================================================================================ THIRD-PARTY SOFTWARE LICENSES & LEVEL 1 SBOM AUDIT TRAIL ================================================================================ Project: ellmos-ai/clip-storyboard-director Version: 0.1.6 (frozen per T-20260920-167562623) Stand: 2026-10-01 Repository License: MIT License (see LICENSE) Attribution Notice: see NOTICE Markdown Companion: see THIRD_PARTY_LICENSES.md Security Policy: see SECURITY.md (48-hour SLA) Governance Standards: INV-LOCAL-01 through INV-SLA-10 Execution Mode: 100% Local-First, Zero-Egress by default, Unprivileged User-Mode (RunAsInvoker) -------------------------------------------------------------------------------- 1. EXECUTIVE COMPLIANCE, ZERO-COPYLEFT & RUNASINVOKER GUARANTEE -------------------------------------------------------------------------------- clip-storyboard-director is engineered under strict architectural and governance invariants: 100% Local-First, Zero-Egress by default, and unprivileged user-mode execution (RunAsInvoker). All storyboard creation, shot sequencing, 4D persistence buffer tracking, Edge Chrome DevTools Protocol (CDP) bridge automation, downloads watching, clue-frame optical extraction, and FFmpeg multi-track audio assembly execute within local workstation process boundaries without requiring elevated administrative privileges. Runtime Dependencies Isolation & Boundary: All direct Python runtime dependencies utilized in clip-storyboard-director are distributed under permissive open-source licenses (MIT, Apache-2.0, PSFL): - PyYAML (MIT) - websocket-client (Apache-2.0) - requests (Apache-2.0) - Python Standard Library (PSFL-2.0) Subprocess Boundary for edge-tts (GPL-3.0): edge-tts is licensed under GPL-3.0. clip-storyboard-director invokes edge-tts strictly via standard, unprivileged external subprocess calls or optional wrapper interfaces. The core directorial engine, 4D persistence buffer, timeline cockpit, and video assembly pipelines remain 100% MIT-licensed with zero copyleft linkage. Users and organizations are free to substitute or swap alternative local speech synthesis engines without modifying core architecture. Subprocess Boundary for FFmpeg / FFprobe (LGPL-2.1+ / GPL-2.0+): FFmpeg and FFprobe are executed exclusively as external system CLI subprocesses (via subprocess.run) across standard OS PATHs with parameterized argument arrays. No C/C++ libraries are statically or dynamically linked into Python binaries. RunAsInvoker Non-Elevation Certification: clip-storyboard-director operates strictly in standard unprivileged user space. It requires zero administrative elevation (UAC prompt), zero root privileges, and zero background daemon registrations. Zero-Egress Perimeter: The directorial server binds exclusively to localhost loopback (127.0.0.1:8765), and CDP communication connects strictly to localhost (127.0.0.1:9222). Zero telemetry, analytics, tracking, or media assets are transmitted over external network interfaces. -------------------------------------------------------------------------------- 2. INVARIANT CROSS-REFERENCE MATRIX (INV-LOCAL-01 TO INV-SLA-10) -------------------------------------------------------------------------------- Invariant ID | Mandate & Architectural Scope | Enforcement Mechanism ---------------+-----------------------------------------+------------------------------------- INV-LOCAL-01 | 100% Local-First & Zero-Egress | Localhost loopback; zero telemetry INV-UNPRIV-02 | Non-Elevation / RunAsInvoker Execution | Standard unprivileged user token INV-LOOPBACK-03| Loopback Socket Isolation (127.0.0.1) | Hard-bound to 127.0.0.1:8765 & 9222 INV-SANDBOX-04 | Subprocess Parameterization & Sandboxing| Parameter arrays, no shell=True INV-CONTINUITY-05 4D Persistence Continuity Buffer | Declarative YAML bounds (project.yaml) INV-CLUEFRAME-06 Clue-Frame Optical