, and then exits. Generated plugins and applications do not require Chrome, Chromium, or Node.

Name	License	Purpose	Link
Babel parser	MIT	JSX/TSX source-contract extraction for `tools/import-design/jsx-runtime/jsx-contract-audit.mjs`	github.com/babel/babel/tree/main/packages/babel-parser
css-tree	MIT	CSS value parsing and lexer validation for JSX source-contract extraction	github.com/csstree/csstree

Optional Externally Licensed Machine Tools¶

Pulp can manage a pinned copy of Google Chrome for Testing when a developer explicitly runs pulp tool install chrome-for-testing. It is a separate machine-local tool governed by the Google Chrome Terms of Service, not by Pulp's MIT license. Review those terms before installing it.

Pulp downloads the complete official versioned archive from Google's Chrome-for-Testing storage, verifies Pulp's committed SHA-256 pin, and installs it under $PULP_HOME/tools/chrome-for-testing/. It is not part of a Pulp release archive, SDK, plugin, or generated application. Design import never downloads it silently; system Chrome/Chromium remains sufficient, and the managed copy is used only after explicit installation. Normal agent operation does not require a special enable switch: the user-visible pulp tool install command is the opt-in action.

Design-import inspiration and clean-room boundary¶

Pulp's design-import refinements were informed by public architectural ideas studied in Octane and Inferno, especially keyed identity, explicit child-shape lanes, and fail-closed update planning. Pulp's implementation is an independent reimplementation over its existing DesignIR, Skia, and Dawn paths. Pulp does not vendor, link, execute, or redistribute Octane or Inferno code, packages, runtime dependencies, or generated artifacts.

The evidence and transfer decisions are recorded in docs/reports/2026-10-04-design-import-framework-comparison.md These references are architectural background only and do not add a redistributed dependency or a new licensing obligation.

Design Formats and Test Fixtures¶

Pulp adopts Google's DESIGN.md format as a first-class import source (pulp import-design --from designmd). The format specification is reimplemented in C++ (no upstream code vendored); the YAML frontmatter is parsed with yaml-cpp (see Core Dependencies above). One example file from upstream examples/paws-and-paths/ is redistributed verbatim as the test fixture at test/fixtures/imports/designmd/alpha/DESIGN.md.

The importer differential lab's frozen holdout panels in test/fixtures/import-differential/holdout/ are self-contained HTML documents that embed third-party material unmodified: the Spectr standalone bundle carries React, React DOM and @babel/standalone builds plus Inter and JetBrains Mono WOFF2 subsets, and the lattice and kelvin panels inline JetBrains Mono and Jost faces from Forge's tape-machine design pack. The fonts are covered by the SIL OFL 1.1 (see Embedded Fonts below; the license text ships beside the fixtures as OFL.txt), and the scripts by the MIT rows below. Chromium evaluates them only inside the lab's capture; none is built, linked, or shipped.

Name	License	Purpose	Link
Babel standalone (holdout fixture)	MIT	Unmodified `@babel/standalone` 7.29.0 build embedded in the importer differential lab holdout `test/fixtures/import-differential/holdout/spectr-standalone.html`; evaluated only by Chromium inside the lab capture.	github.com/babel/babel/tree/main/packages/babel-standalone
DESIGN.md format spec + `paws-and-paths` fixture	Apache-2.0	Design-system interchange format consumed by `pulp import-design --from designmd`; one upstream example file redistributed verbatim as a Pulp test fixture. Pinned at tag `0.4.0`.	github.com/google-labs-code/design.md @ 0.4.0
Khronos Box Textured fixture	LicenseRef-CC-BY-TM + LicenseRef-LegalMark-Cesium	Official glTF Sample Assets `BoxTextured.glb` redistributed as a Scene3D native loader/render test fixture at `test/fixtures/scene3d/BoxTextured/BoxTextured.glb`.	github.com/KhronosGroup/glTF-Sample-Assets/Models/BoxTextured
React (holdout fixture)	MIT	Unmodified `react` and `react-dom` 18.3.1 development UMD builds embedded in the importer differential lab holdout `test/fixtures/import-differential/holdout/spectr-standalone.html`; evaluated only by Chromium inside the lab capture.	github.com/facebook/react

Embedded Fonts¶

Embedded at build time for deterministic text rendering. Every font below is redistributed under the SIL OFL 1.1, which explicitly permits bundling in software.

