Credits & Acknowledgements
Praetor adapts ideas from, ships code from, builds with and integrates with the open-source projects, products and published specifications below. Each entry links to its upstream source and names its license as stated there.
The release archives and the container image carry
THIRD-PARTY-NOTICES.md,
which lists every shipped third-party component with its version, license and copyright line and
reproduces the upstream license and notice texts, and the license texts in
LICENSES/.
How this page is kept
The tables are rendered from one curated list, docs/credits.yaml: one entry per third-party
item, with its upstream URL, its kind, its relation to praetor, the license its upstream LICENSE
file or registry entry states, and the repository paths that use it. The prose around the tables
is written by hand. After an edit to the list, regenerate the tables:
TestCreditsPageIsRendered (internal/supplychain/credits_page_test.go) fails while this page
differs from what RenderCreditsPage (internal/supplychain/credits_page.go) writes from the
list.
The kind says what the item is: a dependency, tool, action, image, vendored file, adapted code, inspiration, specification (standards included), integration, or font or icon. The relation says how much of it reaches praetor:
| Relation | Meaning |
|---|---|
| shipped | Its code is in the release binaries or the container image. |
| vendored | Upstream files are reproduced in this repository under their own license. |
| adapted | Upstream rules or structure are rewritten in praetor's own words; no text is copied. |
| inspired | Only the idea is taken. |
| used by CI | It runs in the build, the hooks or CI and ships nowhere. |
| integrated | Praetor reads, writes or calls it, or files praetor emits into an adopting repository install it. |
A license is an SPDX expression, or one of three words: proprietary for a closed product or
service used under its provider's terms, none when the upstream states no license, and unknown
when the license could not be verified upstream. An identifier the SPDX License List deprecates is
refused: a GNU license is written with -only or -or-later, as the upstream's notice states.
An entry's packages name the inventory items it answers, each as <ecosystem>:<identifier>:
go: a Go module or tool path, npm: and pypi: a package name, action: an owner/repository,
image: and feature: a repository, and download: an id of the downloads list. A package
answers only items of its own ecosystem, so an npm package and a download of the same name are
two items. Its match terms are further words a path names the item by.
The credits gate, CheckUpstreamCredits (internal/supplychain/upstream_credits.go), holds the
list to the repository; TestShippedUpstreamsAreCredited
(internal/supplychain/upstream_credits_test.go) runs it on the checkout and fails when:
- an item the dependency inventory lists has no entry whose
packagesname it. The inventory,ReadCreditInventory(internal/supplychain/notices_sources.go), reads the direct requirements and the tool block of everygo.mod(tools/go/go.modholds the tools), the direct dependencies of everypackage.json, every piprequirements*.in, everyrequirements*.txtwith no.inof its name beside it (a hand-pinned file such as.config/semgrep/requirements.txt; apip-compilelock is read through its.in), theuses:lines of the workflows, composite actions and CI templates, every DockerfileFROM, and the image and features of everydevcontainer.json. It reads the files git lists for the checkout (tracked files and untracked ones git does not ignore), outsidenode_modules,testdataand hidden directories other than.config,.devcontainerand.github. What CI fetches outside a manifest, such as a release binary downloaded with curl, is declared underdownloadsin the list; - a path an entry, an original or a download names is not a file, or no longer names the item as a whole word: by its packages and match terms, or by its name when it declares neither, so a generic name such as Continue needs a specific match term;
- a canonical persona or skill (
.agents/agents,.agents/skills) neither declaresmetadata.derived_fromnor is listed underoriginals; - an entry states license
unknownand no unexpired entry of theexceptionslist in.standards.yamlwith rulecreditsnames one of its paths, or such an exception has expired or excuses nothing. The exceptions list and its rules are described in the clang-tidy coverage guide.
make credits-check runs these tests and the notices tests on their own. ci filter classes this
page, the list and THIRD-PARTY-NOTICES.md as documentation and the personas and skills as agent
text, and both select the documentation gates, so the light run of a documentation or agent-only
pull request runs the target (.github/workflows/ci.yml); every other run reaches the same tests
through make verify-all.