Chaining | Deterministic tail-frame extraction INV-STANDALONE-07 Standalone Directorial Independence | 100% functional without external suites INV-MULTIOS-08 | Multi-OS Operating Parity | Windows, Linux, macOS path neutrality INV-SYNC-09 | Cloud-Sync Conflict & Lock Defense | Atomic writes; ignore conflict patterns INV-SLA-10 | Bilingual Security SLA (48h / 5 days) | SECURITY.md (security@ellmos.ai) -------------------------------------------------------------------------------- 3. DIRECT RUNTIME DEPENDENCIES -------------------------------------------------------------------------------- Component: PyYAML Version: >=6.0 License: MIT License SPDX-ID: MIT Copyright: (c) 2017-2026 Ingy dot Net, Kirill Simonov Repository: https://github.com/yaml/pyyaml Purpose: Declarative project configuration and 4D persistence buffer parsing License Text: MIT License Copyright (c) 2017-2026 Ingy dot Net Copyright (c) 2006-2016 Kirill Simonov Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --- Component: websocket-client Version: >=1.6.0 License: Apache License, Version 2.0 SPDX-ID: Apache-2.0 Copyright: (c) 2021-2026 websocket-client contributors Repository: https://github.com/websocket-client/websocket-client Purpose: Chrome DevTools Protocol (CDP) WebSocket communication on 127.0.0.1:9222 License Text: Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --- Component: requests Version: >=2.28.0 License: Apache License, Version 2.0 SPDX-ID: Apache-2.0 Copyright: (c) 2012-2026 Kenneth Reitz, PSF Repository: https://github.com/psf/requests Purpose: HTTP communication for Edge DevTools JSON target discovery on 127.0.0.1:9222 License Text: Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --- Component: edge-tts (Optional Speech Synthesis Engine) Version: >=6.1.0 License: GNU General Public License v3.0 (GPL-3.0) SPDX-ID: GPL-3.0-or-later Copyright: (c) 2021-2026 rany2 and contributors Repository: https://github.com/rany2/edge-tts Purpose: Local dialogue synthesis and speech track generation (Subprocess Boundary) Architectural Boundary: edge-tts is executed strictly as an isolated subprocess or optional CLI utility. No GPL code is incorporated into clip-storyboard-director core modules. --- Component: Python Standard Library Version: >=3.10 (Tested on 3.10, 3.11, 3.12, 3.13) License: Python Software Foundation License 2.0 (PSFL-2.0) SPDX-ID: Python-2.0 Copyright: (c) 2001-2026 Python Software Foundation Purpose: Standard library runtime modules (pathlib, subprocess, json, http, asyncio) -------------------------------------------------------------------------------- 4. DEVELOPMENT, PACKAGING & CI/CD TOOLS -------------------------------------------------------------------------------- Component: pytest Scope: [dev] optional dependency License: MIT License Purpose: Unit, contract, and regression testing suite Component: ruff Scope: [dev] optional dependency License: MIT OR Apache-2.0 Purpose: Static analysis, code formatting, and import linting Component: setuptools Scope: [build-system] build backend License: MIT License Purpose: PEP 517/PEP 621 package build backend and distribution packaging -------------------------------------------------------------------------------- 5. EXTERNAL SYSTEM UTILITIES (SUBPROCESS BOUNDARY) -------------------------------------------------------------------------------- Component: FFmpeg / FFprobe Scope: System PATH binary License: LGPL-2.1+ / GPL-2.0+ (depending on build configuration) Purpose: Media probing, tail-frame optical clue extraction, video stitching, audio ducking Boundary: Invoked exclusively as external unprivileged subprocess via subprocess.run Component: Microsoft Edge Scope: System browser License: Proprietary (Microsoft Corporation) Purpose: Optional interactive dual-pane directorial cockpit and CDP target host Boundary: Communicated with exclusively via localhost DevTools Protocol port 9222