This project bundles and redistributes a small amount of software written by
other people. MIT and BSD both require the notice to travel with the code.
Shipping the code without the notice is a licence breach, not a documentation
gap, so this file is part of the build and not a courtesy.
Written at v9.10.691, 2026-08-12. Re-checked and corrected at v9.10.692,
2026-08-13 — see *What was corrected at v9.10.692* below.
/papers/third-party-notices.md (HTTP 200, no login) |oracle-vendor/<pkg>/…LICENSE.txt beside each vendored file | the licence for that one artefact | anyone reading the file itself | all three are under oracle-vendor/, which is tracked and served by the /oracle-vendor/ route (which allows .txt) |**Two honest caveats about the state on disk at v9.10.692, neither of which
changes the obligation.** (1) oracle-vendor/mermaid/LICENSE.txt exists and is
in a tracked directory, but has not been committed yet — the verify pass that
placed it was not permitted to commit. It travels as soon as it is. (2) The
/oracle-vendor/ route exists in command-center-server.mjs but the *running*
:3001 process still predates it — measured, /oracle-vendor/chess/chess.js
returns 404 — so that fetchable-notice surface goes live with the next
dashboard restart. Until then the notice still reaches every reader through
this file (served now, publicly) and through the in-product Credits panel.
The in-product surface is not decoration. A web application has no
"documentation and/or other materials provided with the distribution" other
than what it puts on the screen, so a reachable credits screen is how BSD-2
clause 2 and the MIT notice clause are actually satisfied here.
**If a dependency is added, removed or upgraded, this file and the CREDITS
table in oracle-games.js change in the same commit.** A credits screen that
has drifted is worse than no credits screen, because it makes a false claim
rather than no claim.
.gitignore line 44 is a bare vendor/, so **nothing under vendor/ is
tracked** — verified with git check-ignore -v and git ls-files vendor
(0 files). A LICENSE file placed there does not travel with the repository,
which is precisely the obligation being discharged. New vendored artefacts
therefore go in oracle-vendor/, which is tracked (verified the same way),
and are served by the /oracle-vendor/ route in
[internal module].
vendor/mermaid/ predates that rule and keeps its path, because moving the
bundle would break every cached page. Only the bundle has to stay there.
Its licence does not, and at v9.10.692 it moved to
oracle-vendor/mermaid/LICENSE.txt, which is tracked and fetchable. See below.
---
oracle-vendor/chess/chess.js — unmodified, byte-identical76c7c34f0e2e9ab076521a5d6fe786a9cce537bb1b6f29d32a9c9970b5b232d2oracle-vendor/chess/chess.js.LICENSE.txt (SHA-256 0b3a3c2b4432a26bb18f9d06f5bba4de015bcc980306b7db28b06025495e2186)
Used for: the game chess in Oracle Arcade — move generation and legality
only (castling, en passant, promotion, pins, the fifty-move rule). The board,
the input handling, the search, the evaluation, the guide and the sound are
this project's own work and are in oracle-games-chess.js, which is not
chess.js and carries its own header saying so.
Verified about the vendored bytes: zero occurrences of eval(,
new Function, WebAssembly, require(, process. or Buffer. It is a
self-contained ES module with one export line and no imports. The BSD notice
is embedded as a comment at line 1237 of the dist itself, so the source form
retains it even in isolation.
Copyright (c) 2025, Jeff Hlywa ([email protected]) All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
---
because the work deserves it, not because the dedication demands it.
M\Cooper)master), file enable1.txt3f16130220645692ed49c7134e24a18504c2ca55b3c012f7290e3e77c63b1a89oracle-vendor/words/oracle-words.js (49,883 bytes, SHA-256 cfb01357d8861212d2969beaf87f3dd231027484cb74c9459749a97b5088361a)
oracle-vendor/words/ENABLE.LICENSE.txtUsed for: the validity check in wordfive (Word Five) and anagram
(Anagram Rush) — "is this string a word?". The answer pool in both games is
a separate hand-curated list of 762 common five-letter words that lives in
oracle-games-pack.js and is unchanged.
What was extracted: every line matching /^[a-z]{5}$/ — 8,636 words —
sorted, then packed five characters per word with no separators. Nothing was
added, removed, corrected or re-cased. Reproducible from the hashed source in
one line:
grep -x '[a-z]\{5\}' enable1.txt | sort
From README.1ST of the ENABLE archive:
> The ENABLE list has been placed in the Public Domain. This means it is free
> and freely distributable. No fees, registrations, or "contributions" are
> required for its use.
