repro-bundle/scripts/posterly/NOTICE.md

# NOTICE — third-party provenance

posterly is licensed **as a whole under AGPL-3.0 © 2026 Ruishuo Chen** (see `LICENSE`). It
additionally vendors a set of poster-quality "gate" tools, three tokenized templates, and one
component catalog from **ARIS** (Auto-claude-code-research-in-sleep), whose `paper-poster-html`
skill is itself a fork of posterly. Those ARIS files are **MIT-licensed**; MIT is
GPL/AGPL-compatible, so they are lawfully combined into this AGPL project while remaining
individually available under their original MIT terms (see below). This file records the vendor
boundary so the relationship stays clean and attribution is preserved in both directions.

## Licensing of this combined work

- The project **as a whole** is **AGPL-3.0** (`LICENSE`). Any distributed or network-deployed
  (SaaS) derivative of posterly must release its complete corresponding source under AGPL-3.0.
- The **body-unmodified ARIS tools** below (`style_check.py`, `asset_check.py`,
  `extract_pdf_figures.py`, `preprocess_figures.py`) are verbatim **MIT © 2026 wanshuiyin** and
  remain **additionally available under MIT** (`LICENSES/aris-MIT.txt`) — anyone may extract just
  those files and use them under MIT. AGPL copyleft applies to posterly as a whole, not to these
  individual third-party files in isolation.
- The **adapted** files (templates, `COMPONENTS.md`, `run_gates.py`) are derivative works
  combining posterly-original material with ARIS's MIT contribution; as part of posterly they are
  distributed under AGPL-3.0, with the MIT origin attributed below.

## Vendored from ARIS (MIT)

- **Upstream**: ARIS — https://github.com/wanshuiyin/Auto-claude-code-research-in-sleep
  (skill `paper-poster-html`).
- **License**: MIT, © 2026 wanshuiyin. Full text: `LICENSES/aris-MIT.txt`.
- **Note on lineage**: ARIS's `paper-poster-html` vendored posterly's render/measure engine
  (`_posterly/`, `poster_check.py`, `render_preview.py`) unchanged, then layered the gate
  tools below on top. We vendor those ARIS-original additions back here. posterly keeps its
  **own** (newer) `_posterly/` and `poster_check.py` — they are NOT replaced.

Vendored, **body unmodified** (a provenance header comment was prepended to each `.py`):

| Path | Origin in ARIS | Purpose |
|------|----------------|---------|
| `tools/style_check.py` | `scripts/style_check.py` | style HARD gate (13 rules: token-only colors, no inline `style=`, no gradients, font whitelist, `--fs-*` scale, data-attribute contracts, BEM-variant CSS presence) |
| `tools/asset_check.py` | `scripts/asset_check.py` | real-figure provenance gate (`data-source="paper"` + `FIGURE_MANIFEST.json` sha256 chain + rendered-area bands) |
| `tools/extract_pdf_figures.py` | `scripts/extract_pdf_figures.py` | pull real figures out of a paper PDF (contact-sheet / auto / crop) — needs PyMuPDF + Pillow |
| `tools/preprocess_figures.py` | `scripts/preprocess_figures.py` | autocrop / resolution-check extracted crops, keep `FIGURE_MANIFEST.json` honest — needs Pillow |

These vendored scripts import posterly's own `tools/_posterly/` (canvas/render/textutil),
so they run against posterly's engine, not a copy.

Vendored and **adapted**:

| Path | Origin | posterly modifications |
|------|--------|------------------------|
| `templates/COMPONENTS.md` | `templates/COMPONENTS.md` | re-pointed from the ARIS skill's design docs to posterly's `SKILL.md` + `tools/` gates; provenance note added. The component classes it catalogs are posterly's own. |
| `templates/landscape_4col_neutral.html` | `templates/landscape_4col.html` | the **tokenized** form of posterly's own neutral template — replaced the non-tokenized original in place so `style_check` passes out of the box; provenance comment prepended. Measure-role skeleton, component classes, and placeholder copy are posterly's own (verified identical). |
| `templates/landscape_hero_neutral.html` | `templates/landscape_hero.html` | same as above |
| `templates/portrait_2col_neutral.html` | `templates/portrait_2col.html` | same as above |
| `tools/run_gates.py` | `scripts/run_gates.py` | gate orchestrator → `GATE_REPORT.json`. **Modified by posterly** (fixes an upstream false-pass): the asset gate is now opt-in — without `--manifest` it is reported `NOT_RUN` and excluded from `overall`, instead of being run, crashing on its required arg (child exit 2), and silently counted as a pass; a hard gate that ends in SKIPPED from a real environment error now counts as a failure. Also forwards `--hero` to `asset_check`; the report `skill` field is `posterly`. |