Adapted work
A persona or skill derived from an upstream names it in its front matter as
metadata.derived_from: "<url> (<license>)", for example .agents/skills/caveman/SKILL.md. The
gate requires an entry with the same URL, the declaring file among its paths, the same license
and a relation of adapted, inspired or vendored. A vendored derivation also needs
LICENSES/ to hold the license text and REUSE.toml to label the file with the license in the
last annotation table whose path globs match it, the only table REUSE 3.3 applies
(ReuseLabels, internal/supplychain/reuse.go). An entry of one of those relations that names a
persona or skill declaring no upstream, or another one, fails as well. Projects by praetor's own
maintainer are not listed.
| Project | Praetor artifact | Relation | What changed | License |
|---|---|---|---|---|
| Caveman | caveman skill, .agents/skills/caveman/SKILL.md |
adapted | The name and the rules (drop articles, filler and hedges; write fragments; keep code and error text verbatim; invent no abbreviations; keep negations; fall back to plain wording when compression makes a line ambiguous) are rewritten for agent-to-agent traffic only, and the skill adds connective symbols, the brief and return shapes and the evidence bound. No upstream text is copied. | MIT, © 2026 Julius Brussee: the MIT terms of the upstream skill when this skill was adapted from it (2026-09-18), shipped byte for byte as LICENSE beside the skill from upstream commit 8dffbb260, the last licence text before the relicensing. Upstream commit 921eab8a8 relicensed the repository to Apache-2.0 on 2026-09-24, released as Caveman 3.0.0 on 2026-09-30; releases before 3.0.0 keep the terms they shipped with |
| Caveman | prose linter, internal/caveman (praetorctl caveman check) |
adapted | The same rules checked mechanically: article density, filler and hedge words, sentence length, and the brief and return contracts. The Go code is praetor's own. | MIT, © 2026 Julius Brussee, as above |
| i-have-adhd | adhd-format skill, .agents/skills/adhd-format/SKILL.md; social-text skill, .agents/skills/social-text/SKILL.md, which inherits from it |
adapted | The purpose: shape output for a reader with ADHD by leading with the next action, numbering steps, chunking and suppressing tangents. The rules are rewritten in praetor's own words for technical reports (bottom line first, bolded anchors, alert callouts, small diagrams), and no upstream word sequence is reused. social-text inherits the credit through the principles it takes from adhd-format. |
MIT, © 2026 Ayoub Ghriss: the MIT text shipped byte for byte as LICENSE beside each skill, from upstream commit d1671755d, the last commit to change the licence text |
| Documenting Architecture Decisions by Michael Nygard (2011), and MADR | adr-scaffold skill, .agents/skills/adr-scaffold/SKILL.md, and the records in docs/adr/ |
inspired | The practice of one short, immutable record per decision and its shape: status, context, decision and consequences. Numbering, the lifecycle rules and the HISS framing are praetor's own. | CC0-1.0, waived by Cognitect; MADR is MIT OR CC0-1.0 |
| Preparatory Refactoring by Martin Fowler (2015), and Kent Beck's Tidy First? | the refactor: commit checks of praetorctl forge refactor-check, docs/guides/git-hooks.md |
inspired | The practice of reshaping code in its own behaviour-preserving commit before the change that needs the new shape. The assertion lock, the suite check, the HISS-04 trigger and the preparatory-refactoring skill text are praetor's own. |
none, the idea only; no text is taken |
| eval-harness | eval-harness skill, .agents/skills/eval-harness/SKILL.md |
adapted | Evaluation-driven development methodology: define task pass criteria before coding, track pass@k and pass^k metrics, and run deterministic evaluations. Rewritten in praetor's internal caveman register. | MIT, © 2026 Affaan Mustafa: the MIT terms of the upstream skill when this skill was adapted from it (2026-10-15), shipped byte for byte as LICENSE beside the skill from upstream commit 1e8c7e799 |
| ecc-tools-cost-audit | cost-audit skill, .agents/skills/cost-audit/SKILL.md |
adapted | Model token consumption and spend auditing methodology: track per-turn prompt and completion tokens, audit context growth rate, and prevent prompt runaway. Rewritten in praetor's internal caveman register. | MIT, © 2026 Affaan Mustafa: the MIT terms of the upstream skill when this skill was adapted from it (2026-10-15), shipped byte for byte as LICENSE beside the skill from upstream commit 1e8c7e799 |
| deep-research | research-method skill, .agents/skills/research-method/SKILL.md |
adapted | Systematic inquiry and evidence synthesis methodology: clarify scope, execute iterative search with primary source prioritization, and cross-validate findings. Rewritten in praetor's internal caveman register. | MIT, © 2026 Affaan Mustafa: the MIT terms of the upstream skill when this skill was adapted from it (2026-10-15), shipped byte for byte as LICENSE beside the skill from upstream commit 2aebdd340 |
| skill-comply | skill-compliance skill, .agents/skills/skill-compliance/SKILL.md |
adapted | Agent skill specification, scenario evaluation, and behavioral compliance audit methodology. Upstream test runner scripts and network dependencies dropped; inspection protocol rewritten in praetor's internal caveman register. | MIT, © 2026 Affaan Mustafa: the MIT terms of the upstream skill when this skill was adapted from it (2026-10-15), shipped byte for byte as LICENSE beside the skill from upstream commit 2aebdd340 |
"Caveman" is a trademark of Julius Brussee; praetor uses the name to refer to the upstream rules and is not affiliated with or endorsed by the Caveman project.
