# Credits

Everything under `vendor/` is unmodified upstream code, kept here so the lab
runs offline against a pinned copy rather than against whatever a CDN is
serving today. Versions live in `scripts/vendor.sh` and nowhere else. The full
licence text for each item is in `vendor/licenses/`.

Three vendored items, three licences.

| item | version | licence | upstream |
| --- | --- | --- | --- |
| axe-core | 4.10.2 | MPL-2.0 | <https://github.com/dequelabs/axe-core> |
| Silkscreen | v6 (Google Fonts) | SIL OFL 1.1 | <https://kottke.org/plus/type/silkscreen/> |
| Departure Mono | 1.500 | MIT | <https://github.com/rektdeckard/departure-mono> |

## Notes

**axe-core is MPL-2.0**, which is a file-level copyleft. It is used unmodified
and loaded as a whole file by `audit.html`, so nothing here triggers the source
disclosure obligation beyond pointing at upstream, which this file does. It is
vendored rather than loaded from a CDN because the audit runs against local
files with no network, and because a version that can move underneath the
numbers is not a measurement.

**The two faces are under different licences**, correcting this repo's own
`vendor/fonts/LICENSES.md`, which claimed both were OFL until 2026-09-03.
Departure Mono is MIT.

**`corpus/cache/` is not vendored and is not published.** It holds archived
captures of third-party sites pulled from the Internet Archive, kept locally so
the lab can census them without touching the archive again. Republishing
someone else's pages is not what a citation is.

It is gitignored, and it is withheld from the site by `tools/deploy.sh`, which
stages the upload with rsync from `.assetsignore` and refuses to deploy if any
excluded path survives. That mechanism exists because listing it in
`.assetsignore` alone did **not** work: `wrangler pages deploy` never reads that
file, and on this project's first deploy, on 2026-09-03, both captures were
briefly served. They were removed, the deployment holding them was deleted, and
every route was re-verified by comparing checksums against the local files.

## The lab's own work

Everything outside `vendor/` is MIT, see LICENSE. That covers `studies/`,
`lab/`, `scripts/`, the tool pages, and the written findings in NOTES.md.

The studies reconstruct techniques from web design c. 1998 to 2004. They are
original drawings of documented methods, not copies of anyone's pages. Where a
number is cited it comes from archived markup, attributed in NOTES.md to the
capture it was read from.