Name	License	Purpose	Link
Inter	SIL OFL 1.1	Embedded UI font (`Inter-Regular.ttf`, version `4.001;git-9221beed3`)	github.com/rsms/inter
JetBrains Mono	SIL OFL 1.1	Embedded monospace font (`JetBrainsMono-Regular.ttf`, version `2.304`)	github.com/JetBrains/JetBrainsMono
Jost	SIL OFL 1.1	Embedded UI font (`Jost-Regular/Medium/SemiBold/Bold.ttf`, version `3.710`)	github.com/indestructible-type/Jost
Noto Color Emoji	SIL OFL 1.1	Embedded cross-platform color-emoji typeface (`NotoColorEmoji.ttf`, COLRv1, `noto-emoji main @ 2026-05-17`). Gated by `PULP_BUNDLE_NOTO_COLOR_EMOJI` (defaults ON for Linux/Android/headless, OFF for macOS/Windows where the platform color-emoji typeface is preferred).	github.com/googlefonts/noto-emoji

Plugin Format SDKs¶

Name	License	Purpose	Link
AudioUnitSDK	Apache-2.0	AU v2 plugin format adapter	github.com/apple/AudioUnitSDK
CLAP	MIT	CLAP plugin format headers	github.com/free-audio/clap
LV2	ISC	LV2 plugin format headers	github.com/lv2/lv2
VST3 SDK	MIT	VST3 plugin format (pluginterfaces + base)	github.com/steinbergmedia/vst3sdk

Platform-Specific Dependencies¶

Name	License	Purpose	Link
Gradle Wrapper	Apache-2.0	Redistributed wrapper scripts and bootstrap JAR for the pinned Android Gradle 8.11 toolchain	github.com/gradle/gradle
Oboe	Apache-2.0	Android audio backend (AAudio/OpenSL ES abstraction)	github.com/google/oboe

System Services & OS-Provided Dependencies¶

Pulp integrates with a number of operating-system services, libraries, and frameworks to reach native audio, MIDI, Bluetooth, accessibility, windowing, and desktop-integration features. Pulp does not bundle, vendor, fetch, or redistribute any of these — they are provided by the user's operating system or installed by the user, and Pulp reaches them by dynamically linking a system library, dlopen-ing it at runtime, talking to a system service over D-Bus IPC, or invoking a command-line tool as a subprocess. They are therefore not listed in NOTICE.md (which covers code Pulp redistributes), but are recognized here because Pulp uses them.

Name	License	How Pulp uses it	Platform
ALSA (alsa-lib / `libasound`)	LGPL-2.1-or-later	Dynamically linked for native audio + MIDI I/O	Linux
JACK (libjack; incl. PipeWire's JACK layer)	LGPL-2.1-or-later	Optional low-latency audio; linked only when present at build time	Linux
D-Bus (`libdbus-1`)	AFL-2.1 OR GPL-2.0-or-later	Runtime-`dlopen`ed desktop IPC transport (portals, accessibility, BlueZ) — no build-time link	Linux
BlueZ (`org.bluez`)	GPL-2.0-or-later (daemon), LGPL-2.1-or-later (libraries)	Bluetooth-LE MIDI via the `org.bluez` D-Bus service (IPC only; not linked)	Linux
xdg-desktop-portal	LGPL-2.1-or-later	Native file open/save dialogs via D-Bus (IPC)	Linux
AT-SPI2 (at-spi2-core)	LGPL-2.1-or-later	Accessibility tree exposed over the a11y D-Bus (IPC)	Linux
xclip / xsel / wl-clipboard	GPL-2.0-or-later / GPL-3.0-or-later	Arbitrary-MIME clipboard via subprocess (not linked)	Linux
Windows SDK / WinRT (Windows.Devices.Bluetooth, WASAPI, UI Automation, Win32)	Microsoft — OS/SDK provided	Bluetooth-LE MIDI, audio I/O, accessibility, dialogs, windowing via system APIs (base SDK; no out-of-band package)	Windows
Apple system frameworks (CoreAudio, CoreMIDI, CoreBluetooth, Cocoa/UIKit, …)	Apple — OS provided	Audio/MIDI/Bluetooth/windowing via system frameworks	macOS / iOS

Application-selected provider and host integrations¶

Pulp's external-input contract is an application boundary, not a redistributed dependency. An application may select a camera, sensor, controller, analysis worker, network service, or third-party provider and forward bounded frames to Pulp through an existing ingress such as OSC, IPC, MIDI, or a shared buffer. The provider remains responsible for its own license, capture code, inference, permissions, and lifecycle. Pulp does not bundle, fetch, link, or redistribute those provider implementations, and they do not add rows to NOTICE.md, DEPENDENCIES.md, or the dependency manifest.

The contract is documented in the Real-World Inputs guide. It is experimental and provider-neutral; values carry application-defined meaning and are validated by pulp::runtime::ExternalInputGate.

Docs Build & Site Assets¶

The public docs site (generouscorp.com/pulp/) is generated by MkDocs Material. The following Python packages and their bundled CSS/JS/SVG assets are redistributed as part of the generated site.