The adhd-format skill and social-text, which inherits from it, are adapted from
i-have-adhd, a skill with the same purpose.
Shipped in the binaries
| Project | Use | Kind and relation | License |
|---|---|---|---|
| Go standard library and runtime | Statically linked into every binary | dependency, shipped | BSD-3-Clause, © 2009 The Go Authors |
go-toml v2 (Go TOML parser; pronounced go tee-oh-em-el) (github.com/pelletier/go-toml/v2 v2.4.3) |
Parses Cargo.toml, pyproject.toml, REUSE.toml and other TOML configuration | dependency, shipped | MIT, © 2021–2023 Thomas Pelletier |
go-yaml v3 (go.yaml.in/yaml/v3 v3.0.5) |
YAML decoding and encoding; the only Go module the binaries link | dependency, shipped | MIT AND Apache-2.0, MIT for the files ported from libyaml, © 2006–2011 Kirill Simonov; Apache-2.0 for the rest, © 2011–2019 Canonical Ltd |
SchemaStore Claude Code settings schema (claude-code-settings.json at commit ce64da2) |
Checks the Claude Code settings and hook files Praetor renders; vendored byte-identical under internal/clientschema/upstream/ and used at build and test time only (the binaries carry the generated types, not the schema files) (docs/guides/client-schemas.md) |
vendored file, vendored | Apache-2.0, © SchemaStore contributors |
Gemini CLI settings schema (schemas/settings.schema.json at v0.63.0) |
Checks the Gemini CLI settings and hook files Praetor renders; vendored byte-identical under internal/clientschema/upstream/ and used at build and test time only (the binaries carry the generated types, not the schema files) |
vendored file, vendored | Apache-2.0, © Google LLC |
Codex config and hook schemas (codex-rs/core/config.schema.json and codex-rs/hooks/schema/generated/ at rust-v0.162.0) |
Checks the Codex hook files and payload fixtures and generates the Codex hook event types (internal/codexhook); vendored byte-identical under internal/clientschema/upstream/ and used at build and test time only (the binaries carry the generated types, not the schema files) |
vendored file, vendored | Apache-2.0, © OpenAI |
Model Context Protocol schema (schema/2025-11-25/schema.json) |
Checks the standards-mcp responses and generates the MCP message types (internal/mcpwire); vendored byte-identical under internal/clientschema/upstream/ and used at build and test time only (the binaries carry the generated types, not the schema files) |
vendored file, vendored | MIT, © 2024–2025 Anthropic, PBC and contributors; the LICENSE file at tag 2025-11-25 states MIT |
opencode config schema (hosted https://opencode.ai/config.json, observed beside release v1.18.35) |
Checks the opencode.json MCP projection Praetor renders; vendored byte-identical under internal/clientschema/upstream/ and used at build and test time only (the binaries carry the generated types, not the schema files) |
vendored file, vendored | MIT, © 2025 opencode |
| markdownlint 0.41.1 | Markdown linting; the Markdown gate's manifest and lock are embedded and installed, and verify.mjs calls the library. Its configuration file keeps the name and the output format of markdownlint-cli2, which the gate ran before |
dependency, integrated | MIT, © David Anson |
| jsonc-parser 3.3.1 | Parses inline markdownlint-configure-file comments written as JSONC, pinned in the same lock |
dependency, integrated | MIT, © Microsoft |
| smol-toml 1.9.0 | Parses inline markdownlint-configure-file comments written as TOML, pinned in the same lock |
dependency, integrated | BSD-3-Clause, © Squirrel Chat et al. |
| js-yaml 5.4.3 | Parses YAML for the Markdown gate, pinned in the same lock | dependency, integrated | MIT, © 2011–2015 Vitaly Puzrin |
| micromark 4.0.3 | Markdown parsing, pinned in the same lock | dependency, integrated | MIT, © Titus Wormer |
| micromark-extension-mdxjs 3.0.0 | MDX syntax for the same parser, pinned in the same lock | dependency, integrated | MIT, © 2020 Titus Wormer |
| parse5 8.0.1 | HTML parsing, pinned in the same lock | dependency, integrated | MIT, © 2013–2019 Ivan Nikulin |
Dev Container CLI (@devcontainers/cli 0.89.0) |
Builds a repository's devcontainer for the gate; the binaries embed its manifest and lock (internal/devcontainer/cli.go) and install it into the tool cache |
tool, integrated | MIT, © Microsoft Corporation |
interfig (hindsight-interfig/ in vectorize-io/hindsight) |
Draws the interactive figures on this site; vendored byte-identical at commit ccfe85b4851957ac2adf88b4a9ddf9668b2882f1 in tools/figures/third_party/interfig/. The binaries embed its render source and the figure player that bundles it (tools/figures/assets.go) |
vendored file, vendored | MIT, © 2025 Vectorize AI, Inc. Its vendored package.json names Vite, @vitejs/plugin-react and Prettier (MIT each) as development dependencies; no code of theirs is reproduced, and praetor's figure build does not install them |
| React 19.3.1, with react-dom 19.3.1 and scheduler 0.28.0 | Bundled with interfig into the figure player (tools/figures/player/player.js) that the binaries embed and this site loads |
dependency, shipped | MIT, © Meta Platforms, Inc. and affiliates |