From README of the ENABLE archive:
> The word list is in plain ASCII format, unencrypted, and is placed in the
> Public Domain for anyone to use as they see fit. It is non-proprietary, free,
> and freely available for any legal use.
The dedication above is not quoted from the GitHub mirror the word data came
from. That mirror (dolph/dictionary) has no LICENSE file at all, so citing
it as the provenance of a public-domain claim would be citing a repository with
no stated terms. The two quotations were taken from Alan Beale and Mendel
Cooper's original ENABLE distribution, retrieved from SCOWL 2020.12.07
(http://wordlist.sourceforge.net/), files r/enable/readme.1st and
r/enable/readme. SCOWL redistributes the ENABLE documentation unmodified but
does not ship WORD.LST itself, which is why the words come from a mirror while
the dedication comes from the original.
Mirrors disagree on the line count (172,823 here, 172,819 in the mirror's own
README, 172,820 elsewhere). The hash is the only claim that is checkable, so it
is the one that matters.
Deliberately NOT used: popular.txt from the same mirror — 25,322 words,
the obvious source for a frequency-capped pool — because it is derived from
Wiktionary frequency lists (CC BY-SA) and sits in a repository with no licence
file. Its terms are unresolved. ENABLE itself carries no frequency data of any
kind, so nothing in this project can rank words by how common they are.
---
vendor/mermaid/ — 104 files, 3.7 MB, self-hosted (no CDN)vendor/mermaid/mermaid.esm.min.mjs): b81c2c7ac0d81466022ea895c6701978ccb742e12e423dd8ae4a5a45cc259633
oracle-vendor/mermaid/LICENSE.txt — tracked and served (1,089 bytes, SHA-256 ec9fb67dcb25eccc416ed56e1aab819222c805a2a4bfe4cb19e7556bf2ffde80)
Used for: diagram rendering in the document library, via
oracle-mermaid-init.mjs. Not part of the Game Center.
This entry is a repair, and it is worth saying why. mermaid was vendored
with its MIT licence header stripped from the minified bundle (grep -c MIT
returns 0) and no LICENSE file beside it, and there was **no user-facing
attribution surface anywhere in the product** — grepping oracle.html,
oracle-core.js and oracle-games.js for credits / third-party /
open source / acknowledg returned nothing. That is a plain MIT breach and
it predates this file by many versions. It is listed here in full, it names the
holder in the in-product Credits panel, and its licence text is kept as a
tracked file at oracle-vendor/mermaid/LICENSE.txt.
v9.10.691 put the licence at vendor/mermaid/LICENSE.txt and counted it as
one of the four notice surfaces. It was neither of the things a notice surface
has to be:
.gitignore:44 is a bare vendor/, so git ls-files vendor returns 0 files. Cloning the repository does not get it.
/vendor/mermaid/ route in command-center-server.mjs rejects every path that is not .mjs
(!/\.mjs$/.test(relPath) → 404), so a browser asking for it fell through to
the login wall and got 30,822 bytes of HTML. Measured against the live server.
The route is a deliberate strict allowlist and was not relaxed. Instead the
licence now has a tracked, servable home at oracle-vendor/mermaid/LICENSE.txt,
reached by the /oracle-vendor/ route that already allows .txt. The copy at
vendor/mermaid/LICENSE.txt is left where it is — it is harmless beside the
code it covers — but it is not counted as a notice surface, because it is
not one.
None of this was ever the whole obligation: the full MIT permission text has
been in *this* file, tracked and publicly served, the entire time, and the
holder has been named in the in-product Credits panel. The defect was an
overstated claim plus an ineffective file, and both halves are now true.