Name	License	Purpose	Link
Material Design Icons	Apache-2.0	Icon set bundled inside mkdocs-material; redistributed as SVG in the generated docs site	github.com/Templarian/MaterialDesign
mkdocs	BSD-2-Clause	Static site generator (transitive via mkdocs-material); theme assets redistributed in the generated docs site	github.com/mkdocs/mkdocs
mkdocs-awesome-pages-plugin	MIT	MkDocs plugin for navigation ordering (build-time)	github.com/lukasgeiter/mkdocs-awesome-pages-plugin
mkdocs-git-revision-date-localized-plugin	MIT	MkDocs plugin for git-revision dates (build-time)	github.com/timvink/mkdocs-git-revision-date-localized-plugin
mkdocs-material	MIT	Material theme — CSS, JS, SVG icons, and search worker redistributed in the generated docs site	github.com/squidfunk/mkdocs-material
Pygments	BSD-2-Clause	Syntax highlighter used by `pymdownx.highlight`; redistributed as inline HTML/CSS	github.com/pygments/pygments
pymdown-extensions	MIT	Markdown extension bundle used by mkdocs-material (admonitions, tabs, superfences, highlight, emoji)	github.com/facelessuser/pymdown-extensions

Optional Vendor SDK Integrations¶

Optional third-party integrations are off by default and follow one of two distribution models. Some depend on proprietary, developer-supplied SDKs that Pulp never bundles, fetches, exports, or redistributes. Others are permissively licensed dependencies that Pulp fetches via FetchContent only when a developer opts in, and therefore — unlike the proprietary SDKs — do carry NOTICE.md and DEPENDENCIES.md entries. Both kinds stay out of Pulp's default MIT dependency chain until you enable them.

Developer-Supplied Vendor SDKs¶

Separately licensed SDKs that Pulp does not bundle, fetch, export, or redistribute. They are outside Pulp's MIT dependency chain, are supported only through explicit opt-in local configuration, and are intentionally absent from NOTICE.md.

Name	License	Purpose	Distribution
AAX SDK	Separately licensed by Avid	Optional AAX plugin format support	Developer obtains it independently and points `PULP_AAX_SDK_DIR` at an out-of-tree SDK copy
Ableton Link	GPLv2+ or proprietary by arrangement with Ableton	Optional desktop session tempo, beat, phase, and start/stop synchronization	Developer obtains `Ableton/link` independently under suitable rights, keeps it out-of-tree, points `PULP_ABLETON_LINK_SDK_DIR` at it, and sets `PULP_ENABLE_ABLETON_LINK=ON`. Never bundled.
ARA SDK	MIT-compatible (Celemony)	Optional ARA 2.x integration (pitch correction, spectral editing, clip-aware workflows)	Developer obtains it independently (`https://github.com/Celemony/ARA_SDK`), keeps it out-of-tree, points `PULP_ARA_SDK_DIR` at it, and sets `PULP_ENABLE_ARA=ON`. Never bundled.
ASIO SDK	Proprietary (Steinberg)	Optional ASIO device I/O integration	Developer obtains it independently; never bundled or exported by Pulp

Pulp's MIT license does not grant any rights to these vendor SDKs or to any related Avid/PACE tooling. See AAX Setup for the supported local workflow.

Optional Fetched Third-Party Integrations¶

Permissively licensed integrations that Pulp fetches via FetchContent only when the developer opts in (for example with pulp add). Because Pulp redistributes them through the build when enabled, they do get NOTICE.md attribution and a DEPENDENCIES.md row — the divergence from the developer-supplied SDKs above.

Name	License	Purpose	Distribution
Moonbase (moonbase-cpp)	MIT	License activation / copy protection (online/offline/trial activation, RS256 JWT validation, seat management)	Header-only SDK fetched via FetchContent on opt-in (`pulp add moonbase`); exports the CMake target `moonbase::licensing`. Used by `examples/moonbase-activation/`.
MTS-ESP (ODDSound/MTS-ESP)	0BSD	Session-wide microtuning client API, including MTS-ESP master queries, MTS SysEx fallback, note filtering, and multi-channel tuning tables	Source-only client fetched via FetchContent on opt-in (`PULP_ENABLE_MTS_ESP=ON` or `pulp add mts-esp`). The client dynamically loads an installed libMTS shared library at runtime when present and falls back locally when no master is installed. Installed SDKs may ship Pulp-owned wrapper glue for `pulp_enable_midi_tuning_provider()`, but not the ODDSound client source unless the developer opts in.
Sparkle (sparkle-project/Sparkle)	MIT (bundles bsdiff BSD-2-Clause, sais-lite MIT, ed25519 zlib)	Auto-update for macOS standalone apps: appcast checks, EdDSA-verified downloads, installer-package updates	Official release asset fetched with a pinned SHA-256 only when a project calls `pulp_add_sparkle()`; `Sparkle.framework` is embedded in that standalone `.app` and redistributed with it, so the app's acknowledgements must carry Sparkle's notice. Never placed in plug-in bundles; a default Pulp build never downloads it.
Surge Synth Team tuning-library (surge-synthesizer/tuning-library)	MIT	Scala `.scl` / `.kbm` parsing and tuning-table lookup for direct local file-based microtuning	Header-only source fetched via FetchContent on opt-in (`PULP_ENABLE_SCALA_TUNING=ON` or `pulp add sst-tuning-library`). Pulp uses it source-only and exposes it through `pulp::midi::ScalaTuningProvider`; the upstream CMake tools/tests are not added to consumer builds. Installed SDKs may ship Pulp-owned wrapper glue for `pulp_enable_midi_tuning_provider()`, but not Surge's tuning-library source unless the developer opts in.