| Aegis-OS Concordia tokens Commit 5f8e9a23933f9a612c5c1b1c1324250c9b3c0606; Aegis: protective shield, pronounced EE-jis; Concordia: Latin for harmony, kon-KOR-dee-ah | Colour, typography, spacing, reduced motion and 3 px focus tokens; semantic aliases and dark-theme adaptation in the console | vendored file, adapted | EUPL-1.2, © 2026 Lusoris |
| sveltesentio ui 0.8.0, realtime 0.7.0 | The console's UI components and its live-update client (server-sent events), bundled into the console build | dependency, integrated | EUPL-1.2 |
| Svelte 5.57.2 | The console's component framework; its compiled runtime is part of the console build | dependency, integrated | MIT |
| SvelteKit kit 3.1.0, adapter-static 4.0.0 | The console's application framework and its static adapter; its client runtime is part of the console build | dependency, integrated | MIT |
| Ajv 8.20.0 | Compiles console.schema.json into standalone validators at build time, so the browser checks every data file against the schema; one Ajv runtime helper is part of the console build | dependency, integrated | MIT, © Evgeny Poberezkin |
Container and development images
| Project | Use | Kind and relation | License |
|---|---|---|---|
| Distroless | Runtime base of the published container image (Dockerfile) and of the Go Dockerfile template (templates/go/Dockerfile.distroless.tmpl) |
image, shipped | Apache-2.0 |
| golang Docker Official Image | Build stage of the devcontainer bootstrap (.devcontainer/Dockerfile.praetor), of the Go Dockerfile template, and base of the development image (docker/dev/Dockerfile) |
image, integrated | BSD-3-Clause |
| Dev Container images | mcr.microsoft.com/devcontainers/base, the base of this repository's devcontainer and of the one adoption writes (internal/devcontainer/bootstrap.go) |
image, integrated | MIT |
| Dev Container Features | The common-utils, go and node features the devcontainers install (.devcontainer/devcontainer.json, internal/devcontainer/devcontainer.go) |
image, integrated | MIT |
Documentation presets
The presets in docs/presets/ are copied into an adopting repository and build its site with
these packages, which the preset's lists pin: docs/presets/mkdocs/requirements.in and
docs/presets/starlight/package.json.
An adopter who copies the Starlight preset and runs npm ci receives every package of
docs/presets/starlight/package-lock.json, each with its own license file. The preset ships in
this repository only: praetor's binaries embed neither its manifest and lock nor the packages.
Most are under MIT, Apache-2.0, ISC or a BSD license. Two are weak copyleft, and their entries
below follow the lock: the prebuilt libvips that sharp installs per platform
(@img/sharp-libvips-*, also inside @img/sharp-win32-* and @img/sharp-wasm32) is
LGPL-3.0-or-later, and Lightning CSS with its platform binaries is
MPL-2.0. The lock also holds BlueOak-1.0.0, CC0-1.0, Python-2.0 and 0BSD packages. To count the
licenses the lock records:
| Project | Use | Kind and relation | License |
|---|---|---|---|
MkDocs (mkdocs) |
docs/presets/mkdocs: the site generator; it builds this site too |
dependency, integrated | BSD-2-Clause |
Material for MkDocs (mkdocs-material) |
docs/presets/mkdocs: the theme, whose base.html the preset's overrides/main.html extends; this site uses it too. It bundles the icons and loads the fonts listed under Fonts and icons |
dependency, integrated | MIT |
mkdocs-minify-plugin (mkdocs-minify-plugin) |
docs/presets/mkdocs: HTML, CSS and JavaScript minification |
dependency, integrated | MIT |
PyMdown Extensions (pymdown-extensions) |
docs/presets/mkdocs: the pymdownx Markdown extensions |
dependency, integrated | MIT |
Astro (astro, @astrojs/sitemap) |
docs/presets/starlight: the site framework and its sitemap integration |
dependency, integrated | MIT |
Starlight (@astrojs/starlight) |
docs/presets/starlight: the documentation theme, whose head the preset's src/components/SEOHead.astro overrides |
dependency, integrated | MIT |
sharp (sharp) |
docs/presets/starlight: image processing for Astro's image service |
dependency, integrated | Apache-2.0 AND LGPL-3.0-or-later, sharp itself is Apache-2.0; the prebuilt platform package npm installs beside it carries libvips and its dependencies under LGPL-3.0-or-later (@img/sharp-libvips-*, and inside @img/sharp-win32-* and @img/sharp-wasm32), so an adopter who copies the preset receives that LGPL binary with its license |
Lightning CSS (lightningcss) |
docs/presets/starlight: CSS processing in the site build |
dependency, integrated | MPL-2.0, with its platform binaries lightningcss-*; Vite requires it, so the Starlight preset lock installs it |
TypeScript (typescript) |
docs/presets/starlight: type checking, a development dependency; it also checks the figure tooling and builds the VS Code extension |
dependency, integrated | Apache-2.0 |
GitHub Actions
The workflows in .github/workflows/ and the composite actions in .github/actions/ run these
actions, and the CI templates adoption writes (templates/<language>/*.tmpl) reference the ones
whose use names a template.
