# Third-party notices for DeskCapsule 1.0

This inventory must be regenerated from the locked dependency graph for every production release. It does not replace the original license texts included with each component.

## Runtime components

| Component | Version | License | Project |
|---|---:|---|---|
| Microsoft.Data.Sqlite and Microsoft.Data.Sqlite.Core | 10.0.10 | MIT | [EF Core](https://github.com/dotnet/efcore) |
| Microsoft.Bcl.Cryptography | 10.0.2 | MIT | [.NET](https://github.com/dotnet/runtime) |
| Microsoft.Extensions.DependencyInjection.Abstractions and Logging.Abstractions | 8.0.0 | MIT | [.NET](https://github.com/dotnet/runtime) |
| Microsoft.IdentityModel.JsonWebTokens, Tokens, Logging and Abstractions | 8.22.0 | MIT | [IdentityModel](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet) |
| Microsoft.ML.OnnxRuntime | 1.29.0 | MIT | [ONNX Runtime](https://github.com/microsoft/onnxruntime) |
| Microsoft.ML.OnnxRuntime.Extensions | 0.14.0 | MIT | [ONNX Runtime Extensions](https://github.com/microsoft/onnxruntime-extensions) |
| Microsoft.Extensions.AI.Abstractions | 10.2.0 | MIT | [.NET Extensions](https://github.com/dotnet/extensions) |
| NAudio packages | 2.3.0 | MIT | [NAudio](https://github.com/naudio/NAudio) |
| Whisper.net packages and whisper.cpp runtime | 1.9.1 | MIT | [Whisper.net](https://github.com/sandrohanea/whisper.net), [whisper.cpp](https://github.com/ggml-org/whisper.cpp) |
| User-downloaded Whisper model files | pinned catalog entries | Model-specific notice required | [whisper.cpp models](https://huggingface.co/ggerganov/whisper.cpp) |
| System.Security.Cryptography.ProtectedData | 10.0.10 | MIT | [.NET](https://github.com/dotnet/runtime) |
| SQLitePCLRaw packages | 3.0.5 | Apache-2.0 | [SQLitePCL.raw](https://github.com/ericsink/SQLitePCL.raw) |

Self-contained MSIX packages also include .NET runtime files. Preserve the matching .NET license and generated third-party notice materials in the release.

## Local translation models

No local translation model may be published until its exact artifact, revision, license, attribution, redistribution rights, export implications, size and SHA-256 are approved. Current engineering candidates include:

- [Helsinki-NLP OPUS-MT RU to EN](https://huggingface.co/Helsinki-NLP/opus-mt-ru-en), revision `fbd6dc73284f95536648512cc21d57f19191961a`, CC-BY-4.0;
- [Helsinki-NLP OPUS-MT EN to RU](https://huggingface.co/Helsinki-NLP/opus-mt-en-ru), revision `bb09c99d180016eac6819df3dae68edb1690fdee`, Apache-2.0.

Candidate status is not permission to redistribute. The signed model catalog and the release notices must name the exact selected artifacts and all required attribution.

## Remote services

SOVREST license, AI translation, AI Chat and future Speech services are remote services, not binaries distributed in DeskCapsule. Their provider/subprocessor terms, processing region, retention and deletion commitments belong in the approved Privacy Policy and service agreement.

DeskCapsule does not distribute or directly call Groq and does not store a personal Groq key. If SOVREST uses Groq or another upstream provider, SOVREST must disclose and govern that relationship server-side.

## Development and test dependencies

| Component | Version | License |
|---|---:|---|
| coverlet.collector | 10.0.1 | MIT |
| Microsoft.NET.Test.Sdk and Test Platform | 18.8.1 | MIT |
| xunit.v3 | 3.2.2 | Apache-2.0 |
| xunit.runner.visualstudio | 3.1.5 | Apache-2.0 |

Development-only packages must not be copied into the production publish output unless explicitly required and reviewed.

## License texts and release verification

Preserve the authoritative MIT, Apache-2.0 and model-specific license texts in the release artifact. Before signing:

- compare direct and transitive versions with the locked restore graph;
- inspect each package metadata and bundled notices;
- verify local model revision, hash, license and attribution;
- scan the publish output for unexpected development dependencies;
- block release for unknown, incompatible or unreviewed licenses.
