# Vendored-source attribution

This source-only research fixture vendors a minimal, hash-locked closure from:

- AIR v1.0.1, commit `e3bacb3076338db4f9644e469410a6ffea11c303`,
  by Cyntrisec, licensed under CC BY 4.0. The exact license is retained at
  `vendor/air/LICENSE`.
- NVIDIA nvtrust, commit `0c5d627313037c1e577d05a232e79394a41b2c21`,
  whose repository license is Apache License 2.0. The exact upstream root
  license and the local GPU verifier's bundled notices are retained at
  `vendor/nvtrust/LICENSE` and the local verifier `LICENSE.txt`.

`vendor-lock.json` records every vendored byte, upstream path, commit, license,
length, and SHA-256. Glyph Standard has not modified the vendored verifier or
fixture bytes.