| Project | Use | Kind and relation | License |
|---|---|---|---|
| actions/cache | Workflows; Go CI templates | action, used by CI | MIT |
| actions/checkout | Workflows; every CI template | action, used by CI | MIT |
| actions/deploy-pages | Workflows | action, used by CI | MIT |
| actions/setup-go | Workflows; Go CI templates | action, used by CI | MIT |
| actions/setup-java | JVM CI template | action, integrated | MIT |
| actions/setup-node | Workflows; Node CI template | action, used by CI | MIT |
| actions/setup-python | Workflows | action, used by CI | MIT |
| actions/upload-artifact | Workflows; per-test timing files of the portability matrix | action, used by CI | MIT |
| actions/upload-pages-artifact | Workflows | action, used by CI | MIT |
| anchore/sbom-action | Workflows: installs Syft | action, used by CI | Apache-2.0 |
| Azure/setup-helm | Workflows: installs Helm | action, used by CI | MIT |
| docker/login-action | Workflows | action, used by CI | Apache-2.0 |
| docker/setup-buildx-action | Workflows | action, used by CI | Apache-2.0 |
| github/codeql-action | Workflows: CodeQL code scanning | action, used by CI | MIT |
| goreleaser/goreleaser-action | Workflows | action, used by CI | MIT |
| oven-sh/setup-bun | Node CI template | action, integrated | MIT |
| sigstore/cosign-installer | Workflows: installs Cosign | action, used by CI | Apache-2.0 |
| subosito/flutter-action | Flutter CI template | action, integrated | MIT |
Integrations
Forges, model servers, services, toolchains and agent clients praetor reads, writes, calls or configures. Praetor ships none of their code.
| Project | Use | Kind and relation | License |
|---|---|---|---|
| GitHub | The forge praetor's issue, pull-request, ruleset, project and Actions commands drive through the GitHub REST and GraphQL APIs (internal/forge/github.go) |
integration, integrated | proprietary, a hosted service used under GitHub's terms |
| Gitea | Forge provider: the forge commands against a Gitea API (internal/forge/gitea.go) |
integration, integrated | MIT |
| Forgejo | Forge provider through the Gitea-compatible API (internal/forge/gitea.go) |
integration, integrated | GPL-3.0-or-later, from Forgejo 9.0; earlier releases are MIT |
| GitLab | Forge provider: the forge commands against the GitLab API (internal/forge/gitlab.go) |
integration, integrated | MIT, outside ee/ and jh/, which carry their own licenses; doc/ is CC BY-SA 4.0 |
| Hindsight | Memory server the hindsight commands and MCP tools read and write (internal/hindsight); interfig, above, comes from the same repository |
integration, integrated | MIT, © 2025 Vectorize AI, Inc. |
| LiteLLM | Model gateway whose catalog the model router syncs and whose response-cost header repair runs read | integration, integrated | MIT, © 2023 Berri AI; enterprise/ carries its own license |
| Ollama | Local model server whose installed models the router discovers (internal/router/discovery.go) |
integration, integrated | MIT |
| vLLM | OpenAI-compatible model server whose models the router discovers (internal/router/discovery.go) |
integration, integrated | Apache-2.0 |
| OpenVINO | Named by the Python ML flavor, which audits PyTorch and OpenVINO pipelines (internal/flavor/definitions.go) |
integration, integrated | Apache-2.0 |
| Paperclip | Agent control plane the adoption policy, the harness (internal/paperclip) and the paperclip-operate skill integrate with; the skill's rules are praetor's own |
integration, integrated | MIT |
| NotebookLM | Planning notebooks: praetor prepares source snapshots for it (internal/notebook) and exports to it (scripts/notebooklm_export.py) |
integration, integrated | proprietary, a Google service used under Google's terms |
| Zig | The needs analyzer reads Zig builds (build.zig) and their package manifests (build.zig.zon) |
integration, integrated | MIT |
| Trivy | Vulnerability scanner the container, OS-image and infrastructure archetypes name; the generated devcontainers install its editor extension | integration, integrated | Apache-2.0 |
| Node.js | Runs the Markdown gate, the figure build and the devcontainer CLI; praetorctl downloads the release internal/devcontainer/cli/node.json pins from nodejs.org |
tool, integrated | MIT, © Node.js contributors; each release archive carries the licenses of the dependencies it bundles |
| Git | praetorctl runs git for every repository read and write | tool, integrated | GPL-2.0-only |
| Visual Studio Code | The praetor extension in editors/vscode runs in it, and adoption writes its workspace settings |
integration, integrated | MIT, the Code - OSS source; Microsoft's Visual Studio Code builds ship under the Microsoft product license |
| JetBrains IDEs | praetorctl editors generate writes their inspection profile and workspace settings (.idea/) |
integration, integrated | proprietary, JetBrains products used under their terms; the open-source builds of IntelliJ IDEA and PyCharm are Apache-2.0 under the JetBrains Open-Source Build Terms |
| Neovim | praetorctl editors generate writes its project configuration (.nvim.lua, lua/standards.lua) |