See the Copyright Protection guide for setup, the audio-thread gating rule, and the reference plugin.

GPU and Windowing¶

Name	License	Purpose	Link
Dawn	BSD-3-Clause	WebGPU implementation (Metal, D3D12, Vulkan), pinned via the DEPS of Skia `chrome/m158` at `be7d7c3e996e` (the bundled build reports Dawn `1716e88cc9e5`)	dawn.googlesource.com
ICU	Unicode-3.0 (+ ICU, BSD, IPADIC/ICOT dictionary notices)	Unicode text segmentation, bidi and normalization data linked through Skia (`libskunicode_icu.a`), ICU 78.2; data subsetted to what Pulp's text stack reads	github.com/unicode-org/icu
SDL3	zlib	Cross-platform windowing and input	github.com/libsdl-org/SDL
Skia	BSD-3-Clause	2D GPU rendering engine (Graphite backend), pinned to `chrome/m158 @ be7d7c3e996e` with bundled HarfBuzz and ICU DEPS revisions locked for deterministic text shaping	skia.org
vellum-gpu-runtime	MIT	The GPU device layer Pulp's macOS device targets forward to (the Vellum repository's `gpu-runtime/`, pinned by commit); adds no third-party code	github.com/Generous-Corp/vellum
WebGPU-distribution	MIT	WebGPU C API wrapper for Dawn	github.com/eliemichel/WebGPU-distribution
wgpu-native	MIT OR Apache-2.0	Prebuilt WebGPU runtime library staged beside desktop GPU modules; release assets SHA-256 pinned	github.com/gfx-rs/wgpu-native

Optional Dependencies¶

Fetched or installed only when the corresponding CMake option, platform gate, or developer tool is used. Developer-only entries (e.g. the video-proof composer's ffmpeg-static and Remotion) are never bundled into Pulp or shipped in end-user plugins — Pulp commits only its own glue source and the packages are installed on demand via npm.

Name	License	Purpose	Link
DRACO	Apache-2.0	Optional glTF mesh decompression; fetched only when `PULP_ENABLE_DRACO=ON`	github.com/google/draco
Emscripten	MIT	C++ to WebAssembly compiler (for WAMv2/WebCLAP)	emscripten.org
fastgltf	MIT	Optional native no-JS glTF/GLB parser; fetched only when `PULP_ENABLE_SCENE3D=ON`	github.com/spnda/fastgltf
ffmpeg-static	Wrapper MIT; bundled FFmpeg binaries GPL/LGPL	Developer-only desktop video-proof composer (`tools/local-ci`); encodes captured frames to MP4 (a system `PULP_FFMPEG` works too). `npm`-installed on demand — never bundled or shipped in plugins	github.com/eugeneware/ffmpeg-static
node-addon-api	MIT	Node.js bindings via Node-API	github.com/nodejs/node-addon-api
Node.js runtime	MIT and bundled third-party notices	Self-contained runtime shipped with browser-backed design import	github.com/nodejs/node
pybind11	BSD-3-Clause	Python bindings for HeadlessHost	github.com/pybind/pybind11
react	MIT	Peer dependency of `@pulp/react` (packages/pulp-react); npm-installed by plugin authors, never bundled into Pulp itself	github.com/facebook/react
react-reconciler	MIT	Reconciler runtime wrapped by `@pulp/react` to drive `pulp::view::WidgetBridge`; npm-installed alongside the package	github.com/facebook/react
Remotion	Remotion License (source-available; free under their tier, paid company license above it)	Developer-only desktop video-proof composer (`tools/local-ci`); turns automation run bundles into short annotated MP4s. `npm`-installed on demand — never bundled or shipped in plugins. Companies over Remotion's free tier need a license	github.com/remotion-dev/remotion
scheduler	MIT	Cooperative-scheduling runtime pulled in transitively by `react-reconciler` for `@pulp/react`; npm-installed	github.com/facebook/react
simdjson	Apache-2.0	JSON parser used by fastgltf; fetched only when `PULP_ENABLE_SCENE3D=ON`	github.com/simdjson/simdjson
three.js	MIT	Pinned native WebGPU runtime for demos, tests, and installed-SDK consumers; fetched or supplied through `PULP_THREEJS_RUNTIME_DIR` when `PULP_ENABLE_THREEJS_RUNTIME=ON` (the default with GPU support)	github.com/mrdoob/three.js
V8	BSD-3-Clause	Optional JS engine backend, selected with `PULP_JS_ENGINE=v8` (default is QuickJS; JSC is opt-in on Apple with `PULP_JS_ENGINE=jsc`). Sealed prebuilt `libv8` (bundles ICU/zlib/Abseil internally — see NOTICE.md); fetched per-platform via `tools/scripts/fetch_v8_for_release.py`. V8 is unavailable as a Pulp iOS runtime; the m158 jitless simulator framework is retained only for provider/header provenance validation	github.com/danielraffel/v8-builder

