docs/THIRD_PARTY.md

# Third-party source inventory

This file records what is actually visible in the sanitized tree. It is not a license clearance, and `UNKNOWN` must be resolved before publication rather than treated as permission.

## Current inventory

| Retained path | Apparent upstream / role | Local license evidence | Exact source revision | Publication status |
| --- | --- | --- | --- | --- |
| `approach/ovod/APE/` | [shenyunhang/APE](https://github.com/shenyunhang/APE) | Apache-2.0 at `approach/ovod/APE/LICENSE`; nested `openimages2coco` utility has its own MIT license | UNKNOWN for the vendored source | Blocked pending source-revision verification |
| `approach/ovod/GroundingDINO/` | [IDEA-Research/GroundingDINO](https://github.com/IDEA-Research/GroundingDINO) | Apache-2.0 at `approach/ovod/GroundingDINO/LICENSE` | UNKNOWN | Blocked pending source-revision verification |
| `approach/ovod/detectron2/`, `baselines/detectron2/` | [facebookresearch/detectron2](https://github.com/facebookresearch/detectron2) | Apache-2.0 license in both roots | UNKNOWN for both snapshots | Blocked pending revision and duplication review |
| `approach/vlm/LLaVA/` | [haotian-liu/LLaVA](https://github.com/haotian-liu/LLaVA) | Apache-2.0 at `approach/vlm/LLaVA/LICENSE` | UNKNOWN | Blocked pending source-revision verification |
| `approach/ovod/d-cube/` | D-cube evaluation support | CC-BY-NC-4.0 at `approach/ovod/d-cube/LICENSE` | UNKNOWN | Requires an explicit non-commercial-license compatibility decision |
| `approach/ovod/mm-ovod/` | Detic-derived MM-OVOD snapshot | No root license file; README points to Detic; nested CenterNet2 carries Apache-2.0 | UNKNOWN | Blocked; do not infer the parent license from the nested subtree |
| `baselines/CenterNet2/`, `approach/ovod/mm-ovod/third_party/CenterNet2/` | [xingyizhou/CenterNet2](https://github.com/xingyizhou/CenterNet2) | Apache-2.0 roots; README identifies `bifpn_fcos.py` as AdelaiDet non-commercial code, but that referenced license text is not retained | UNKNOWN | Blocked pending the missing component license and exact revisions |
| `baselines/UIED-3.3/` | [MulongXie/UIED](https://github.com/MulongXie/UIED) | Apache-2.0 at `baselines/UIED-3.3/LICENSE` | UNKNOWN | Blocked pending source-revision verification |
| `baselines/YOLO/ultralytics/JSON2YOLO/` | Ultralytics JSON2YOLO conversion utility | Local `LICENSE` is AGPL-3.0; retained README says GPL-3.0 | UNKNOWN | Blocked until the license mismatch is resolved or the subtree is removed |
| `baselines/Aria-UI/` | Aria-UI and AndroidWorld adapter snapshot | No root license file; some AndroidWorld-derived files contain Apache-2.0 headers | UNKNOWN | Blocked; file headers are not a complete subtree license inventory |
| `baselines/CogVLM/`, `baselines/Xianyu/`, `baselines/internVL/`, `baselines/qwen3-vl/`, `baselines/seed-e2e/` | Model/baseline adapters or copied source of unresolved provenance | No root license file in the retained directories | UNKNOWN | Classify authored-vs-vendored files, then add provenance or remove |

The bundled APE-L\(_D\) checkpoint is tracked separately in `docs/MODEL_MANIFEST.md`. That artifact is pinned to its official Hugging Face revision and checksum; this does not establish the revision of the vendored APE source tree.

## Retained third-party assets

The tree includes non-code upstream assets that also require provenance review:

- `approach/ovod/mm-ovod/datasets/metadata/` contains about 11 MB of LVIS category metadata, GPT-derived descriptions, and CLIP/image-exemplar feature arrays used by MM-OVOD configurations;
- model-family READMEs and demo folders retain upstream figures or other documentation assets;
- selected evaluation ground truth is an Orienter runtime input and must be tied to the public dataset version and license.

These are not Orienter experiment logs or generated prediction results, but they still need a documented source, version, checksum where appropriate, and redistribution license. Remove any asset that cannot be cleared or that is not required by the chosen public scope.

## Required decision before publication

1. Choose the top-level Orienter code license; do not infer it from APE or another dependency.
2. Decide whether optional baseline/vendor trees remain in scope. Removing unused, uncleared subtrees is safer than publishing them with unknown provenance, but may reduce baseline reproducibility.
3. For every retained third-party path, record the upstream URL, exact commit/tag, license/notice files, local modifications, and any separately licensed assets.
4. Resolve whether CC-BY-NC-4.0, AGPL-3.0, and referenced non-commercial components are compatible with the intended release.
5. Restore required license/notice text from the verified upstream revision; do not synthesize or guess it.

Release-local sanitation changes are intentionally narrow: generated artifacts were removed; a D-cube example now reads `D3_DATASET_ROOT`; and an MM-OVOD README example now uses a repository-relative path instead of an upstream developer's personal path. Record these changes against the exact upstream revisions after provenance is recovered.

This is an engineering inventory, not legal advice.