integration, integrated | Apache-2.0 AND Vim, © Neovim contributors; the parts contributed under the Vim license keep it |
| Zed | praetorctl editors generate writes its settings and tasks (.zed/) |
integration, integrated | GPL-3.0-or-later, the editor's license; upstream marks its Apache-2.0 components |
| Helix | praetorctl editors generate writes its configuration and languages (.helix/) |
integration, integrated | MPL-2.0 |
| GNU Emacs | praetorctl editors generate writes its directory variables (.dir-locals.el) |
integration, integrated | GPL-3.0-or-later |
| Fleet | praetorctl editors generate writes its settings and run configurations (.fleet/) |
integration, integrated | proprietary, a JetBrains product used under its terms |
| Sublime Text | praetorctl editors generate writes its project file (standards.sublime-project) |
integration, integrated | proprietary, a Sublime HQ product used under its license |
| Visual Studio | praetorctl editors generate writes the .clang-tidy its code analysis reads |
integration, integrated | proprietary, a Microsoft product used under its license terms |
| Claude Code | Agent client praetor compiles agent context for and configures | integration, integrated | proprietary, © Anthropic PBC; used under Anthropic's Commercial Terms of Service |
| Codex CLI | Agent client praetor compiles agent context for and configures | integration, integrated | Apache-2.0 |
| Gemini CLI | Agent client praetor compiles agent context for and configures | integration, integrated | Apache-2.0 |
| Antigravity | Agent client praetor compiles agent context for and configures | integration, integrated | proprietary, a Google product used under Google's terms |
| Cline | Agent client praetor compiles agent context for and configures | integration, integrated | Apache-2.0 |
| Continue | Agent client praetor compiles agent context for and configures | integration, integrated | Apache-2.0 |
| Kilo Code | Agent client praetor compiles agent context for and configures | integration, integrated | MIT |
| OpenCode | Agent client praetor compiles agent context for and configures | integration, integrated | MIT |
| Cursor | Agent client praetor compiles agent context for and configures | integration, integrated | proprietary, a product of Anysphere used under its terms |
| Windsurf | Agent client praetor compiles agent context for and configures | integration, integrated | proprietary, used under its provider's terms |
| GitHub Copilot | Agent client praetor compiles agent context for and configures | integration, integrated | proprietary, a GitHub service used under GitHub's terms |
Specifications and standards
| Project | Use | Kind and relation | License |
|---|---|---|---|
| The Power of 10 rules (Gerard J. Holzmann, NASA JPL; IEEE Computer 39(6):95–97, 2006, doi:10.1109/MC.2006.212) | The basis of the HISS invariants | specification, inspired | none |
| Semantic Versioning 2.0.0 | Version comparison and release tags | specification, integrated | CC-BY-3.0 |
| Conventional Commits 1.0.0 | Commit subjects and the commit check | specification, integrated | MIT, © 2018 Conventional Changelog |
| Keep a Changelog 1.1.0 | Changelog sections | specification, integrated | MIT, © 2014 Olivier Lacan |
| Developer Certificate of Origin 1.1 | The Signed-off-by requirement |
specification, integrated | none, © 2004, 2006 The Linux Foundation and its contributors; everyone may copy it verbatim |
| SLSA v1.0 | Release provenance | specification, integrated | Community-Spec-1.0 |
| in-toto Attestation Framework v1 | The provenance statement format | specification, integrated | Apache-2.0 |
| CycloneDX | The SBOM format praetorctl sbom writes |
specification, integrated | Apache-2.0 |
| SPDX | License identifiers and the SBOM format Syft writes during a release | specification, integrated | Community-Spec-1.0, older portions CC BY 3.0 |
| Model Context Protocol | The MCP servers | specification, integrated | Apache-2.0, moving from MIT; parts not yet relicensed stay MIT |
| Schema.org | JSON-LD in the documentation presets | specification, integrated | CC-BY-SA-3.0 |
| EditorConfig | Editor settings the adoption writes | specification, integrated | BSD-2-Clause, © 2019 EditorConfig Team |
| AGENTS.md | The canonical agent instruction file | specification, integrated | MIT, © 2025 OpenAI |
| SARIF 2.1.0 | The static-analysis result format whose compiler and linter logs praetor distills (internal/lockdown) |
specification, integrated | LicenseRef-OASIS-IPR-Policy, © OASIS Open; published under the OASIS IPR Policy in its RF on RAND terms mode |
| C4 model | The levels of the architecture views (docs/architecture/c4-models.md) |
specification, inspired | CC-BY-4.0, Simon Brown |
| OSV schema | The vulnerability entry format the Go vulnerability gate reads from govulncheck's stream (internal/govuln) |
specification, integrated | Apache-2.0 |
Fonts and icons
Material for MkDocs bundles these icon sets and loads these fonts from Google Fonts for this site
and for the MkDocs preset. Neither site sets theme.font: false, so a visitor's browser fetches
the fonts from Google.