Developer-Only Tooling (not shipped)¶

Building, testing, and reviewing Pulp uses developer-only tools that are never bundled into Pulp or shipped in end-user plugins — installed on demand via npm/pip or by the developer (mise), and used under their own licenses. (The video-proof composer's Remotion and ffmpeg-static are listed under Optional Dependencies above.) Full inventory and boundary live in DEPENDENCIES.md.

Name	License	Purpose
esbuild	MIT	Build-time JS/TS bundler for `@pulp/react`, `pulp-import-ir`, the Figma plugin, and the Three.js bundle
fflate	MIT	Deflate/zip in the developer-only Figma plugin
json-schema-to-typescript	MIT	TypeScript type generation for the Figma plugin
melatonin_perfetto (sudara/melatonin_perfetto)	MIT	Compile-time `PRETTY_FUNCTION` trimmer adapted into `pulp::runtime::trace_detail::prettify_function` (only that component; dev-only, compiled under `PULP_TRACING`). See NOTICE.md
mise (jdx/mise)	MIT	Developer-installed locked installer and task runner for the exact build-tool versions pinned in `tools/toolchain/manifest.toml` (CMake, Ninja, Python, Node.js, clang-format, Tart). Use it for reproducibility-sensitive builds, Windows VM probes, release investigations, and toolchain changes. It is never bundled or shipped; setup/CI migration remains a reviewed follow-up. See Pinned Build Tools with mise
numpy	BSD-3-Clause	Motion visual-analysis lane (`tools/motion/visual`) and the Audio Quality Lab (`tools/audio/quality-lab`)
opencv-python	Apache-2.0 (OpenCV); packaging MIT	Optional affine estimation for the Motion visual-analysis lane (graceful fallback)
Perfetto (google/perfetto)	Apache-2.0	Dev-only tracing SDK (amalgamated `perfetto.cc`/`perfetto.h`); fetched by pinned URL + SHA-256 via `tools/cmake/PulpTracing.cmake` only when `PULP_TRACING=ON` (OFF by default; never linked into a shipping build, never exported by `cmake --install`). The pinned `trace_processor` query tool (same v57.2) backs `pulp trace query --trace` and is fetched on demand by `pulp trace fetch`, SHA-256-verified per platform, never linked or shipped
Pillow	HPND (BSD-style)	Image IO for the Motion visual-analysis lane
scikit-image	BSD-3-Clause	Image metrics for the Motion visual-analysis lane
soundfile (libsndfile)	BSD-3-Clause (package); libsndfile LGPL-2.1	WAV/audio IO for the Audio Quality Lab
TypeScript	Apache-2.0	Type-checking/build for the TypeScript packages and the Figma plugin
Vitest	MIT	Unit tests for `@pulp/react` and `pulp-import-ir`

Audio Quality Lab — optional perceptual models + MIR oracle (not bundled, developer-supplied). The Audio Quality Lab (tools/audio/quality-lab) can optionally consult full-reference perceptual audio-quality models and an independent MIR structural oracle as advisory cross-checks. These are never bundled, vendored, fetched, or shipped; each is reached only across a process boundary via its own explicit env-path the developer sets, and the lab degrades to "skipped" when one is absent (the default, and always in public CI) — each tool independently, so any subset can be enabled. They are acknowledged here even though Pulp does not distribute them:

Name	License	Env-path	Role
ViSQOL	Apache-2.0	`PULP_VISQOL_BIN`	full-reference perceptual MOS-LQO (music + speech)
PEAQ (ITU-R BS.1387; e.g. GstPEAQ, PeaqB)	GPL	`PULP_PEAQ_BIN`	classic broadcast perceptual ODG — developer-local only
AQUA-Tk	GPL-3.0	`PULP_AQUATK_BIN`	PEAQ port + embedding distances — developer-local only
aubio	GPL-3.0	`PULP_AUBIO_BIN`	MIR structural oracle (onset cross-check) — a feature extractor, not a perceptual metric; developer-local only

The perceptual layer is deliberately full-reference and music/general-audio; speech (PESQ, POLQA) and no-reference neural speech metrics (DNSMOS, NISQA) are out of scope. The GPL-licensed tools above are used only as separate developer-installed programs over a process boundary; no GPL code is compiled, linked, or redistributed with Pulp.