The MIT License (MIT) Copyright (c) 2014 - 2022 Knut Sveidqvist Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
---
Added at v9.10.696. oracle-chip8.js is an emulator, which is exactly the
kind of file a reader of this document should expect to find third-party content
in. It does not contain any, and this section exists so that nobody has to take
that on trust.
tools/chip8-roms/ so this is checkable rather than a claim: a test re-assembles all five from that source and asserts the shipped bytes match exactly. |FX29 instruction — it is a hardware interface, not a typeface, and is reproduced from the specification. Cover art is generated by running each ROM and blitting its framebuffer. The beeper is a synthesised square wave through oracle-games-fx.js. |Why the ROMs were authored rather than imported. The obvious source is
JohnEarnest/chip8Archive, which is CC0. It was deliberately not used — see
*chip8Archive ROMs* under Considered and NOT taken below for the full
reasoning. The short version: "the archive is CC0" is a claim about a repository
and not a per-work licence verification, and fetching the files is a download
the owner had not approved.
A ROM the player opens from their own device (Library → *Open a .ch8 file*)
is read with FileReader, never uploaded, never stored, and never posted to a
leaderboard. It is the player's own content and creates no obligation for this
project.
One implementation note that is a licence-adjacent trap. A common CHIP-8
speed trick is to compile opcodes into closures with new Function. That is
CSP-blocked here and this interpreter does not do it — it is a plain switch.
The prohibition is asserted by a test that strips comments and string literals
before scanning, so the file's own documentation about eval and WebAssembly
cannot make the check pass or fail.
---
Recorded so the same ground is not re-covered.
Declined; the game was written instead. That repository is three files —
LICENSE, README.md, index.html. It is a finished standalone application,
not an importable rules module, so there was nothing to import. Dropping its
index.html into an iframe would put a game inside the Game Center that is not
a GC.register block: no pause contract, no audio voice, no XP, no
save/resume, no how-to panel, no leaderboard. Porting its logic means rewriting
the rendering, input, layout and audio for the Oracle idiom anyway, leaving
roughly a quarter genuinely reused in exchange for a permanent notice
obligation. Klondike's rules are a few hundred lines with no edge case like en
passant, so oracle-games-solitaire.js is original work and owes nobody
anything. Chess went the other way, deliberately, because there the third-party
part is the hard part.
> **UPDATED at v9.10.696. The emulator is now BUILT; the archive ROMs are still
> NOT TAKEN, and the reasoning below is why.** oracle-chip8.js ships a plain-JS
> CHIP-8 interpreter and five programs, **all five of which were written for this
> project** — see *§4. CHIP-8 — no third-party content* above. Nothing was
> sourced, bundled or fetched, so this entry stays in "considered and not taken"
> for the ROMs and only for the ROMs.
The archive: not taken. Blocked on an owner decision, not on a licence.
GAME-CENTER-ARCADE-GOAL.md §5 records: *"ROMs are the owner's to supply and to
be entitled to. Build the loader and the library. Do not source, bundle, or
fetch game content."* CC0 removes the legal objection; it does not remove the
instruction. Bundling 87 ROMs on a licence technicality would be an agent
overriding a documented decision by the person who owns this project.
Two further reasons the v9.10.696 unit did not import them even while building
the emulator that would run them: (a) per-work verification. "The archive is
CC0" is a statement about a repository, not about each program in it; a licence
has to be read per work before it can be relied on, and that reading had not been
done. (b) Fetching them is a download, which needs the owner's approval, and
he was asleep. Authoring the ROMs removed the obligation entirely rather than
discharging it — which is strictly better than a correct import, and was also
about a day's less risk. **The import remains available as an owner-approved
step.** If it is taken: verify each ROM's licence individually, vendor the
licence text beside the bytes under oracle-vendor/, and add a section here.
Two corrections to the record, for whoever picks it up:
cannot load"* — is true of a WASM core and not true of a CHIP-8
interpreter written in plain JavaScript. CHIP-8 is 4 KB of RAM, sixteen
registers, two 60 Hz timers, a 64×32 boolean framebuffer and about 35
opcodes; a switch interpreter needs no eval, no new Function and no
WebAssembly. (It must never JIT opcodes via new Function — that common
speed trick *is* CSP-blocked here.)
chip8, 34 schip and 50 xochip. A plain CHIP-8 interpreter runs 51% of
them. Anything shipped should say which half it covers.
Wanted for Anagram Rush, and not available under a clear licence from the
sources looked at. ENABLE has no frequency data; popular.txt is CC BY-SA
derived and sits in a repository with no licence file; SUBTLEX, Google Books
n-grams and wordfreq each carry their own terms that were not cleared. So
Anagram Rush keeps its curated puzzle pool and uses ENABLE only to widen what
counts as a valid alternative answer.