| Project | Use | Kind and relation | License |
|---|---|---|---|
| Material Design Icons | The theme toggle icons of this site and of the MkDocs preset (material/ icons in mkdocs.yml), bundled by Material for MkDocs |
font or icon, integrated | LicenseRef-Pictogrammers-Free-License AND Apache-2.0, Pictogrammers; some icons are redistributed under Apache-2.0, as the upstream license states |
| Font Awesome Free | The GitHub icon in this site's footer (fontawesome/brands/github in mkdocs.yml), bundled by Material for MkDocs |
font or icon, integrated | CC-BY-4.0, for the icons; Font Awesome Free fonts are OFL-1.1 and its code MIT |
| Roboto | Body font of this site and of the MkDocs preset: Material for MkDocs loads it from Google Fonts unless theme.font is false |
font or icon, integrated | OFL-1.1, Christian Robertson, ParaType, Font Bureau |
| Roboto Mono | Code font of this site and of the MkDocs preset, loaded the same way | font or icon, integrated | OFL-1.1, Christian Robertson |
Build and CI tooling
These run in the build, the hooks or CI, and the download declarations name what CI fetches outside a manifest. None of them ships in the binaries.
| Project | Use | Kind and relation | License |
|---|---|---|---|
| Lefthook | Git hooks; CI and the cloud session bootstrap build the tool of tools/lefthook/go.mod |
tool, used by CI | MIT |
| GoReleaser | Release archives, the container image and checksums | tool, used by CI | MIT |
| golangci-lint | Go linting: make lint runs the tool of tools/lint/go.mod; the pre-push hook still runs its latest release (#1416) |
tool, used by CI | GPL-3.0-only, the upstream LICENSE is the GPL version 3 text, with no notice granting later versions |
| gosec | Go security scan, a tool of tools/go/go.mod |
tool, used by CI | Apache-2.0 |
| Gitleaks | Secret scan, a tool of tools/go/go.mod |
tool, used by CI | MIT |
| govulncheck | Go vulnerability scan, a tool of tools/go/go.mod |
tool, used by CI | BSD-3-Clause, © The Go Authors |
| gofumpt | Format-checks the Go managed assets adoption copies, a tool of tools/go/go.mod |
tool, used by CI | BSD-3-Clause, © 2019, Daniel Martí |
| shfmt | Checks that every shell script adoption emits keeps the layout shfmt -i 2 -ci writes, a tool of tools/go/go.mod |
tool, used by CI | BSD-3-Clause, © 2016, Daniel Martí |
| Semgrep | Static analysis rules | tool, used by CI | LGPL-2.1-or-later, the license expression of the PyPI release |
| Black | Formats the hook sources adoption copies (.config/hook-lint/requirements.in) |
tool, used by CI | MIT |
| Flake8 | Lints the hook sources adoption copies | tool, used by CI | MIT |
| Ruff | Lints and format-checks the Python managed assets adoption copies | tool, used by CI | MIT |
| yamllint | Lints the YAML praetor emits and the portability job's YAML | tool, used by CI | GPL-3.0-or-later |
| ShellCheck | Lints the shell hooks; the portability job downloads a pinned release | tool, used by CI | GPL-3.0-or-later, the notice of every upstream source file |
| Cosign | Keyless signing and verification | tool, used by CI | Apache-2.0 |
| Syft | SBOM generation | tool, used by CI | Apache-2.0 |
| Helm | Lints, packages and pushes the chart in deploy/helm/praetor during a release |
tool, used by CI | Apache-2.0 |
| Renovate | Dependency update proposals; renovate.json extends its built-in presets config:recommended, :dependencyDashboard, :semanticCommits and :maintainLockFilesWeekly, and CI installs it to validate the configuration |
tool, used by CI | AGPL-3.0-only |
| REUSE | License compliance check (reuse lint), installed from a hash-pinned lock in CI and in the emitted REUSE workflow | tool, used by CI | Apache-2.0 AND CC0-1.0 AND CC-BY-SA-4.0 AND GPL-3.0-or-later, the license expression of the PyPI release |
| Chromium | The browser Playwright downloads in CI to render and check the documentation figures | tool, used by CI | BSD-3-Clause, © 2015 The Chromium Authors |
| Probity | Optional test-first edit guard for AI coding assistants | tool, used by CI | MIT |
| jscpd 5.4.2 | Copy/paste detector for foreign code deduplication in C, C++, CUDA, Python, Rust, shell, and YAML | tool, integrated | MIT, © 2013–2024 Andrey Kucherenko |
Development dependencies
Development dependencies of the figure tooling (tools/figures/package.json) and the VS Code
extension (editors/vscode/package.json), and the packages the vendored interfig manifest names.