Type-only @types/* and @figma/plugin-typings, and environment-supplied prerequisites — the Rust toolchain (cargo/rustc), yamllint (GPL-3.0), actionlint, and Docker — are likewise developer/CI-only and never shipped.

Standards and Specifications¶

Pulp implements or builds on these open standards:

Standard	Organization	Purpose
Audio Unit	Apple	Plugin format specification
CLAP	Clever Audio	Plugin format specification
DAWproject	Bitwig	DAW project interchange format (bounded import + export)
LV2	LV2 Community	Plugin format specification
Standard MIDI File	MIDI Association	SMF format 0/1 import and export against the tempo map
MIDI 2.0 UMP	MIDI Association	Universal MIDI Packet format
OSC 1.0	CNMAT	Open Sound Control messaging
VST3	Steinberg	Plugin format specification
WAMv2	Web Audio Modules	Web plugin standard
WASI	WebAssembly CG	System interface for WebAssembly
Web Audio API	W3C	Browser audio processing
Web MIDI API	W3C	Browser MIDI access
WebCLAP	WebCLAP	Portable CLAP plugins via WebAssembly
WebGPU	W3C	GPU rendering API

DAWproject and SMF: specifications, not fetched code

Listing a standard here does not by itself say whether Pulp uses a vendor SDK for it — several do. VST3 ships against the Steinberg SDK, Audio Unit against Apple's AudioUnitSDK, and CLAP is fetched via FetchContent; those are covered under Plugin Format SDKs and carry their own attribution.

DAWproject and Standard MIDI File are different: Pulp implements both directly from their published specifications. It fetches no SDK, vendors no source, and bundles no schema for either, so neither carries a NOTICE.md entry or a DEPENDENCIES.md row — there is nothing third-party being redistributed. That is why they are not under Optional Fetched Third-Party Integrations, where the distinguishing fact is that Pulp does redistribute the dependency through the build.

Pulp's DAWproject reader and writer are its own code over pugixml (MIT, already a core dependency and attributed as one). Support is a deliberately bounded, fail-closed subset, not full-format coverage:

Import accepts flat, beats-timed note and audio tracks. Nested groups, warps, seconds-timed lanes, and any construct outside the subset fail the import rather than being silently dropped.
Export emits flat tracks, beats-timed clips, inline notes, referenced audio, and a single tempo and meter — plus an in-band loss manifest inside the package. Everything outside that subset (markers, clip gain and fades, embedded media, mixer state, automation, devices, take lanes, freeze) is declared lost in the capability table and refused unless the caller accepts each concept by name. There is no force flag.
A neutral channel (unity volume, centre pan) is written so a receiving DAW registers the track. That is not an export of authored mixer state, which is still reported as dropped.

Concept-by-concept status is in the interchange matrix; the API is in the Timeline SDK.

Pulp's JS/React UI layer also targets the web-platform standards below. These are implemented as a deliberate, tracked subset (Pulp is Flexbox + Grid only by design — see the layout model); per-property / per-API status lives in the project compatibility matrix, and @pulp/react provides a React-compatible renderer (via react-reconciler) over the same WidgetBridge.

Standard	Organization	Purpose
CSS Flexible Box Layout Level 1	W3C	UI layout — flexbox box model (via Yoga)
CSS Grid Layout Level 1	W3C	UI layout — grid (partial; via Yoga)
CSS (visual properties)	W3C	Box model, color, typography, transform/transition subset applied to the view tree
HTML Canvas 2D Context	WHATWG	2D drawing API exposed to JS UIs (backed by Skia / CoreGraphics)
DOM & UI Events	WHATWG	`document` / `Element` / event subset targeted by the JS UI layer
ECMAScript	Ecma International (TC39)	JavaScript language for scripted UIs (engine-dependent: QuickJS / JSC / V8)
W3C Design Tokens (DTCG)	W3C Community Group	Design-token interchange format (import / export)
Unicode Bidirectional Algorithm (UAX #9)	Unicode Consortium	Bidirectional text layout (via SheenBidi)
glTF 2.0	Khronos Group	Optional 3D scene/asset format (Scene3D)

Attributed Mathematical Source Material¶

The entries below are not fetched libraries or runtime dependencies. They name specific published mathematical material adapted into Pulp source and the permission basis Pulp relies on. They are also recorded in NOTICE.md.