## ARIS-inspired, original posterly work (not a copy)

- The **softened closed-set fix vocabulary** and the **cross-model final-review** step in
  `SKILL.md` are original posterly text, inspired by `paper-poster-html`'s DESIGN_FINAL
  (Phase 5 anti-patch-loop / Phase 6 Codex review). posterly's version is half-closed (the
  agent may *propose* a new token/variant for human review rather than being hard-blocked)
  and uses adjustable round caps, suited to a human-in-the-loop workflow.

## Not vendored

ARIS's venue color-token packs (`templates/tokens/*.json`) were intentionally **not** taken:
posterly derives its palette from poster signals (logo / figure / brand) under WCAG AA,
rather than from fixed per-venue presets.

## ResearchStudio-inspired, original posterly work (not a copy)

Five loop-convergence mechanisms were inspired by **ResearchStudio**'s `paper2poster` skill
(https://github.com/ai-nuts/ResearchStudio, `ResearchStudio-Reel/skills/paper2poster`) after a
2026-07 side-by-side review. **No code or prose was copied** — the mechanisms were re-designed
for posterly's human-in-the-loop workflow and implemented from scratch against posterly's own
`_posterly` engine (paper2poster shares distant ancestry with that engine but diverged long
ago):

- the **shared-passing-band + safe-delta hints** in `measure` (their `needPx`/`needPxRange`;
  posterly's version couples the spread and gap constraints into one band),
- the **on-disk measure circuit breaker** (`_posterly/budget.py`; their `.fill_budget.json` —
  posterly counts *consecutive failures* and auto-resets on PASS / 12 h idle),
- the **`pack` column-feasibility pre-check** (their static floor arithmetic; posterly instead
  probes the Gate A band endpoints live in the browser),
- the **edit-targets block** (their `EDIT TARGETS` verbatim-source dump; posterly emits source
  line numbers + math-stripped anchors instead, since MathJax mutates the DOM),
- the **keybox two-line label reservation** (their `.stat-mini .lbl { min-height: 2.4em }`;
  posterly uses `2lh` so each template's own line-height is tracked).

## Vendored third-party runtime: MathJax

`assets/mathjax/tex-svg.js` is the **unmodified** MathJax 3.2.2 single-file SVG bundle
(https://www.mathjax.org/, **Apache-2.0** — license text at `assets/mathjax/LICENSE`, version
pin at `assets/mathjax/VERSION`). The check tools' renderer intercepts the templates' MathJax
CDN request and serves this bundle (`_posterly/render.py route_mathjax_local`), so the
measurement gates typeset math deterministically offline. Vendoring an Apache-2.0 file into
this AGPL-3.0 project is license-compatible; the file remains individually available under
Apache-2.0. (Mechanism ported from ResearchStudio paper2poster's offline-math routing,
re-implemented here; the MathJax bundle itself is upstream MathJax's build, not theirs.)

## Upstream-sync rule

When pulling new ARIS releases of these tools, preserve the vendor boundary: re-vendor the
body-unmodified `.py` files (`style_check.py`, `asset_check.py`, `extract_pdf_figures.py`,
`preprocess_figures.py`) as drop-in replacements (re-prepend the provenance header), and
re-apply the documented `COMPONENTS.md` + template adaptations. **`run_gates.py` is not a
drop-in**: re-apply posterly's asset-opt-in / no-silent-false-pass patch on top of the new
upstream version. Do not fold posterly-specific logic into the body-unmodified files, so the
ARIS diff stays clean and re-syncable.