| Project | Use | Kind and relation | License |
|---|---|---|---|
jsonschema (v6.0.3) |
The JSON Schema oracle of the test-only module tools/schemacheck; the production module does not link it |
dependency, used by CI | Apache-2.0 |
go-toml v2 (v2.4.3) |
TOML reading for validating Codex configurations against JSON Schema in the test-only module tools/schemacheck; the production module does not link it |
dependency, used by CI | MIT, © 2021–2023 Thomas Pelletier |
go-yaml v3 (gopkg.in/yaml.v3 v3.0.1) |
YAML parsing for validating rendered client configurations in test-only module tools/schemacheck; the production module does not link it |
dependency, used by CI | MIT AND Apache-2.0, MIT for the files ported from libyaml, © 2006–2011 Kirill Simonov; Apache-2.0 for the rest, © 2011–2019 Canonical Ltd |
| esbuild | Bundles the figure player from tools/figures/package-lock.json |
tool, used by CI | MIT |
| Playwright | Drives the browser of the figure checks; the vendored interfig manifest names it as well | tool, used by CI | Apache-2.0 |
Sätteri (satteri) |
Markdown and MDX processing of the figures' Astro integration (tools/figures/astro.mjs) and its tests |
dependency, used by CI | MIT |
| DefinitelyTyped | Type declarations (@types/react, @types/react-dom, @types/node, @types/vscode) for the figure tooling and the VS Code extension |
dependency, used by CI | MIT |
| vscode-languageclient | The language client of the praetor VS Code extension (editors/vscode) |
dependency, integrated | MIT |
| Tailwind CSS 4.3.3 | Generates the console's stylesheet at build time | tool, used by CI | MIT |
| vite-plugin-svelte 7.3.1 | Compiles the console's Svelte components in the Vite build | tool, used by CI | MIT |
| svelte-check 4.7.7 | Type and template checks of the console (pnpm check) |
tool, used by CI | MIT, © The Svelte Community |
| Vitest 5.0.5 | Runs the console's unit tests and the planted bundle-budget overrun | tool, used by CI | MIT, © Anthony Fu |
| Svelte Testing Library 5.4.2 | Renders console components in the unit tests | tool, used by CI | MIT |
| jsdom 30.1.3 | The DOM environment of the console's unit tests | tool, used by CI | MIT |
| Playwright 1.56.1 | Drives the console's accessibility and keyboard tests in Chromium and renders its screenshots | tool, used by CI | Apache-2.0, © Microsoft Corporation |
| axe-core 4.14.0 | The accessibility rules engine (WCAG 2.2 AA) of the console's accessibility tests | tool, used by CI | MPL-2.0 |
| axe-core Playwright integration 4.14.0 | Runs axe-core inside the console's Playwright tests | tool, used by CI | MPL-2.0 |
| ESLint eslint 10.13.0, @eslint/js 10.0.1 | Lints the console's TypeScript and Svelte sources (pnpm lint) |
tool, used by CI | MIT, © Nicholas C. Zakas |
| eslint-plugin-svelte 3.23.1 | ESLint rules for the console's Svelte components | tool, used by CI | MIT, © Yosuke Ota |
| typescript-eslint 8.72.0 | ESLint rules and parser for the console's TypeScript | tool, used by CI | MIT |
| globals 17.13.0 | Browser and Node global names for the console's ESLint configuration | tool, used by CI | MIT, © Sindre Sorhus |
| prettier-plugin-svelte 4.1.1 | Formats the console's Svelte components in the formatting check | tool, used by CI | MIT, © James Birtles |