Project	Permission	How Pulp Uses It
Fast MiniMax Polynomial Approximations of Sine and Cosine by Lasse Schlör	No formal SPDX license declared; used under the author's public permission comment	Pulp adapts the selected degree-5 and degree-9 normalized-cycle sine coefficient expressions from pinned revision `d65178e`. Pulp supplies its own phase folding, float rounding, semantic profiles, verification, and consumer integration; upstream scripts, prose, plots, site assets, and unrelated coefficient tables are not redistributed.

Projects That Inspired Pulp¶

Project	License	What We Learned
Astral (uv, Ruff, ty)	Apache-2.0 / MIT	CI/CD security baseline, supply chain hardening, and release process discipline. Pulp adopts several practices from their open-source security post. Already in place: branch protection on `main`, tag protection on `v*`, default read-only workflow tokens, immutable release identity via tag protection. In progress: action SHA pinning via Renovate, immutable release artifacts, Sigstore release attestations, `zizmor` workflow lint in CI.
AudioKit	MIT	Swift audio patterns, Apple platform integration
ctx	ISC	A vector UI protocol, not just a rasterizer: ctx treats a drawing as a recordable command stream that can be written out, diffed and replayed (`ctx_render_stream` / `ctx_parse`), carrying relative units inline (`100%`, `1@` for em). Pulp took the serialising half only — a text form of a `RecordingCanvas` drawlist, which is position- AND material-aware and so covers the two blind spots every pixel scorer here documents — and deliberately not the parsing half, because Pulp already has two round-trippable draw formats in SKP capture and the canvas2d API the ops were authored in, and a third nobody authors in would be dead weight. Separately, ctx's `deps/` is where we found libDaltonLens (below); ctx vendors it without wiring it into the renderer, so the credit there is for carrying the dependency at all, not for a CVD feature. Pulp implements this independently; no ctx source is copied or vendored. Thanks to Øyvind Kolås.
ELYSIUM by Julian Behrens	Figma Community (design; not redistributed)	A real-world plugin UI we used to harden Pulp's Figma design-importer: faithful-vector SVG rendering and crop, knob/shape fidelity (indicator erasure, value-driven fills), and the source-detected native interactive overlays (search, dropdown, `< >` stepper, tabs). Used only as a private test reference — the design is not vendored, bundled, or shipped in Pulp, and nothing about it is hardcoded; the lessons are generalized. Thanks to Julian Behrens (vst-design.com) for sharing it on the Figma Community.
Inferno	MIT	Design inspiration for Pulp's design-import pipeline; Pulp contains no Inferno code. See Inferno below.
iPlug2	zlib-like	Multi-format adapter architecture, graphics abstraction
libDaltonLens	Public domain	The colour-vision-deficiency model behind Pulp's palette check: Viénot 1999 for protanopia and deuteranopia as a 3x3 matrix applied in linear RGB (applying it to gamma-encoded values looks plausible and is wrong, the same trap as shading in sRGB), with severity as a linear blend toward the unimpaired colour. Pulp deliberately does not implement tritanopia: libDaltonLens documents its own Viénot tritan matrix as inaccurate and directs callers to Brettel 1997, and a simulation that is quietly wrong is worse than one that is absent — it would let a palette pass a check that never actually looked. Pulp re-implements the published matrices in Python; no libDaltonLens source is vendored.
MotionEyes	MIT	Agent-first motion observability shape behind `pulp::view::motion`: the `Trace.value` / `Trace.geometry` / `Trace.scrollGeometry` DSL, FrameClock-driven change-only sampling with epsilon/precision, the SwiftUI `GeometryReader` probe pattern, and the Start/End burst framing that lets agents read animation behavior from logs instead of guessing from source. Pulp re-implements all of this from scratch in cross-platform C++20 with Swift, Kotlin (Android), and JS facades — no MotionEyes source code, headers, or fixtures are copied or vendored. We learned the shape; the implementation is independent.
Octane	MIT	Inferno's successor, studied with it as a reference design for Pulp's design import. Pulp's plans take from it the split of each component into static structure compiled once and dynamic slots that alone update, and keyed slot identity preserved through replay, which Pulp adopted on its existing `stable_anchor_id` instead of a second key field or compiler. Pulp does not depend on Octane, and no Octane source is copied or vendored.
PreText	MIT	Measure-once, reflow-forever text layout. Pulp's `pulp::canvas::TextShaper` / `PreparedText` adopt PreText's two-phase model directly: `prepare()` shapes multilingual text once through Skia/HarfBuzz and caches segment widths plus real font metrics, and `layout()` reflows arithmetically at any width with no font calls — so wrapped height, virtualization, and width-only relayout stay cheap, and streamed or resized text does not shift. Pulp re-implements the pattern from scratch in C++20; no PreText source is copied or vendored. We learned the shape — thanks to chenglou for articulating it so clearly.
React Native Skia	MIT	A reference for keeping Skia work off the hot path, studied for Pulp's importer and renderer. Pulp's plans take from it the rule that an image is decoded and uploaded once and then reused as an object with a stable identity, so a repaint never decodes or uploads again (Pulp's inline `data:` images are the case it exposed); taking a Graphite surface's image without the copy a snapshot always makes; and invariance tests that change one inert property and assert nothing else in the render moves. Pulp does not depend on React Native Skia, and no React Native Skia source is copied or vendored.
react-native-skia-webgpu-video	MIT	A Skia Graphite and WebGPU video compositor, studied for its GPU resource discipline. Pulp's plans take from it two rules: never hand Graphite a fresh raster image for unchanged pixels, because each new image is a new cache key and a new upload, and treat a Graphite submission as complete only when its recording and submit results are checked, never because a flush returned. Pulp does not depend on react-native-skia-webgpu-video, and no source from it is copied or vendored. Thanks to Sebastien Hecart.
Redraw	Proprietary (technical preview; no public source)	A wide set of front-end capability ideas, and one reframing: treat expressive rendering as a substrate authors reach for, not a catalogue of effects we ship. Redraw's model — every shape is a signed distance field evaluated at fragment time, with distance, arc length, tangent and cross-stroke position handed to author-written GPU functions — is what makes variable-width and geometry-aware strokes, colour that follows a path, analytic feathering that stays correct at the 1-3px radii where a raster blur is only softening an already-antialiased edge, and shape operators that compose a compound silhouette so translucent paints never double-blend and a stroke follows the combined outline. It also sharpened two things Pulp already had and under-used: `sdFlatArc` computes arc length and cross-stroke distance and threw both away, and bevel/material shading existed but was reachable only for the text atlas. Pulp implements this independently in SkSL over Skia — no Redraw source is copied or vendored; the techniques have well-known public formulations. Thanks to William Candillon, also a co-creator of react-native-skia, which separately informed `@pulp/react`'s reconciler.
SignalKit	MIT	Real-time DSP patterns in Swift
signalsmith-clap-cpp	MIT	WCLAP build pipeline, webview extension patterns
Visage	MIT	SDF-first rendering, dirty region tracking, shape batching, and a high bar for visual quality in audio plugin interfaces

