# GI JI dependency and redistribution inventory

This inventory describes what is built, bundled, or installed separately. It
is a technical record, not legal approval.

## Customer package

- GI JI website import: `golang.org/x/net` v0.57.0 supplies the maintained
  HTML5 parser and charset detector; `golang.org/x/text` v0.40.0 supplies the
  charset decoders used by that detector. Both are maintained by the Go
  Authors and BSD-3-Clause licensed. The full shared license, patent grant,
  and pinned-version notice are packaged under `third_party/golang/` and
  enforced by `scripts/verify-dist.sh`.
- Qdrant 1.18.2: bundled native binary for the matching platform — macOS
  (Intel and Apple Silicon), Linux x86_64, and Windows x86_64;
  immutable downloads and binary checksums are pinned in
  `scripts/qdrant-integrity.sh`. Qdrant is Apache-2.0 licensed. The full
  upstream license and notice-status record are packaged under
  `third_party/qdrant/` and enforced by `scripts/verify-dist.sh`.

## Installed separately, not redistributed in the customer package

- Ollama and its model cache.
- User-selected local models, including Qwen and BGE variants.
- PDF extraction tooling supplied by the operating system/package manager.

Their licenses and model terms remain owner/user review items before public
distribution claims are made.

## Website build dependencies

The static website is built with the exact npm dependency graph pinned in
`web/package-lock.json`. The generated machine-readable inventory at
`web/THIRD_PARTY_DEPENDENCIES.json` records package, version, declared license,
and development-only status. Node modules are build inputs and are not copied
into the static cPanel output.

## Release gate

`BLOCKED — OWNER/EXTERNAL INPUT REQUIRED`: qualified legal review must approve
the complete notices, EULA, model terms, website licenses, seller disclosures,
and redistribution posture before a paid public launch.