Inferno¶

Pulp's design-import work studied Inferno, together with its successor Octane, as a reference for keeping React-style authoring while moving work to compile time. Pulp took ideas, not a runtime: its plans decline to embed Inferno or copy its runtime, and add metadata to Pulp's existing DesignIR instead.

Child-shape metadata, not a new runtime. Inferno's VNodeFlags / ChildFlags inspired recording each node's child shape (text, single child, keyed list, unkeyed list) as metadata over DesignIR, so code generation can pick a tight path without normalizing children at run time.
No silent guessing. Those flags are only safe when compiler and runtime agree, so the plans require an unknown shape to take an explicit, reported fallback rather than a guessed flag.
Measured, not assumed. Inferno's normalization-free paths and keyed (LIS) diffing are adopted only where measurement justifies them. The child-update planner keeps a shared prefix and suffix and the longest increasing run of surviving children in place and moves only the rest, after a named keyed-mutation corpus (after uibench) showed the earlier position-by-position loop moving 49 of 50 children for a single move-to-end.
Explicit keyed and unkeyed paths. Following Inferno's separate keyed and non-keyed child patching, Pulp's DesignIR child-update planner matches unique anchors by key and, when anchors are missing or duplicated, reports ambiguous_keys with a per-child reason (duplicate, missing, or mixed keys) and replaces the sibling set wholesale rather than reusing anything by position.

Pulp contains no Inferno code and does not depend on Inferno.

Discipline¶

Pulp follows strict rules. Implementation is from specs, SDK documentation, and original design — never from studying proprietary or restrictively-licensed source code. For optional AAX support, that means no Avid SDK files or example sources in the repo and no copied implementation text from the SDK examples. See CLAUDE.md for the full policy.

License Policy¶

Before adding any bundled dependency to Pulp:

Check the license — must be MIT, BSD, Apache 2.0, ISC, zlib, BSL-1.0, SIL OFL 1.1 (fonts), or public domain
Add to DEPENDENCIES.md — alphabetical order, with version, license, and purpose
Add to NOTICE.md — full license text, alphabetical order
Add to docs/reference/licensing.md — same table row, matching license string
Update tools/deps/manifest.json — machine-readable inventory consumed by tools/deps/audit.py
No copyleft — GPL, LGPL, AGPL, SSPL are not allowed
MPL-2.0 — requires case-by-case review (weak copyleft)
Vendor SDKs stay separate — optional AAX/ASIO-style SDKs must remain developer-supplied, out-of-tree, and excluded from NOTICE.md

Dependency update workflow is tracked in tools/deps/manifest.json and audited by tools/deps/audit.py. Run python3 tools/deps/audit.py --strict before proposing a dependency change; the audit script will also run in CI (tracked alongside the skill-sync and version-bump gates).